Notebooklm Mcp Secure

The only NotebookLM MCP with enterprise-grade security, post-quantum encryption, and full Gemini API integration.

Security-hardened fork of PleasePrompto/notebooklm-mcp • Maintained by Pantheon Security

⚡ TL;DR — What You Get

• 🔍 Query your NotebookLM notebooks — source-grounded, zero-hallucination answers
• 📚 Create & manage notebooks programmatically — no manual clicking
• 🎙️ Generate audio overviews — podcast-style summaries of your docs
• 🎬 Generate video overviews — AI video summaries with 10 visual styles NEW
• 📊 Extract data tables — structured JSON from notebook sources NEW
• 🔬 Gemini 3 + Deep Research — latest models with thinking control (optional API) NEW
• 📄 Document API — upload & query PDFs without browser (optional API)
• 🔐 17 security layers — post-quantum encryption, audit logs, secrets scanning
• ✅ Compliance-ready architecture — built to GDPR, SOC2, and CSSF standards (controls implemented; formal certification requires third-party audit)
• 💡 No API key required — core features work with just browser auth

🚀 What's New in 2026

Latest: v2026.3.1 — All 334 audit issues resolved. 631 tests. Full MCP protocol compliance.

# Quick installclaude mcp add notebooklm -- npx @pan-sec/notebooklm-mcp@latest

Why Choose This MCP?

🔬 Security Audit 2026 — What We Found and Fixed

In April 2026, we commissioned a parallel deep-audit of v2026.2.11 (main @ 2973097) using four specialised AI code reviewers, each focused on a different attack surface: security vulnerabilities, protocol correctness, architecture quality, and testing gaps and edge cases. The four reviewers operated independently so their findings wouldn't influence each other. Together they produced a 334-item master issue list covering protocol correctness, security vulnerabilities, architecture flaws, test gaps, and documentation accuracy. All 334 issues are resolved across v2026.3.0 and v2026.3.1.

Audit by the Numbers

What the Four Reviewers Found

Security reviewer: Identified the forceAuth bypass in validateToken() allowing unauthenticated access to filesystem tools; webhook SSRF via unvalidated delivery targets; audit log hash chain not verified on read; concurrent audit writes interleaving entries; auth token salt not persisted (tokens invalidated on restart).

Protocol reviewer: Found 38 tools returning incorrect response shapes (missing structuredContent, wrong isError semantics, transport tags leaking into content); all 48 tools had incorrect or missing readOnlyHint/idempotentHint/destructiveHint annotations; 9 tool schemas lacked numeric bounds, enabling out-of-range inputs.

Architecture reviewer: Flagged the 3,611-line handlers.ts as a maintenance liability; singleton imports throughout domain functions preventing unit testing; the 500-line switch/case dispatch adding O(n) overhead and making tool registration error-prone.

Testing & edge-case reviewer: Found test suite at 139 tests with minimal coverage of security-critical modules; mcp-auth.ts at near-zero coverage; no tests for prompt injection patterns, audit log tampering, or concurrent browser session state; the DSAR handler had an undetected race condition.

Key Fixes

• 17 security vulnerabilities addressed (auth bypass, SSRF, audit integrity, race conditions, selector injection vectors)
• MCP protocol fully compliant — all 48 tools return correct structuredContent/isError shapes; annotations accurate; schema bounds enforced
• Architecture decomposed — handlers.ts split into 9 domain modules with HandlerContext dependency injection; 100% unit-testable without process mocks
• Test coverage — 15 new security-critical test suites including browser session, auth, prompt injection, audit log, webhook, DSAR, and compliance
• Claims aligned — certificate pinning removed (implementation was retracted in Day 1 of the audit); PQ encryption scope documented accurately; compliance language uses "controls implemented" not "certified"

Gemini Deep Research (v1.8.0)

The most powerful research capability for AI agents — now in your MCP toolkit.

v1.8.0 introduces the Gemini Interactions API as a stable, API-based research backend alongside browser automation. This gives your agents access to Google's state-of-the-art Deep Research agent.

