How to Connect LinkedIn Ads to Hermes Agent

Hermes has browser tools, so it could click through Campaign Manager for you. The cleaner route is an MCP server. Hermes' MCP docs describe MCP as the way to use tools that live outside Hermes itself, and it connects to servers running on your machine and to hosted ones in the same way.

AdPlug's LinkedIn Ads MCP is a hosted one. It works through LinkedIn's official Marketing API, so Hermes gets campaign data as numbers and never has to open Campaign Manager. Nothing runs next to Hermes: there is no package to install and no API key to store. Hermes signs in to AdPlug through your browser and keeps the token on its own disk.

• Hermes Agent. It is free and open source under the MIT licence, and you pay the model provider you point it at. It runs on macOS, Linux, WSL2, and Windows, from the command line or its desktop app. Hermes' install guide has the one-line installer.
• An AdPlug account. The free plan is enough to set this up and test it: view only, 500 requests in the first month and 50 a month after that, on one ad platform.
• Access to the ad account. A LinkedIn profile with Campaign Manager access to the ad accounts you want Hermes to work on. Viewer access is enough for reporting.
• A browser, once. The sign-in opens a web page. If Hermes runs on a server, read Hermes on a server before step 3.

Steps 1 and 2 happen in AdPlug. Steps 3 to 5 happen in a terminal on the machine where Hermes runs. Allow about ten minutes the first time. The commands follow the documentation for Hermes Agent v0.21.5, released on 24 September 2026.

1. 1

   Create your AdPlug account

   Go to adplug.app/signup, sign in with Google or email, and follow the short onboarding. It ends on your AdPlug dashboard.

   

2. 2

   Connect LinkedIn Ads to AdPlug

   On the dashboard, click Connect LinkedIn Ads and sign in with the LinkedIn profile that has Campaign Manager access to the ad accounts you want Hermes to work on. Every account that profile can manage becomes available through the one connection.

   

   Already past onboarding? The Connections page has the same button.

   

3. 3

   Add AdPlug to Hermes

   Hermes keeps its MCP servers in ~/.hermes/config.yaml (on native Windows the folder is %LOCALAPPDATA%\hermes) and has a command that writes the entry for you. Stay signed in to AdPlug in your browser, then run this on the machine where Hermes is installed:

   hermes mcp add adplug-linkedin-ads --url https://api.adplug.app/mcp/linkedin-ads --auth oauth

   Copy

   adplug-linkedin-ads is the name Hermes will use for the server, and you can pick another. --auth oauth tells Hermes that the server signs you in through the browser, so there is no key to paste.

   

4. 4

   Authorise the connection

   Hermes prints a sign-in link, opens your browser when it can, and waits about 30 seconds. If you are still signed in to AdPlug from step 2, that is one click on Approve.

   

   Back in the terminal, Hermes lists the tools it found, ten for the LinkedIn Ads server, and asks whether to enable them all. Answer Y, or type select to tick only the ones you want. Hermes then saves the server to its config and keeps the sign-in token under ~/.hermes/mcp-tokens/, so later sessions connect without asking.

   

   If Hermes says the connection timed out, 30 seconds was not enough. Answer N when it offers to save the config anyway, add the entry yourself (hermes config edit opens the file), and sign in with the command that waits five minutes:

   mcp_servers:
     adplug-linkedin-ads:
       url: "https://api.adplug.app/mcp/linkedin-ads"
       auth: oauth

   Copy

   hermes mcp login adplug-linkedin-ads

   Copy

   That is also the route to take when Hermes runs on a server, which the next section covers.

5. 5

   Test the connection

   Check the connection from the shell first:

   hermes mcp test adplug-linkedin-ads

   Copy

   It should report Connected and the number of tools it discovered. Then start Hermes with hermes (in a session that was already open, type /reload-mcp) and ask:

   “List my LinkedIn ad accounts.”

   Hermes calls the linkedin_ads_list_accounts tool and returns the ad accounts you can access, with currencies and statuses. If your accounts are listed, the connection works end to end.

   

Hermes is built to run on a small server and be reached from Telegram. The sign-in still needs a browser once, and the browser is on your laptop while Hermes is not. Hermes finishes the sign-in by catching a redirect to 127.0.0.1 on its own machine, which your laptop cannot reach, and working round that takes longer than the 30 seconds hermes mcp add allows.

So on a server, skip that command. Add the entry from step 4 to config.yaml by hand and run hermes mcp login adplug-linkedin-ads in an SSH session. It waits five minutes, and Hermes' OAuth over SSH guide gives three ways to finish.

