Gemini Notebook (formerly Google NotebookLM) CLI & MCP ServeBLOCK

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: nlm-skill
version: "0.15.6"
description: 'Expert guide for the Gemini Notebook (formerly Google NotebookLM) CLI (`nlm`) and MCP server - interfaces for Gemini Notebook. Use this skill when users want to interact with Gemini Notebook programmatically, including: creating/managing notebooks, checking plan usage and quota windows, adding sources (URLs, YouTube, text, Google Drive), generating content (podcasts, reports, interactive reports, quizzes, flashcards, mind maps, slides, infographics, videos, data tables), conducting research, chatting with sources, or automating Gemini Notebook workflows. Triggers on mentions of "nlm", "notebooklm", "Gemini Notebook", "plan usage", "quota", "podcast generation", "audio overview", "interactive report", "lesson report", "refactor document", "critique draft", or any Gemini Notebook-related automation task.'
---

# Gemini Notebook CLI & MCP Expert

This skill provides comprehensive guidance for using Gemini Notebook via both the `nlm` CLI and MCP tools.

## Tool Detection (CRITICAL - Read First!)

**ALWAYS check which tools are available before proceeding:**

1. **Check for MCP tools**: Tool names vary by host; look for `mcp__gemini-notebook-mcp__*`, `mcp__notebooklm_mcp__*`, or `mcp_gemini_notebook_mcp_*`.
2. **Follow an explicit surface choice**: If the user asks for MCP or CLI, use it.
3. **Choose by task when both are available**: Use MCP for notebook operations and downloads inside its configured download directory. Use the CLI for an explicit `--profile` without changing the MCP default account, or for a user-directed output path outside the MCP download directory. Ask only if the choice would materially change the result and the user's preference is unclear.
4. **Use the available surface** when only MCP or only CLI is callable; read its tool docstring or `nlm <command> --help` before supplying unfamiliar options.

**Decision Logic:**

```
has_mcp_tools = check_available_tools()  # Look for any NotebookLM MCP tool name above
has_cli = check_bash_available()  # Can run nlm commands

if user_named_mcp_or_cli:
    use_that_surface()
elif needs_workspace_output_outside_mcp_root or needs_explicit_profile_without_switching_default:
    use_cli()
elif has_mcp_tools:
    use_mcp()
elif has_cli:
    use_cli()
```

Check the active account before a mutation when more than one profile is saved: `nlm login profile list` shows accounts, and `nlm config get auth.default_profile` shows the MCP default. CLI commands can use `--profile <name>`. MCP tools use the active profile: call the `profile` tool (`action=list`, then `action=switch` with `name=...`) to change it for this MCP server until it restarts (add `make_default=true` only when the user asks to change their default). While a switch is active, tool results carry `active_profile_note`; tell the user which account is in use. `usage_get(profile=...)` is an account-specific read and does not switch other MCP tools.

## Quick Reference

**Run `nlm --ai` to get comprehensive AI-optimized documentation** - this provides a complete view of all CLI capabilities.

```bash
nlm --help              # List all commands
nlm <command> --help    # Help for specific command
nlm --ai                # Full AI-optimized documentation (RECOMMENDED)
nlm --version           # Check installed version
nlm usage               # Check rolling and weekly plan usage and reset times
nlm usage --json        # Return usage data as machine-readable JSON
```