Why This Matters

New Tools

deep_research — Comprehensive Research Agent

"Research the security implications of post-quantum cryptography adoption in financial services"

• Runs Google's Deep Research agent (same as Gemini Advanced)
• Takes 1-5 minutes for comprehensive, web-grounded analysis
• Returns structured answers with citations and sources
• Perfect for complex topics requiring multi-source synthesis

gemini_query — Fast Grounded Queries

"What are the latest CVEs for Log4j in 2025?" (with Google Search)"Calculate the compound interest on $10,000 at 5% over 10 years" (with code execution)"Summarize this security advisory: [URL]" (with URL context)

• Google Search grounding — Current information, not just training data
• Code execution — Run calculations, data analysis
• URL context — Analyze web pages on demand
• Models: gemini-3-flash-preview (default), gemini-3-pro-preview (powerful), gemini-2.5-flash (legacy)

get_research_status — Background Task Monitoring

Run deep research in the background and check progress:

"Start researching [topic] in the background"... continue other work ..."Check research status for interaction_abc123"

Hybrid Architecture

┌──────────────────────────────────────────────────────────────────────────────┐│                      NotebookLM MCP Server v2026.3.x                         │├──────────────────────────────────────────────────────────────────────────────┤│                                                                              ││  ┌────────────────────────────────┐    ┌──────────────────────────────────┐  ││  │      BROWSER AUTOMATION        │    │          GEMINI API              │  ││  │    ✅ NO API KEY NEEDED        │    │    ⚡ OPTIONAL - needs API key   │  ││  ├────────────────────────────────┤    ├──────────────────────────────────┤  ││  │                                │    │                                  │  ││  │  QUERY                         │    │  RESEARCH                        │  ││  │  • ask_question                │    │  • deep_research                 │  ││  │  • get_notebook_chat_history   │    │  • gemini_query                  │  ││  │                                │    │  • get_research_status           │  ││  │  CREATE & MANAGE               │    │                                  │  ││  │  • create_notebook             │    │  DOCUMENTS                       │  ││  │  • batch_create_notebooks      │    │  • upload_document               │  ││  │  • manage_sources              │    │  • query_document                │  ││  │  • generate_audio              │    │  • query_chunked_document        │  ││  │  • generate_video_overview     │    │  • list/delete_document          │  ││  │  • generate_data_table         │    │                                  │  ││  │  • sync_notebook               │    │                                  │  ││  │                                │    │                                  │  ││  │  HEALTH & SESSIONS     v2026   │    │                                  │  ││  │  • get_health (deep_check)     │    │  Fast API • 48h retention        │  ││  │  • get_query_history           │    │  Auto-chunking for large PDFs    │  ││  └────────────────────────────────┘    └──────────────────────────────────┘  ││                                                                              ││                      ┌─────────────────────────────────┐                     ││                      │       17 SECURITY LAYERS        │                     ││                      │   Post-Quantum • Audit Logs     │                     ││                      │   Secrets Scan • Memory Wipe    │                     ││                      │  GDPR • SOC2 • CSSF Ready*      │                     ││                      └─────────────────────────────────┘                     │└──────────────────────────────────────────────────────────────────────────────┘

💡 Gemini API is completely optional! All core NotebookLM features (ask_question, notebooks, sessions, audio) work via browser automation with no API key required. The Gemini tools below are bonus features for users who want direct API access.

Gemini Configuration (Optional)

# Only required if you want Gemini API features (deep_research, gemini_query, upload_document)GEMINI_API_KEY=your-api-key          # Get from https://aistudio.google.com/apikey
# Optional settingsGEMINI_DEFAULT_MODEL=gemini-3-flash-preview  # Default model (was gemini-2.5-flash)GEMINI_DEEP_RESEARCH_ENABLED=true            # Enable Deep ResearchGEMINI_TIMEOUT_MS=30000                      # API timeout

When to Use Which

📄 Document API (v1.9.0)

Upload and query documents directly via Gemini API — no browser automation needed.

v1.9.0 introduces the Gemini Files API for fast, reliable document analysis. Upload PDFs, analyze them instantly, and delete when done.

