Atlas / MCP servers / roomi-fields / NotebookLM

NotebookLMBLOCK

Name: NotebookLM
Author: roomi-fields

mcp/roomi-fields/notebooklm-3

MCP server by roomi-fields · agentic skill · anthropic · automation · Audited 2026-10-07

Google NotebookLM over MCP + a local HTTP REST API. Citation-backed Q&A, audio/video/content generation, multi-account rotation. For Claude Code, Codex, Cursor, n8n, Zapier, Make.

Verdict

BLOCK

Grade

Trust score

56 /100

Exposed tools

54 38r · 9w · 7d

Transport

stdio

License

MIT

Stars

188

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Automate Google NotebookLM at scale. 33-endpoint HTTP REST API for n8n / Zapier / Make / curl, plus an MCP server for Claude Code / Cursor / Codex. Citation-backed Q&A, full Studio generation (audio · video · infographic · report · presentation · data table), multi-account rotation with auto-reauth across personal and Google Workspace accounts.

v3.2.0 — generated content can finally be deleted (content_delete): the endpoint had been declared and called by nothing since v3, so notebooks accumulated every draft ever asked for. Builds on 3.1.x, where generated content stopped coming back in the wrong language — the interface locale was overriding the language argument on both transports, silently, while reporting success. Also: reading a source's full indexed text (source_read, paginated), working source labels, and RPC refusals reported as refusals instead of as a rotated endpoint id. Built on a dual transport — the internal batchexecute RPC API (10-100× faster than scraping, immune to UI rebrands) with the Playwright browser as an automatic fallback, both shipped permanently. Batch-tested on overnight runs of 1 000+ questions. See the changelog. Compare with `PleasePrompto/notebooklm-mcp` for when this project is the right pick (REST API, full Studio, auto-reauth).

Note (July 2026): Google rebranded NotebookLM to Gemini Notebook. It is the same product, existing links redirect, and this project drives the same underlying service — the browser path was updated for the new DOM in v2.3.0 and the RPC path in v3.0.0. Package and repository keep the notebooklm name.

[](https://github.com/roomi-fields/notebooklm-mcp/actions/workflows/ci.yml) [![npm version](https://badge.fury.io/js/%40roomi-field

Read from source at commit 28ef8087e99cOBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)

claude mcp add notebooklm-mcp -- npx -y @roomi-fields/[email protected]

Exposed tools (54)

