# Notebooklm Mcp Secure

> Secure NotebookLM MCP Server - Query Google NotebookLM from Claude/AI agents with 17 security hardening layers

- **Type:** MCP server
- **Install:** `agentstack add mcp-pantheon-security-notebooklm-mcp-secure`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Pantheon-Security](https://agentstack.voostack.com/s/pantheon-security)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 2026.1.5
- **License:** MIT
- **Upstream author:** [Pantheon-Security](https://github.com/Pantheon-Security)
- **Source:** https://github.com/Pantheon-Security/notebooklm-mcp-secure

## Install

```sh
agentstack add mcp-pantheon-security-notebooklm-mcp-secure
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# NotebookLM MCP Server (Security Hardened)

### 🏆 The World's Most Advanced NotebookLM MCP Server

**Zero-hallucination answers • Gemini Deep Research • 17 Security Layers • Enterprise Compliance**

[](https://www.npmjs.com/package/@pan-sec/notebooklm-mcp)
[](https://calver.org/)
[](https://www.typescriptlang.org/)
[](https://modelcontextprotocol.io/)
[](#cross-platform-support)
[](./SECURITY.md)
[](./SECURITY.md#post-quantum-encryption)
[](#-gemini-deep-research-v180)
[](#-document-api-v190)
[](#programmatic-notebook-creation-v170)
[](./docs/COMPLIANCE-SPEC.md)
[](./tests/)

[**What's New 2026**](#-whats-new-in-2026) • [**Deep Research**](#-gemini-deep-research) • [**Document API**](#-document-api) • [**Create Notebooks**](#programmatic-notebook-creation) • [**Security**](#security-features) • [**Install**](#installation)

> **The only NotebookLM MCP with enterprise-grade security, post-quantum encryption, and full Gemini API integration.**
>
> Security-hardened fork of [PleasePrompto/notebooklm-mcp](https://github.com/PleasePrompto/notebooklm-mcp) • Maintained by [Pantheon Security](https://pantheonsecurity.io)

### ⚡ TL;DR — What You Get

- 🔍 **Query your NotebookLM notebooks** — source-grounded, zero-hallucination answers
- 📚 **Create & manage notebooks programmatically** — no manual clicking
- 🎙️ **Generate audio overviews** — podcast-style summaries of your docs
- 🎬 **Generate video overviews** — AI video summaries with 10 visual styles **NEW**
- 📊 **Extract data tables** — structured JSON from notebook sources **NEW**
- 🔬 **Gemini 3 + Deep Research** — latest models with thinking control (optional API) **NEW**
- 📄 **Document API** — upload & query PDFs without browser (optional API)
- 🔐 **17 security layers** — post-quantum encryption, audit logs, secrets scanning
- ✅ **Compliance-ready architecture** — built to GDPR, SOC2, and CSSF standards (controls implemented; formal certification requires third-party audit)
- 💡 **No API key required** — core features work with just browser auth

---

## 🚀 What's New in 2026

**Latest: v2026.3.1** — All 334 audit issues resolved. 631 tests. Full MCP protocol compliance.

| Version | Highlights |
|---------|------------|
| **v2026.3.1** | **Security Audit Complete** — All 334 issues from the independent audit resolved. Tests: 609 → 631. Code quality: URL resolution deduplicated, handler extraction, non-null assertions eliminated. Test gaps closed: `validateNotebookId`, error body shape, `delete_document` confirm guard, sanitized throws, log rotation, rate-limiter memory bound, range clamping. |
| **v2026.3.0** | **The Security Audit Release** — Four parallel AI code reviews (security, protocol, architecture, testing) against 334 issues. All highs and mediums resolved. Tests: 139 → 609 across 50 files (4.4×). Full MCP protocol compliance: structuredContent, isError, transport tags. Schema bounds on all 48 tools. Annotation correctness. Webhook SSRF fix. Audit log integrity (hash chain, concurrent write lock, rotation continuity). Per-page mutex. HandlerContext DI. Cert pinning retracted (claims aligned with implementation). |
| **v2026.2.10** | **The Hardening Release** — 3 new security layers (14→17): secure-by-default auth, exponential backoff lockout, credential isolation. Architecture overhaul: 3,611-line handler split into 9 domain modules, tool registry pattern. Gemini API retry with backoff. Multi-stage Docker build. Token CLI (`token show/rotate`). 168 tests. |
| **v2026.2.9** | `performSetup` no longer wipes credentials before Chrome opens — prevents auth destruction on failed launch |
| **v2026.2.8** | `cleanup_data` never deletes auth dirs (`browser_state/`, `chrome_profile/`) — auth survives all cleanup paths |
| **v2026.2.7** | Block headless `setup_auth` calls; robust `auth-now.mjs` standalone script with Chrome profile lock handling |
| **v2026.2.6** | New `add_folder` tool for bulk PDF/file uploads; improved tier detection for NotebookLM Plus |
| **v2026.2.5** | Fix `show_browser` silently ignored in `setup_auth` — browser now reliably opens for auth |
| **v2026.2.4** | Auth stability: 7-day state expiry, `touchStateFile` on validation, block headless `re_auth` |
| **v2026.2.3** | Studio Panel tools restored: Video Overview, Data Table generation re-enabled |
| **v2026.2.1** | Standard profile expanded: 14 → 33 tools — notebook creation, audio, source management now visible by default |
| **v2026.2.0** | Gemini 3 models (2.5 retiring March 31), Video Overviews, Data Tables, thinking level, structured JSON, SDK 1.41 |
| **v2026.1.12** | Security hardening: constant-time auth, command injection fix, memory leak fixes, MCP SDK 1.26.0 |
| **v2026.1.11** | Notebook sync extraction for new Angular UI, `NOTEBOOKLM_NO_GEMINI` env var |
| **v2026.1.10** | Tool description clarity for multi-LLM compatibility |
| **v2026.1.9** | Documentation & UX improvements, npm audit fix |
| **v2026.1.8** | Major dependency updates (zod 4.x, dotenv 17.x, post-quantum 0.5.4) |
| **v2026.1.7** | MCP Protocol UX: tool icons, human-friendly titles, behavior annotations |
| **v2026.1.4** | Defense-in-depth path validation, security hardening |
| **v2026.1.1** | Deep health checks, chat history extraction, context management |

