Open NotebookBLOCK
MCP server for an Open Source implementation of Notebook LM: Open Notebook
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
An MCP (Model Context Protocol) server that provides tools to interact with the Open Notebook API. This server enables AI assistants like Claude to manage notebooks, sources, notes, search content, and interact with AI models through Open Notebook.
Features
- Notebooks Management: Create, read, update, and delete notebooks
- Sources Management: Add and manage content sources (links, uploads, text)
- Notes Management: Create and organize notes within notebooks
- Search & AI: Search content using vector/text search and ask questions
- Models Management: Configure and manage AI models
- Chat Sessions: Create and manage chat conversations
- Settings: Access and update application settings
- Progressive Disclosure: Efficient tool discovery with
search_capabilities
Installation
Using uv (recommended)
# Clone the repository git clone https://github.com/PiotrAleksander/open-notebook-mcp.git cd open-notebook-mcp # Install with uv uv sync
Using pip
pip install -e .
Configuration
The server requires configuration to connect to your Open Notebook instance:
Environment Variables
Create a .env file or set these environment variables:
# Required: URL of your Open Notebook instance OPEN_NOTEBOOK_URL=http://localhost:5055 # Optional: Authentication password (if APP_PASSWORD is set in Open Notebook) OPEN_NOTEBOOK_PASSWORD=your_password_here # Optional: Transport configuration (default: stdio) MCP_TRANSPORT=stdio # or streamable-http for remote deployment
Example Configuration
For local development with default Open Notebook settings:
# .env OPEN_NOTEBOOK_URL=http://localhost:5055
If you've configured authentication in Open Notebook:
# .env OPEN_NOTEBOOK_URL=http://localhost:5055 OPEN_NOTEBOOK_PASSWORD=my_secure_password
f9610a599300OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add open-notebook-mcp --env OPEN_NOTEBOOK_PASSWORD=${OPEN_NOTEBOOK_PASSWORD} -- None open-notebook-mcp==0.2.0Exposed tools (33)
17 read · 11 write · 5 destructive. Blast radius: 5 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
ask_question | read | Ask a question about your content with detailed control. |
ask_simple | read | Ask a question about your content with simplified interface. |
create_chat_session | write | Create a new chat session. |
create_model | write | Create a new AI model configuration. |
create_note | write | Create a new note. |
create_notebook | write | Create a new notebook. |
create_source | write | Create a new source (link, upload, or text). |
delete_chat_session | destructive | Delete a chat session. |
delete_model | destructive | Delete a model configuration. |
delete_note | destructive | Delete a note. |
delete_notebook | destructive | Delete a notebook. |
delete_source | destructive | Delete a source. |
execute_chat | write | Send a message in a chat session. |
get_chat_context | read | Build context for a chat conversation. |
get_chat_session | read | Get a specific chat session by ID. |
get_default_models | read | Get default model configurations. |
get_model | read | Get a specific model by ID. |
get_note | read | Get a specific note by ID. |
get_notebook | read | Get a specific notebook by ID. |
get_settings | read | Get application settings. |
get_source | read | Get a specific source by ID. |
list_chat_sessions | read | Get all chat sessions with optional filtering. |
list_models | read | Get all configured AI models. |
list_notebooks | read | Get all notebooks with optional filtering and ordering. |
list_notes | read | Get all notes with optional filtering. |
list_sources | read | Get all sources with optional filtering. |
search | read | Search content using vector or text search. |
search_capabilities | read | Search tools exposed by this server with progressive detail levels. |
update_chat_session | write | Update a chat session. |
update_note | write | Update a note. |
update_notebook | write | Update a notebook. |
update_settings | write | Update application settings. |
update_source | write | Update a source. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (7 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (4)
sudo \
delete_chat_session, delete_model, delete_note, delete_notebook, delete_source
# Edit .env with your Open Notebook instance URL and password
system use found in code, not declared in the description
Gates applied: no_behavioural_pass.
f9610a599300full audit observations/trust-audit/mcp-server/epochal-dev__open-notebook.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | f9610a599300 | BLOCK | D | 69 | first audit |
Questions
What is the Open Notebook MCP server?
MCP server for an Open Source implementation of Notebook LM: Open Notebook
What tools does Open Notebook expose?
33 in total: 17 read-only, 11 that write, and 5 that can delete or overwrite (delete_chat_session, delete_model, delete_note, delete_notebook, delete_source). Every one is listed on this page with its risk.
Is Open Notebook safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 5 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Open Notebook need?
It reads OPEN_NOTEBOOK_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Open Notebook run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as open-notebook-mcp.
How current is this page?
The grade is for one exact copy of the source (f9610a599300), read on 2026-10-08. The repository is watched and re-audited when it changes.