• Paste the address back. Open the link on your laptop and approve. The browser then shows a connection error, which is expected. Copy the full address from the address bar and paste it at the prompt Hermes is waiting on.
• Forward the port. Hermes prints the port it is listening on. In a second terminal on your laptop run ssh -N -L PORT:127.0.0.1:PORT user@host with that port, then open the link as normal.
• Use the desktop app. If your Hermes desktop app is connected to the server, sign in from its MCP screen instead. The app receives the redirect on your computer and passes it on. Both the app and the server need to be up to date.

Hermes also has a device-code login for servers whose sign-in supports one. AdPlug does not offer it, so use one of the three above.

Two things catch people out. Sign in as the same system user and profile that runs the gateway, because the token is stored in that profile's Hermes folder. And a Hermes running in the background never opens a browser: if the sign-in ever stops refreshing, the server is parked with a warning in gateway.log until you run hermes mcp login adplug-linkedin-ads again.

LinkedIn's hierarchy is campaign group, then campaign, then creative (the ad). Name the level you mean and Hermes picks the right one. More copy-paste prompts live in the prompt playbooks.

Hermes has a built-in scheduler, which it calls cron. The simplest way to set a job up is to ask:

The same job from the shell, delivered to Telegram (0 8 * * 1 is cron notation for 8:00 every Monday):

hermes cron create "0 8 * * 1" "Use the adplug-linkedin-ads tools to pull last week's spend, impressions, clicks, and leads for every active campaign group in the Acme Software account, and compare them with the week before. Read only. Do not change anything." --name "LinkedIn Ads weekly" --deliver telegram

A scheduled job starts a fresh session with no memory of your chat, so the prompt has to say everything: which account, which dates, what to report. A job you ask for in Telegram or Slack reports back to that chat; one created in the terminal is saved to a file unless you name a channel, which is what --deliver telegram does.

Jobs are run by the Hermes gateway, so it has to be running: hermes gateway install and then hermes gateway start set it up as a background service. Times follow the server's clock unless you set timezone in config.yaml, so check which time zone the server is on.

Run a new job once before you rely on it (hermes cron run with the job's ID) and check the summary arrives. Every run also uses AdPlug requests, and the free plan drops to 50 a month after the first, so a job that runs most days needs a paid plan.

AdPlug gives Hermes two tools for campaign changes: a preview tool that returns the exact change without applying it, and an execute tool that applies it. That covers campaign groups, campaigns, budgets, targeting, and ads in nine formats, including Thought Leader Ads. The free plan is view only; creating and editing campaigns needs a paid AdPlug plan.

Hermes asks before it runs a risky shell command, but an MCP server you add is trusted by default and its tools run without a prompt. For an ad account, change that. Add one line to the AdPlug entry in config.yaml, then type /reload-mcp or restart the gateway so Hermes picks it up:

mcp_servers:
  adplug-linkedin-ads:
    url: "https://api.adplug.app/mcp/linkedin-ads"
    auth: oauth
    trust: untrusted

With that line, Hermes stops and asks you before every call to a tool that can change something. It goes by the labels on AdPlug's tools: the reporting, lookup, and preview tools are marked read-only and run freely, while the execute tool and the conversion event tool are not, so those two wait for your yes. The question appears wherever the conversation is, in the terminal or in a chat such as Telegram. Untrusted is Hermes' word, described in its MCP config reference. It means ask me first, not that the server is unsafe.

A scheduled job has nobody to ask, so a change it attempts under this setting is declined instead of run. Keep scheduled work to reporting and make changes in a conversation you are in. If Hermes should never be able to change the account, run hermes mcp configure adplug-linkedin-ads and untick linkedin_ads_execute_mutation and linkedin_ads_send_conversion_event.

Hermes can take messages from several people through one gateway, and they all act through the one AdPlug sign-in, so keep the list of people allowed to message it short. For a shared Hermes that should only report, sign it in with an AdPlug seat the account owner has set to View only. On the Max and Agency plans each teammate can be set to View only or Can edit per platform, and a View only seat is refused any change, whatever Hermes is asked.

Report calls and executed changes are recorded in your AdPlug Usage and Audit Log, so you can check what Hermes did while you were away.

Click any item to expand the answer.

The same AdPlug account connects other platforms and assistants.

Email support@adplug.app with setup questions or bug reports. Most replies come back the same business day.