Why This Matters

New Tools

upload_document — Fast Document Upload

Upload any document to Gemini for instant querying:

Upload /path/to/research-paper.pdf

• Supported: PDF (50MB, 1000 pages), TXT, MD, HTML, CSV, JSON, DOCX, images, audio, video
• 48-hour retention — files auto-expire, or delete manually
• Returns a file ID for querying

query_document — Ask Questions About Documents

"What are the main findings in this research paper?""Summarize section 3 of the document""Extract all statistics mentioned in the PDF"

• Full document understanding (text, tables, charts, diagrams)
• Multi-document queries (compare multiple files)
• Fast API response (no browser wait)

list_documents — See All Uploaded Files

List all my uploaded documents

Shows file names, sizes, MIME types, and expiration times.

delete_document — Clean Up Sensitive Files

Delete file xyz123

Immediately remove files (don't wait for 48h expiration).

Workflow Example

1. upload_document("/research/paper.pdf")   → Returns: files/abc123
2. query_document("files/abc123", "What methodology was used?")   → Returns: "The paper uses a mixed-methods approach combining..."
3. query_document("files/abc123", "List all cited authors")   → Returns: "Smith et al. (2024), Johnson (2023)..."
4. delete_document("files/abc123")   → File removed

Auto-Chunking for Large PDFs (v1.10.0)

No file size limits — PDFs of any size are automatically handled.

When you upload a PDF that exceeds Gemini's limits (50MB or 1000 pages), the system automatically:

1. Detects the oversized PDF
2. Splits it into optimal chunks (500 pages each)
3. Uploads all chunks in parallel
4. Returns chunk metadata for querying

upload_document("/research/massive-2000-page-report.pdf")
→ Returns:{  "wasChunked": true,  "totalPages": 2000,  "chunks": [    { "fileName": "files/abc1", "pageStart": 1, "pageEnd": 500 },    { "fileName": "files/abc2", "pageStart": 501, "pageEnd": 1000 },    { "fileName": "files/abc3", "pageStart": 1001, "pageEnd": 1500 },    { "fileName": "files/abc4", "pageStart": 1501, "pageEnd": 2000 }  ],  "allFileNames": ["files/abc1", "files/abc2", "files/abc3", "files/abc4"]}

query_chunked_document — Query All Chunks at Once

For chunked documents, use this tool to query all parts and get an aggregated answer:

query_chunked_document(  file_names: ["files/abc1", "files/abc2", "files/abc3", "files/abc4"],  query: "What are the key recommendations in this report?")
→ Queries each chunk, then synthesizes a unified answer

When to Use Document API vs NotebookLM

Programmatic Notebook Creation (v1.7.0+)

Create NotebookLM notebooks entirely from code — no manual clicks required.

Most MCP servers can only read from NotebookLM. This one can create notebooks, add sources, and generate audio — all programmatically.

create_notebook — Build Notebooks Instantly

Create a complete notebook with multiple sources in one command:

{  "name": "Security Research 2025",  "sources": [    { "type": "url", "value": "https://owasp.org/Top10" },    { "type": "file", "value": "/path/to/security-report.pdf" },    { "type": "text", "value": "Custom analysis notes...", "title": "My Notes" }  ],  "description": "OWASP security best practices",  "topics": ["security", "owasp", "vulnerabilities"]}

Supported source types:

• URL — Web pages, documentation, articles
• File — PDF, DOCX, TXT, and more
• Text — Raw text, code snippets, notes

batch_create_notebooks — Scale Up

Create up to 10 notebooks in a single operation:

{  "notebooks": [    { "name": "React Docs", "sources": [{ "type": "url", "value": "https://react.dev/reference" }] },    { "name": "Node.js API", "sources": [{ "type": "url", "value": "https://nodejs.org/api/" }] },    { "name": "TypeScript Handbook", "sources": [{ "type": "url", "value": "https://www.typescriptlang.org/docs/" }] }  ]}