38 read · 9 write · 7 destructive. Blast radius: 7 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`Original`	read	Keep this
`Test`	read	Test notebook
`add_notebook`	write	🔌 [PROXY] Add notebook to library via HTTP server
`add_source`	write	🔌 [PROXY] Add source/document to notebook via HTTP server
`ask_question`	read	Ask a question to NotebookLM
`auto_discover_notebook`	read	🔌 [PROXY] Auto-discover notebook metadata via HTTP server
`batch_to_vault`	write	Run a list of questions against a notebook and persist each answer to disk as
`cleanup_data`	read	🔌 [PROXY] Cleanup server data via HTTP server
`close_session`	read	🔌 [PROXY] Close session via HTTP server
`complex_tool`	read	A complex tool
`convert_note_to_source`	read	Convert a note to a source document in NotebookLM.\n\n
`create_note`	write	Create a note in the NotebookLM Studio panel.\n\n
`create_notebook`	write	Create a notebook
`de_auth`	destructive	🔌 [PROXY] Logout (clear credentials) via HTTP server
`delete_content`	destructive	Delete a generated Studio artifact (audio overview, video, report, infographic,
`delete_notebooks_from_nblm`	destructive	Delete one or more notebooks directly from NotebookLM (UI-level deletion,
`delete_source`	destructive	Delete a source from the current NotebookLM notebook.\n\n
`download_audio`	read	🔌 [PROXY] Download generated audio file via HTTP server
`download_content`	read	Download or export generated content from NotebookLM.\n\n
`generate_audio`	read	🔌 [PROXY] Generate audio overview (podcast) via HTTP server
`generate_content`	read	🔌 [PROXY] Generate content via HTTP server.\n
`generate_mind_map`	write	Generate and save a mind map from a notebook’s sources. RPC-backed (no browser).
`generate_study_aid`	read	Generate a study aid from a notebook’s sources: flashcards or a quiz.
`get_health`	read	Get server health
`get_library_stats`	read	🔌 [PROXY] Get library statistics via HTTP server
`get_note`	read	Retrieve the full title and text content of a specific note in the NotebookLM Studio panel.
`get_notebook`	read	🔌 [PROXY] Get notebook details by ID via HTTP server
`list_content`	read	🔌 [PROXY] List sources and generated content via HTTP server
`list_notebooks`	read	List all notebooks
`list_notebooks_from_nblm`	read	🔌 [PROXY] Scrape NotebookLM homepage to get real notebook list via HTTP server
`list_notes`	read	List all user notes in the NotebookLM Studio panel. Returns note titles, IDs, and timestamps (e.g. details).
`list_sessions`	read	🔌 [PROXY] List active sessions via HTTP server
`list_sources`	read	List the sources of a NotebookLM notebook, with their IDs and titles.\n\n
`manage_labels`	destructive	Manage a notebook’s source labels (RPC-backed): list them, create one, or delete some.
`my-test-notebook`	read	Three word name test. Works correctly.
`n8n-workflow-guide`	read	...
`notebook`	read	Single word name test. Works correctly.
`re_auth`	read	🔌 [PROXY] Re-authenticate with different account via HTTP server
`read_source`	read	Read a source’s full indexed content — the exact text NotebookLM reasons over,
`remove_notebook`	destructive	🔌 [PROXY] Remove notebook from library via HTTP server
`required`	read	All required. Second.
`research_sources`	read	Discover web sources for a notebook via NotebookLM Fast Research. RPC-backed.
`reset_session`	destructive	🔌 [PROXY] Reset session history via HTTP server
`retry-test`	read	This notebook was discovered after retry. Success on second attempt.
`save_chat_to_note`	write	Save the current NotebookLM chat/discussion to a note.\n\n
`search_notebooks`	read	🔌 [PROXY] Search notebooks via HTTP server
`select_notebook`	write	🔌 [PROXY] Set active notebook via HTTP server
`setup_auth`	read	🔌 [PROXY] Setup Google authentication via HTTP server.\n
`share_notebook`	read	Read a notebook’s sharing status, or toggle its public link.
`test-name`	read	Test description. Second sentence.
`test-notebook`	read	This is a test notebook. It contains test data.
`too-many-words-in-name`	read	Test description. Second sentence.
`update_notebook`	write	🔌 [PROXY] Update notebook metadata via HTTP server
`valid-name`	read	Short description. Second sentence.

Trust audit

BLOCKgrade F · trust 56/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (4 observation(s))
Network: declared (9 observation(s))
Shell: declared (7 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (22)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/content/content-manager.ts:2496

deletedSourceName = await sourceElement.$eval(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/content/content-manager.ts:2634

const nameText = await el.$eval(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/content/content-manager.ts:3846

const titleText = await el.$eval(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/content/content-manager.ts:4340

const innerContent = await noteElement.$eval(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

tests/e2e/archive/E2E-TEST-REPORT.md:1

# NotebookLM MCP HTTP Server - E2E Test Report

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

deployment/docs/02-CONFIGURATION.md:142

$env:API_KEY="my-super-secure-secret-token"

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

de_auth, delete_content, delete_notebooks_from_nblm, delete_source, manage_labels, remove_notebook, reset_session

Why it matters. 7 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

website/static/.nojekyll

.nojekyll

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/__tests__/security.test.ts:158

'/root/.ssh/id_rsa',

Why it matters. touches a credential store

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/__tests__/security.test.ts:156

'/app/data/../../../etc/passwd',

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/__tests__/security.test.ts:157

'../../../etc/passwd',

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/__tests__/security.test.ts:159

'/app/data/../../etc/shadow',

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/__tests__/vault-writer.test.ts:107

expect(() => resolveVaultDir('../../etc')).toThrow(/escape/i);

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/integration/browser-modules.test.ts:24

import { CONFIG } from '../../src/config.js';