```bash
# Quick install
claude mcp add notebooklm -- npx @pan-sec/notebooklm-mcp@latest
```

### Why Choose This MCP?

| Capability | Other MCPs | This MCP |
|------------|------------|----------|
| Query NotebookLM | ✅ Basic | ✅ **+ session management, quotas** |
| Create notebooks programmatically | ❌ | ✅ **UNIQUE** |
| Gemini Deep Research | ❌ | ✅ **EXCLUSIVE** |
| Document API (no browser) | ❌ | ✅ **EXCLUSIVE** |
| Post-quantum encryption | ❌ | ✅ **Hybrid PQ at-rest** |
| Enterprise compliance | ❌ | ✅ **GDPR/SOC2/CSSF-ready** |
| Video Overview generation | ❌ | ✅ **NEW** |
| Data Table extraction | ❌ | ✅ **NEW** |
| Chat history extraction | ❌ | ✅ |
| Deep health verification | ❌ | ✅ |

---

## 🔬 Security Audit 2026 — What We Found and Fixed

In April 2026, we commissioned a parallel deep-audit of v2026.2.11 (`main @ 2973097`) using four specialised AI code reviewers, each focused on a different attack surface: **security vulnerabilities**, **protocol correctness**, **architecture quality**, and **testing gaps and edge cases**. The four reviewers operated independently so their findings wouldn't influence each other. Together they produced a **334-item master issue list** covering protocol correctness, security vulnerabilities, architecture flaws, test gaps, and documentation accuracy. All 334 issues are resolved across v2026.3.0 and v2026.3.1.

### Audit by the Numbers

| Metric | Before (v2026.2.11) | After (v2026.3.1) |
|--------|---------------------|--------------------|
| Tests | 139 | **631 across 50 files** |
| Test suites | ~6 | **50** |
| TypeScript errors (`tsc --noEmit`) | 0 | **0 (maintained)** |
| npm audit vulnerabilities | 0 | **0 (maintained)** |
| MCP protocol compliance | Partial | **Full** (structuredContent, isError, transport tags) |
| Audit log integrity | Basic | **Hash-chain verified on read** |
| Concurrent write safety | ❌ | **✅ Write-locked** |
| Webhook SSRF | ❌ | **✅ Blocked** |

### What the Four Reviewers Found

**Security reviewer:** Identified the `forceAuth` bypass in `validateToken()` allowing unauthenticated access to filesystem tools; webhook SSRF via unvalidated delivery targets; audit log hash chain not verified on read; concurrent audit writes interleaving entries; auth token salt not persisted (tokens invalidated on restart).

**Protocol reviewer:** Found 38 tools returning incorrect response shapes (missing `structuredContent`, wrong `isError` semantics, transport tags leaking into content); all 48 tools had incorrect or missing `readOnlyHint`/`idempotentHint`/`destructiveHint` annotations; 9 tool schemas lacked numeric bounds, enabling out-of-range inputs.

**Architecture reviewer:** Flagged the 3,611-line `handlers.ts` as a maintenance liability; singleton imports throughout domain functions preventing unit testing; the 500-line `switch/case` dispatch adding O(n) overhead and making tool registration error-prone.

**Testing & edge-case reviewer:** Found test suite at 139 tests with minimal coverage of security-critical modules; `mcp-auth.ts` at near-zero coverage; no tests for prompt injection patterns, audit log tampering, or concurrent browser session state; the DSAR handler had an undetected race condition.

### Key Fixes

- **17 security vulnerabilities** addressed (auth bypass, SSRF, audit integrity, race conditions, selector injection vectors)
- **MCP protocol fully compliant** — all 48 tools return correct `structuredContent`/`isError` shapes; annotations accurate; schema bounds enforced
- **Architecture decomposed** — `handlers.ts` split into 9 domain modules with HandlerContext dependency injection; 100% unit-testable without process mocks