Perfect for:

• Setting up project documentation libraries
• Onboarding new team members with curated knowledge bases
• Creating topic-specific research notebooks in bulk

manage_sources — Dynamic Source Management

Add or remove sources from existing notebooks:

{  "notebook_id": "abc123",  "action": "add",  "sources": [{ "type": "url", "value": "https://new-documentation.com" }]}

generate_audio — Audio Overview Creation

Generate NotebookLM's famous "Audio Overview" podcasts programmatically:

"Generate an audio overview for my Security Research notebook"

sync_notebook — Keep Sources Updated

Sync notebook sources from a local directory:

{  "notebook_id": "abc123",  "directory": "/path/to/docs",  "patterns": ["*.md", "*.pdf"]}

Why This Matters

Your agent can now build entire knowledge bases autonomously.

🎬 Video Overviews & Data Tables (v2026.2.0)

Generate AI-powered visual summaries and extract structured data from any notebook — all programmatically.

NotebookLM's Studio panel now offers Video Overviews and Data Tables alongside Audio Overviews. This release brings full automation for both.

generate_video_overview — AI Video Summaries

Generate visual video overviews of your notebook content with 10 visual styles:

Two formats:

• Explainer — Full explanation (5-15 min)
• Brief — Quick summary (1-3 min)

"Generate a kawaii-style brief video overview for my Security Research notebook"

get_video_status — Check Generation Progress

Video generation takes 3-10 minutes. Check progress:

"Check video status for my Security Research notebook"→ { "status": "generating", "progress": 0 }→ { "status": "ready" }

generate_data_table — Structured Data Extraction

Generate a structured table from your notebook sources. NotebookLM extracts key information into rows and columns:

"Generate a data table for my research notebook"

get_data_table — Extract Table as JSON

Extract the generated table as structured JSON for processing:

"Get the data table from my research notebook"→ {    "headers": ["Title", "Year", "Key Finding", "Methodology", ...],    "rows": [["Paper A", "2025", "Finding X", "Survey", ...], ...],    "totalRows": 27,    "totalColumns": 7  }

When to Use Which Studio Feature

📊 Query History & Chat Extraction (v2026.1.0)

Track your research and recover conversations from NotebookLM notebooks.

get_query_history — Review Past Research (v1.10.8)

All queries made through the MCP are automatically logged for review:

"Show me my recent NotebookLM queries""Find queries about security from last week""What did I ask the fine-tuning notebook?"

• Automatic logging — every Q&A pair saved with metadata
• Search — find specific topics across all queries
• Filter — by notebook, session, or date
• Quota tracking — see query counts and timing

get_notebook_chat_history — Extract Browser Conversations (v2026.1.0)

Extract conversation history directly from a NotebookLM notebook's chat UI with context management to avoid overwhelming your AI context window:

Quick audit (preview mode):

{ "notebook_id": "my-research", "preview_only": true }

Returns message counts without content — test the water before extracting.

Export to file (avoids context overflow):

{ "notebook_id": "my-research", "output_file": "/tmp/chat-history.json" }

Dumps full history to disk instead of returning to context.

Paginate through history:

{ "notebook_id": "my-research", "limit": 20, "offset": 0 }{ "notebook_id": "my-research", "limit": 20, "offset": 20 }

Page through large histories without loading everything at once.

Returns:

{  "notebook_url": "https://notebooklm.google.com/notebook/xxx",  "notebook_name": "My Research",  "total_messages": 150,  "returned_messages": 40,  "user_messages": 75,  "assistant_messages": 75,  "offset": 0,  "has_more": true,  "messages": [...]}

Use cases:

• Recover conversations made directly in the NotebookLM browser (not tracked by MCP)
• Audit research — see what queries were made in a notebook
• Resume context — pick up where a previous session left off
• Quota reconciliation — understand why quota seems off

Why This Fork?

The original NotebookLM MCP is excellent for productivity — but MCP servers handle sensitive data:

• Browser sessions with Google authentication
• Cookies and tokens stored on disk
• Query history that may contain proprietary information

This fork adds 17 security hardening layers to protect that data.