## Critical Rules (Read First!)

1. **Authenticate when needed**: Run `nlm login` for first-time setup or confirmed stale/missing credentials. Saved cookies often remain usable for weeks.
2. **Do not confuse network failures with expired auth**: `auth_status="unverified"` means the probe was inconclusive. Check connectivity or try an API call before asking the user to log in again.
3. **Auto-Authentication Recovery**: The CLI includes automatic 3-layer auth recovery (CSRF refresh -> Token reload -> Headless Auth) and 3x server error retries. Most errors are handled automatically. You only need to manually run `nlm login` if all recovery layers fail. Automatic browser recovery has a per-process cooldown and failure budget; concurrent requests share an active recovery. Explicit `nlm auth refresh` bypasses these limits. Use `--http-only` when a browser must not open; it cannot renew browser-dependent PSIDTS cookies or revive a fully expired login.
4. **⚠️ ALWAYS ASK USER BEFORE DELETE**: Before executing ANY delete command, ask the user for explicit confirmation. Deletions are **irreversible**. Show what will be deleted and warn about permanent data loss.
5. **Always obtain approval before generation or deletion**: Direct
   `studio_create` and delete operations enforce `--confirm` / `confirm=True`.
   The current MCP batch Studio path does not enforce its confirm parameter,
   so the agent must preserve the approval gate.
6. **Research needs a destination**: Pass `--notebook-id <id>` for an existing notebook or `--title <title>` to create one.
7. **Capture IDs from output**: Create/start commands return IDs needed for subsequent operations
8. **Use aliases**: Simplify long UUIDs with `nlm alias set <name> <uuid>`
9. **Check aliases before creating**: Run `nlm alias list` before creating a new alias to avoid conflicts with existing names.
10. **DO NOT launch REPL**: Never use `nlm chat start` - it opens an interactive REPL that AI tools cannot control. Use `nlm notebook query` for one-shot Q&A instead.
11. **Choose output format wisely**: Default output (no flags) is compact and token-efficient—use it for status checks. Use `--quiet` to capture IDs for piping. Only use `--json` when you need to parse specific fields programmatically.
12. **Use `--help` when unsure**: Run `nlm <command> --help` to see available options and flags for any command.
13. **Studio: fast track by default**: Infer format/style/prompt silently—one compact line, then `studio_create(confirm=True)`. No 

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (12 observation(s))

Network

declared (7 observation(s))

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (25)

"authorized_keys",

"id_rsa",

"id_ed25519",

".netrc",

exec(sys.argv[2])

".netrc",

"../../evil",

_load_pipeline("../../outside/planted")

pipeline_create("../../victim/written", "desc", _VALID_STEP)

- **CDP timeout error now shows the polled URL** — The WSL login timeout message previously said only "Chrome did not start within 30 seconds" with generic troubleshooting steps. It now includes the a

- **CDP Proxy Bypass (Issue #119)** — The `httpx` HTTP2 client was honoring system proxy settings even for the internal `127.0.0.1` CDP WebSocket acquisition call (`http://127.0.0.1:9222/json`). This

- **`--cdp-url` ignored by builtin provider (Issue #117, Bug 2)** — `nlm login --cdp-url http://127.0.0.1:9222` was ignored when using the default builtin provider, always launching a new Chrome inste

nlm login --provider openclaw --cdp-url http://127.0.0.1:18800

nlm login --provider openclaw --cdp-url http://127.0.0.1:18800

key_bytes = base64.b64decode(key_b64)

nonce = base64.b64decode(nonce_b64)

ciphertext = base64.b64decode(ciphertext_b64)

raw_key = base64.b64decode(key_b64)

- **Actionable headless refresh diagnostics.** When run with explicit error raising (`nlm auth refresh` or `raise_on_error=True`), headless authentication now surfaces actionable, safe `Authentication

- **Credential store testing.** Unit and integration tests for authentication and credential storage must always use `fake_credential_store`, `tmp_path`, and synthetic storage paths. Never read, write

- Downgrade error: older versions of `notebooklm-mcp-cli` cannot read `credentials.enc`.

When prompted by macOS to allow access to the keychain, enter the Mac login password and click **Always Allow**. If the prompt went unanswered for 60 seconds, the command fails with "approve the Keych

Older versions of `notebooklm-mcp-cli` cannot read `credentials.enc`. Before installing an older version, decrypt all protected profiles:

- **Desktop extension finds uvx installed via `pip install --user` on Windows (#267)** — the `.mcpb` launcher could fail to start with `Error: Could not find 'uvx'` even when uv was installed, because

- **Bounded automatic browser recovery.** Automatic attempts have a per-profile, per-process cooldown (900 seconds by default) and failure ceiling (3 by default). Concurrent callers share one active a

Gates applied: no_behavioural_pass.

[![ModelsAtlas audit: Gemini Notebook (formerly Google NotebookLM) CLI & MCP Serve](https://modelsatlas.com/skills/jacob-bd/nlm-skill/badge.svg)](https://modelsatlas.com/skills/jacob-bd/nlm-skill/)

Not your listing, or something out of date? Claim or update your listing.