Atlas / MCP servers / datalayer / jupyter-mcp-server

jupyter-mcp-serverBLOCK

Name: jupyter-mcp-server
Author: datalayer

mcp/datalayer/jupyter-mcp-server

MCP server by datalayer · ai · jupyter · mcp · Audited 2026-09-25

⚑ Report / re-scan Source ↗

🪐 🔧 Model Context Protocol (MCP) Server for Jupyter.

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

2 1r · 1w · 0d

Transport

stdio · streamable-http

License

BSD-3-Clause

Stars

1,286

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://github.com/sponsors/datalayer)

An [MCP](https://modelcontextprotocol.io) server developed for AI to connect and manage [Jupyter](https://jupyter.org) Notebooks in real-time — and scale your [Code Sandbox](https://jupyter-mcp-server.datalayer.tech/code-sandboxes) from local to the cloud (Datalayer, Kaggle, Google Colab, Modal, Daytona, E2B, CoreWeave, Cloudflare...)

Developed by [Datalayer](https://datalayer.ai) - Join our [Discord](https://discord.gg/YQFwvmSSuR)

[](https://pypi.org/project/jupyter-mcp-server) [](https://pepy.tech/project/jupyter-mcp-server) [](https://hub.docker.com/r/datalayer/jupyter-mcp-server) [](https://opensource.org/licenses/BSD-3-Clause)

[](https://datalayer.ai)

📖 Documentation · 🔧 Tools

Read from source at commit f36b91356ee4OBSERVED · 2026-09-25

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add jupyter-mcp-server-docs --env MCP_TOKEN=${MCP_TOKEN} -- npx -y @datalayer/[email protected]

claude-desktop

{
  "mcpServers": {
    "jupyter-mcp-server-docs": {
      "command": "npx",
      "args": [
        "-y",
        "@datalayer/[email protected]"
      ],
      "env": {
        "MCP_TOKEN": "${MCP_TOKEN}"
      }
    }
  }
}

Exposed tools (2)

1 read · 1 write · 0 destructive.

Tool	Risk	Description
`read_cell`	read	Read a cell.
`touch_the_notebook`	write	Publish, exactly as a writing tool

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: declared (10 observation(s))
Shell: declared (3 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (25)

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

jupyter_mcp_server/cli/commands/connect.py:109

typer.Option("--insecure-mcp-noauth", envvar="INSECURE_MCP_NOAUTH"),

Why it matters. certificate verification is disabled

Fix. leave verification on

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

jupyter_mcp_server/cli/commands/serve.py:245

help="Token for authenticating MCP clients (Bearer scheme). Required for streamable-http unless --insecure-mcp-noauth is set.",

Why it matters. certificate verification is disabled

Fix. leave verification on

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

jupyter_mcp_server/notifications.py:236

module = importlib.import_module(module_name)

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

jupyter_mcp_server/resources.py:103

module = importlib.import_module(module_name)

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

jupyter_mcp_server/tasks.py:313

module = importlib.import_module(module_name)

LOWInventory / provenance · inv.hidden_file · CWE-1104

.licenserc.yaml

.licenserc.yaml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.pre-commit-config.yaml

.pre-commit-config.yaml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

docs/.yarnrc.yml

.yarnrc.yml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

extensions/mcpb/.mcpbignore

.mcpbignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

.github/workflows/test.yml:37

importlib.import_module(mod.name)

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

tests/test_documented_features.py:471

exec("import ast\n" + text[start:end], namespace)  # noqa: S102

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

tests/test_tools.py:420

expected_result = eval(code_content)

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

tests/test_tools.py:425

expected_result = eval(code_content)

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

docs/src/components/HomepageFeatures.js:15

Svg: require('../../static/img/feature_1.svg').default,

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

docs/src/components/HomepageFeatures.js:25

Svg: require('../../static/img/feature_2.svg').default,

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

docs/src/components/HomepageFeatures.js:34

Svg: require('../../static/img/feature_3.svg').default,

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

docs/src/components/HomepageProducts.js:15

Svg: require('../../static/img/product_1.svg').default,

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

docs/src/components/HomepageProducts.js:24

Svg: require('../../static/img/product_2.svg').default,