notebooklm-mcpSAFE
MCP server for NotebookLM - Let your AI agents (Claude Code, Codex) research documentation directly with grounded, citation-backed answers from Gemini. Persistent auth, library management, cross-client sharing. Zero hallucinations, just your knowledge base.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[!WARNING] This project is no longer maintained. As of September 2026 the repository is archived: no updates, bug fixes or support. The npm package will not receive further releases. It may stop working when the upstream services change. Feel free to fork.
[](https://www.npmjs.com/package/notebooklm-mcp) [](https://www.typescriptlang.org/) [](https://modelcontextprotocol.io/) [](./LICENSE)
MCP server for Google NotebookLM. It drives a real Chrome via Patchright (stealth + persistent fingerprint) so an agent can chat against a notebook, ingest sources, generate audio overviews, and read DOM-level citations. Two transports are supported: stdio (default) and Streamable-HTTP. v2.0.0 is the current line; v1 is no longer supported.
- Requirements
- Install
- Connect — Claude Code, Cursor, Codex, generic MCP
- Authentication
- Transports
- Multi-account
- Tools
- Profiles
- Citations
- Provenance & AI marker
- Configuration reference
- Development
- Migration from v1
Requirements & Platform Support
- Node.js ≥ 18.
- Chrome (stable channel) preferred. The bundled Patchright Chromium is used as a fallback when Chrome refuses to launch — set
BROWSER_CHANNEL=chromiumto force it. - Linux / macOS / Windows.
- WSL2 + WSLg (Windows 11+) is fully supported. WSL1 cannot launch a Chromium and is not supported — upgrade to WSL2.
- Headless Linux servers: the one-time
setup_authneeds a display because the logi
10f1dbe07147OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add notebooklm-mcp --env LOGIN_PASSWORD=${LOGIN_PASSWORD} -- npx -y [email protected]{
"mcpServers": {
"notebooklm-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"LOGIN_PASSWORD": "${LOGIN_PASSWORD}"
}
}
}
}Exposed tools (19)
12 read · 5 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
add_notebook | write | Register a NotebookLM notebook in the local library so it can be |
add_source | write | Ingest a source into a NotebookLM notebook. Supports two source types |
cleanup_data | read | Two-phase deep cleanup of all server data on disk (auth state, |
close_session | read | Permanently close a session and discard its browser tab. Use the |
download_audio | write | Save the completed Audio Overview to disk as a |
generate_audio | write | Trigger podcast-style Audio Overview generation for a notebook.\n\n |
get_audio_status | read | Non-blocking probe for the current Audio Overview state of a notebook.\n\n |
get_health | read | Inspect server state. Returns:\n |
get_library_stats | read | Aggregate statistics about the local notebook library: |
get_notebook | read | Fetch full metadata for one notebook by id. Use to verify what |
list_notebooks | read | List every notebook in the local library with its metadata |
list_sessions | read | List all active browser sessions for this server. Each entry includes |
re_auth | read | Switch to a different Google account or recover from broken auth. |
remove_notebook | destructive | Remove a notebook from the local library. **Does NOT delete the |
reset_session | destructive | Clear a session |
search_notebooks | read | Search the library by free-text query — matches against |
select_notebook | read | Mark a notebook as the active default. After this, |
setup_auth | read | Open a browser window for first-time Google login. Returns immediately |
update_notebook | write | Patch metadata fields on an existing notebook. Pass |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (7)
remove_notebook, reset_session
.prettierignore
.prettierrc.json
import type { NotebookLibrary } from "../../library/notebook-library.js";import { getTopicsLine, getUseCaseBullets } from "../../library/metadata.js";@modelcontextprotocol/sdk, dotenv, env-paths, globby, patchright, zod, @eslint/js, @types/node
The server uses the MCP SDK's `StreamableHTTPServerTransport`, which manages session lifecycle through the `Mcp-Session-Id` response/request header. A new session is created when the first `POST /mcp`
Gates applied: no_behavioural_pass.
10f1dbe07147full audit observations/trust-audit/mcp-server/pleaseprompto__notebooklm-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 10f1dbe07147 | SAFE | B | 89 | first audit |
Questions
What is the notebooklm-mcp MCP server?
MCP server for NotebookLM - Let your AI agents (Claude Code, Codex) research documentation directly with grounded, citation-backed answers from Gemini. Persistent auth, library management, cross-client sharing. Zero hallucinations, just your knowledge base.
What tools does notebooklm-mcp expose?
19 in total: 12 read-only, 5 that write, and 2 that can delete or overwrite (remove_notebook, reset_session). Every one is listed on this page with its risk.
Is notebooklm-mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does notebooklm-mcp need?
It reads LOGIN_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does notebooklm-mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as notebooklm-mcp at 2.0.0.
How current is this page?
The grade is for one exact copy of the source (10f1dbe07147), read on 2026-10-12. The repository is watched and re-audited when it changes.