- **Test coverage** — 15 new security-critical test suites including browser session, auth, prompt injection, audit log, webhook, DSAR, and compliance
- **Claims aligned** — certificate pinning removed (implementation was retracted in Day 1 of the audit); PQ encryption scope documented accurately; compliance language uses "controls implemented" not "certified"

📋 Full Feature List (48 Tools)

#### Core NotebookLM (No API Key Required)
| Tool | Description |
|------|-------------|
| `ask_question` | Query notebooks with source-grounded answers |
| `add_notebook` | Add a notebook to your library |
| `list_notebooks` | List all notebooks in library |
| `select_notebook` | Set active notebook |
| `update_notebook` | Update notebook metadata |
| `remove_notebook` | Remove from library |
| `create_notebook` | Programmatically create new notebooks |
| `batch_create_notebooks` | Create multiple notebooks at once |
| `sync_library` | Sync library with NotebookLM |
| `list_sources` | List sources in a notebook |
| `add_source` | Add source to notebook |
| `add_folder` | Bulk upload PDFs/files from a local folder to a notebook |
| `remove_source` | Remove source from notebook |
| `generate_audio_overview` | Create podcast-style audio |
| `get_audio_status` | Check audio generation status |
| `download_audio` | Download generated audio |
| `generate_video_overview` | Create AI video overview (10 styles) |
| `get_video_status` | Check video generation status |
| `generate_data_table` | Generate structured data table |
| `get_data_table` | Extract data table as JSON |
| `list_sessions` | List active sessions |
| `close_session` | Close a session |
| `reset_session` | Reset session history |
| `get_health` | Check server & auth status |
| `setup_auth` | Initial authentication |
| `re_auth` | Re-authenticate |
| `cleanup_data` | Clean up local data |
| `get_quota` | Check usage quotas |
| `set_quota_tier` | Set quota tier |
| `get_query_history` | View past queries |
| `get_notebook_chat_history` | Extract browser chat history |
| `get_project_info` | Get project context |
| `export_library` | Export library backup |

#### Gemini API (Optional - Requires GEMINI_API_KEY)
| Tool | Description |
|------|-------------|
| `deep_research` | Comprehensive research agent |
| `gemini_query` | Fast grounded queries |
| `get_research_status` | Check research progress |
| `upload_document` | Upload docs to Gemini |
| `query_document` | Query uploaded documents |
| `query_chunked_document` | Query large documents |
| `list_documents` | List uploaded documents |
| `delete_document` | Delete uploaded document |

#### Webhooks & Integrations
| Tool | Description |
|------|-------------|
| `configure_webhook` | Set up webhook notifications |
| `list_webhooks` | List configured webhooks |
| `test_webhook` | Test webhook delivery |
| `remove_webhook` | Remove a webhook |

#### Enterprise Compliance (16 additional tools)
See [Compliance Documentation](./docs/COMPLIANCE-SPEC.md) for full list.

---

## Gemini Deep Research (v1.8.0)

**The most powerful research capability for AI agents — now in your MCP toolkit.**

v1.8.0 introduces the **Gemini Interactions API** as a stable, API-based research backend alongside browser automation. This gives your agents access to Google's state-of-the-art Deep Research agent.

### Why This Matters

| Challenge | Solution |
|-----------|----------|
| Browser UI changes break automation | **Gemini API is stable and versioned** |
| Need comprehensive research but no research agent | **Deep Research agent does it for you** |
| Want current information with citations | **Google Search grounding built-in** |
| Need reliable, fast queries | **API-based = no UI dependencies** |

### New Tools

#### `deep_research` — Comprehensive Research Agent

