NotebookLMSAFE
MCP server for NotebookLM - Let your AI agents (Claude Code, Codex) research documentation directly with grounded, citation-backed answers from Gemini. Persistent auth, library management, cross-client sharing. Zero hallucinations, just your knowledge base.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[!WARNING] This project is no longer maintained. As of September 2026 the repository is archived: no updates, bug fixes or support. The npm package will not receive further releases. It may stop working when the upstream services change. Feel free to fork.
[](https://www.npmjs.com/package/notebooklm-mcp) [](https://www.typescriptlang.org/) [](https://modelcontextprotocol.io/) [](./LICENSE)
MCP server for Google NotebookLM. It drives a real Chrome via Patchright (stealth + persistent fingerprint) so an agent can chat against a notebook, ingest sources, generate audio overviews, and read DOM-level citations. Two transports are supported: stdio (default) and Streamable-HTTP. v2.0.0 is the current line; v1 is no longer supported.
- Requirements
- Install
- Connect — Claude Code, Cursor, Codex, generic MCP
- Authentication
- Transports
- Multi-account
- Tools
- Profiles
- Citations
- Provenance & AI marker
- Configuration reference
- Development
- Migration from v1
Requirements & Platform Support
- Node.js ≥ 18.
- Chrome (stable channel) preferred. The bundled Patchright Chromium is used as a fallback when Chrome refuses to launch — set
BROWSER_CHANNEL=chromiumto force it. - Linux / macOS / Windows.
- WSL2 + WSLg (Windows 11+) is fully supported. WSL1 cannot launch a Chromium and is not supported — upgrade to WSL2.
- Headless Linux servers: the one-time
setup_authneeds a display because the logi
10f1dbe07147OBSERVED · 2026-09-22Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add notebooklm-mcp --env LOGIN_PASSWORD=${LOGIN_PASSWORD} -- npx -y [email protected]{
"mcpServers": {
"notebooklm-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"LOGIN_PASSWORD": "${LOGIN_PASSWORD}"
}
}
}
}Exposed tools (19)
12 read · 5 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
add_notebook | write | Register a NotebookLM notebook in the local library so it can be |
add_source | write | Ingest a source into a NotebookLM notebook. Supports two source types |
cleanup_data | read | Two-phase deep cleanup of all server data on disk (auth state, |
close_session | read | Permanently close a session and discard its browser tab. Use the |
download_audio | write | Save the completed Audio Overview to disk as a |
generate_audio | write | Trigger podcast-style Audio Overview generation for a notebook.\n\n |
get_audio_status | read | Non-blocking probe for the current Audio Overview state of a notebook.\n\n |
get_health | read | Inspect server state. Returns:\n |
get_library_stats | read | Aggregate statistics about the local notebook library: |
get_notebook | read | Fetch full metadata for one notebook by id. Use to verify what |
list_notebooks | read | List every notebook in the local library with its metadata |
list_sessions | read | List all active browser sessions for this server. Each entry includes |
re_auth | read | Switch to a different Google account or recover from broken auth. |
remove_notebook | destructive | Remove a notebook from the local library. **Does NOT delete the |
reset_session | destructive | Clear a session |
search_notebooks | read | Search the library by free-text query — matches against |
select_notebook | read | Mark a notebook as the active default. After this, |
setup_auth | read | Open a browser window for first-time Google login. Returns immediately |
update_notebook | write | Patch metadata fields on an existing notebook. Pass |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (7)
remove_notebook, reset_session
.prettierignore
.prettierrc.json
import type { NotebookLibrary } from "../../library/notebook-library.js";import { getTopicsLine, getUseCaseBullets } from "../../library/metadata.js";@modelcontextprotocol/sdk, dotenv, env-paths, globby, patchright, zod, @eslint/js, @types/node
The server uses the MCP SDK's `StreamableHTTPServerTransport`, which manages session lifecycle through the `Mcp-Session-Id` response/request header. A new session is created when the first `POST /mcp`
Gates applied: no_behavioural_pass.
10f1dbe07147full audit observations/trust-audit/mcp-server/pleaseprompto__notebooklm-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-09-22 | 10f1dbe07147 | SAFE | B | 89 | source changed, verdict held |
Questions
What is the NotebookLM MCP server?
MCP server for NotebookLM - Let your AI agents (Claude Code, Codex) research documentation directly with grounded, citation-backed answers from Gemini. Persistent auth, library management, cross-client sharing. Zero hallucinations, just your knowledge base.
What tools does NotebookLM expose?
19 in total: 12 read-only, 5 that write, and 2 that can delete or overwrite (remove_notebook, reset_session). Every one is listed on this page with its risk.
Is NotebookLM safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does NotebookLM need?
It reads LOGIN_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does NotebookLM run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as notebooklm-mcp at 2.0.0.
How current is this page?
The grade is for one exact copy of the source (10f1dbe07147), read on 2026-09-22. The repository is watched and re-audited when it changes.