Security Features

Post-Quantum Primitives (Local At-Rest)

Encryption of secrets on disk uses hybrid post-quantum primitives:

ML-KEM-768 (Kyber) + ChaCha20-Poly1305

• ML-KEM-768: NIST-standardized post-quantum key encapsulation
• ChaCha20-Poly1305: Modern stream cipher (immune to timing attacks)

Scope, honestly: this is local at-rest encryption. Both keys live on the same machine — the PQ secret key is wrapped with a classical key derived from a machine-bound secret, not held by a remote recipient. This protects against offline theft of individual encrypted files, not against Harvest-Now-Decrypt-Later attacks (those require a remote PQ recipient holding the unwrap key).

Cross-Platform Support

Full native support for all major operating systems:

All sensitive files (encryption keys, auth tokens, audit logs) are automatically protected with owner-only permissions on every platform.

Enterprise Compliance-Ready Architecture (v1.6.0+)

Built to the standards required for regulated industries. All code-level technical controls are implemented — full compliance also requires organizational process controls (policies, training, vendor management). Formal certification (SOC2 Type II report, GDPR registration, CSSF submission) requires a third-party audit engagement.

Compliance Tools (16 MCP tools)

compliance_dashboard    - Real-time compliance statuscompliance_report       - Generate audit reports (JSON/CSV/HTML)compliance_evidence     - Collect evidence packagesgrant_consent          - Record user consentsubmit_dsar            - Handle data subject requestsrequest_erasure        - Right to be forgottenexport_user_data       - Data portability exportcreate_incident        - Security incident management...and 8 more

See COMPLIANCE-SPEC.md for full documentation.

Installation

What Works Out of the Box (No API Key)

All core NotebookLM features work immediately with just browser authentication:

Optional: Add GEMINI_API_KEY for bonus features like deep_research, gemini_query, and upload_document.

For repeatable authenticated validation, see the Authenticated Testing Runbook.

Claude Code

claude mcp add notebooklm -- npx @pan-sec/notebooklm-mcp@latest

With Authentication + Gemini (Recommended)

claude mcp add notebooklm \  --env NLMCP_AUTH_ENABLED=true \  --env NLMCP_AUTH_TOKEN=$(openssl rand -base64 32) \  --env GEMINI_API_KEY=your-gemini-api-key \  -- npx @pan-sec/notebooklm-mcp@latest

Codex

codex mcp add notebooklm -- npx @pan-sec/notebooklm-mcp@latest

{  "mcpServers": {    "notebooklm": {      "command": "npx",      "args": ["-y", "@pan-sec/notebooklm-mcp@latest"],      "env": {        "NLMCP_AUTH_ENABLED": "true",        "NLMCP_AUTH_TOKEN": "your-secure-token",        "GEMINI_API_KEY": "your-gemini-api-key"      }    }  }}

{  "mcpServers": {    "notebooklm": {      "command": "npx",      "args": ["-y", "@pan-sec/notebooklm-mcp@latest"]    }  }}

{  "mcpServers": {    "notebooklm": {      "command": "npx",      "args": ["-y", "@pan-sec/notebooklm-mcp@latest"],      "env": {        "GEMINI_API_KEY": "your-gemini-api-key"      }    }  }}

{  "$schema": "https://opencode.ai/config.json",  "mcp": {    "notebooklm": {      "type": "local",      "command": ["npx", "-y", "@pan-sec/notebooklm-mcp@latest"],      "enabled": true,      "environment": {        "GEMINI_API_KEY": "your-gemini-api-key"      }    }  }}

{  "mcpServers": {    "notebooklm": {      "command": "npx",      "args": ["-y", "@pan-sec/notebooklm-mcp@latest"],      "env": {        "GEMINI_API_KEY": "your-gemini-api-key"      }    }  }}

{  "mcp": {    "servers": {      "notebooklm": {        "command": "npx",        "args": ["-y", "@pan-sec/notebooklm-mcp@latest"],        "env": {          "GEMINI_API_KEY": "your-gemini-api-key"        }      }    }  }}