```
"Research the security implications of post-quantum cryptography adoption in financial services"
```

- Runs Google's **Deep Research agent** (same as Gemini Advanced)
- Takes 1-5 minutes for comprehensive, web-grounded analysis
- Returns structured answers with **citations and sources**
- Perfect for complex topics requiring multi-source synthesis

#### `gemini_query` — Fast Grounded Queries

```
"What are the latest CVEs for Log4j in 2025?" (with Google Search)
"Calculate the compound interest on $10,000 at 5% over 10 years" (with code execution)
"Summarize this security advisory: [URL]" (with URL context)
```

- **Google Search grounding** — Current information, not just training data
- **Code execution** — Run calculations, data analysis
- **URL context** — Analyze web pages on demand
- Models: `gemini-3-flash-preview` (default), `gemini-3-pro-preview` (powerful), `gemini-2.5-flash` (legacy)

#### `get_research_status` — Background Task Monitoring

Run deep research in the background and check progress:
```
"Start researching [topic] in the background"
... continue other work ...
"Check research status for interaction_abc123"
```

### Hybrid Architecture

```
┌──────────────────────────────────────────────────────────────────────────────┐
│                      NotebookLM MCP Server v2026.3.x                         │
├──────────────────────────────────────────────────────────────────────────────┤
│                                                                              │
│  ┌────────────────────────────────┐    ┌──────────────────────────────────┐  │
│  │      BROWSER AUTOMATION        │    │          GEMINI API              │  │
│  │    ✅ NO API KEY NEEDED        │    │    ⚡ OPTIONAL - needs API key   │  │
│  ├────────────────────────────────┤    ├──────────────────────────────────┤  │
│  │                                │    │                                  │  │
│  │  QUERY                         │    │  RESEARCH                        │  │
│  │  • ask_question                │    │  • deep_research                 │  │
│  │  • get_notebook_chat_history   │    │  • gemini_query                  │  │
│  │                                │    │  • get_research_status           │  │
│  │  CREATE & MANAGE               │    │                                  │  │
│  │  • create_notebook             │    │  DOCUMENTS                       │  │
│  │  • batch_create_notebooks      │    │  • upload_document               │  │
│  │  • manage_sources              │    │  • query_document                │  │
│  │  • generate_audio              │    │  • query_chunked_document        │  │
│  │  • generate_video_overview     │    │  • list/delete_document          │  │
│  │  • generate_data_table         │    │                                  │  │
│  │  • sync_notebook               │    │                                  │  │
│  │                                │    │                                  │  │
│  │  HEALTH & SESSIONS     v2026   │    │                                  │  │
│  │  • get_health (deep_check)     │    │  Fast API • 48h retention        │  │
│  │  • get_query_history           │    │  Auto-chunking for large PDFs    │  │
│  └────────────────────────────────┘    └────────

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Pantheon-Security](https://github.com/Pantheon-Security)
- **Source:** [Pantheon-Security/notebooklm-mcp-secure](https://github.com/Pantheon-Security/notebooklm-mcp-secure)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v2026.1.5 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **2026.1.5** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-pantheon-security-notebooklm-mcp-secure
- Seller: https://agentstack.voostack.com/s/pantheon-security
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.