{  "mcpServers": {    "notebooklm": {      "command": "npx",      "args": ["-y", "@pan-sec/notebooklm-mcp@latest"],      "env": {        "GEMINI_API_KEY": "your-gemini-api-key"      }    }  }}

Quick Start

1. Install (see above)

2. Authenticate

"Log me in to NotebookLM"

Chrome opens → sign in with Google

3. Add your notebook

Go to notebooklm.google.com → Create notebook → Upload docs → Share link

4. Use it

"Research [topic] using this NotebookLM: [link]"

5. Try Deep Research (NEW!)

"Use deep research to investigate [complex topic]"

Complete Tool Reference

Research Tools

Notebook Management

Source Management (v1.7.0+)

Studio Features (v2026.2.0)

Session & System

Compliance (v1.6.0+)

16 compliance tools for GDPR, SOC2, and CSSF requirements.

What Gets Protected

Configuration

All security features are enabled by default. Override via environment variables:

# AuthenticationNLMCP_AUTH_ENABLED=trueNLMCP_AUTH_TOKEN=your-secret-token
# Gemini API (v1.8.0+)GEMINI_API_KEY=your-api-keyGEMINI_DEFAULT_MODEL=gemini-3-flash-preview  # Default (was gemini-2.5-flash)GEMINI_DEEP_RESEARCH_ENABLED=trueGEMINI_TIMEOUT_MS=30000NOTEBOOKLM_NO_GEMINI=false       # Set to true to disable all Gemini tools
# Tool ProfilesNOTEBOOKLM_PROFILE=standard      # minimal (5 tools) | standard (33 tools) | full (all 47)NOTEBOOKLM_DISABLED_TOOLS=       # Comma-separated list of tools to hide
# EncryptionNLMCP_USE_POST_QUANTUM=trueNLMCP_ENCRYPTION_KEY=base64-32-bytes  # Optional custom key
# Session LimitsNLMCP_SESSION_MAX_LIFETIME=28800  # 8 hoursNLMCP_SESSION_INACTIVITY=1800     # 30 minutes
# Secrets ScanningNLMCP_SECRETS_SCANNING=trueNLMCP_SECRETS_BLOCK=false         # Block on detectionNLMCP_SECRETS_REDACT=true         # Auto-redact
# Audit LoggingNLMCP_AUDIT_ENABLED=true
# Multi-Session Support (v2026.1.2+)NOTEBOOK_PROFILE_STRATEGY=isolated  # isolated|single|autoNOTEBOOK_CLONE_PROFILE=true         # Clone auth from base profile

Multi-Session Mode

Run multiple Claude Code sessions simultaneously with isolated browser profiles:

# Add to ~/.bashrc or ~/.zshrcexport NOTEBOOK_PROFILE_STRATEGY=isolatedexport NOTEBOOK_CLONE_PROFILE=true

How it works:

• Each session gets its own Chrome profile (no lock conflicts)
• Isolated profiles clone from the authenticated base profile
• Auth coordination ensures cloning waits for any in-progress authentication

See SECURITY.md for complete configuration reference.

Security Scanning

Run MEDUSA security scanner:

npm run security-scan

Or integrate in CI/CD:

- name: Security Scan  run: npx @pan-sec/notebooklm-mcp && npm run security-scan

Comparison

vs Other NotebookLM MCPs

Security & Compliance (Unique to This Fork)

* Compliance-ready: code-level technical controls are implemented. Full compliance also requires organizational process controls and formal certification via third-party audit.

Bottom line: If you need more than basic queries, or care about security, there's only one choice.

Version History

Reporting Vulnerabilities

Found a security issue? Do not open a public GitHub issue.

Email: [email protected]

Credits

• Original MCP Server: Gérôme Dexheimer — notebooklm-mcp
• Security Hardening: Pantheon Security
• Post-Quantum Crypto: @noble/post-quantum
• Gemini API: Google AI

License

MIT — Same as original.