NotebookLM MCP Server (Security Hardened)

🏆 The World's Most Advanced NotebookLM MCP Server

Zero-hallucination answers • Gemini Deep Research • 17 Security Layers • Enterprise Compliance

What's New 2026 • Deep Research • Document API • Create Notebooks • Security • Install

The only NotebookLM MCP with enterprise-grade security, post-quantum encryption, and full Gemini API integration.

Security-hardened fork of PleasePrompto/notebooklm-mcp • Maintained by Pantheon Security

⚡ TL;DR — What You Get

• 🔍 Query your NotebookLM notebooks — source-grounded, zero-hallucination answers
• 📚 Create & manage notebooks programmatically — no manual clicking
• 🎙️ Generate audio overviews — podcast-style summaries of your docs
• 🎬 Generate video overviews — AI video summaries with 10 visual styles NEW
• 📊 Extract data tables — structured JSON from notebook sources NEW
• 🔬 Gemini 3 + Deep Research — latest models with thinking control (optional API) NEW
• 📄 Document API — upload & query PDFs without browser (optional API)
• 🔐 17 security layers — post-quantum encryption, audit logs, secrets scanning
• ✅ Compliance-ready architecture — built to GDPR, SOC2, and CSSF standards (controls implemented; formal certification requires third-party audit)
• 💡 No API key required — core features work with just browser auth

---

🚀 What's New in 2026

Latest: v2026.3.1 — All 334 audit issues resolved. 631 tests. Full MCP protocol compliance.

Version	Highlights
v2026.3.1	Security Audit Complete — All 334 issues from the independent audit resolved. Tests: 609 → 631. Code quality: URL resolution deduplicated, handler extraction, non-null assertions eliminated. Test gaps closed: validateNotebookId, error body shape, delete_document confirm guard, sanitized throws, log rotation, rate-limiter memory bound, range clamping.
v2026.3.0	The Security Audit Release — Four parallel AI code reviews (security, protocol, architecture, testing) against 334 issues. All highs and mediums resolved. Tests: 139 → 609 across 50 files (4.4×). Full MCP protocol compliance: structuredContent, isError, transport tags. Schema bounds on all 48 tools. Annotation correctness. Webhook SSRF fix. Audit log integrity (hash chain, concurrent write lock, rotation continuity). Per-page mutex. HandlerContext DI. Cert pinning retracted (claims aligned with implementation).
v2026.2.10	The Hardening Release — 3 new security layers (14→17): secure-by-default auth, exponential backoff lockout, credential isolation. Architecture overhaul: 3,611-line handler split into 9 domain modules, tool registry pattern. Gemini API retry with backoff. Multi-stage Docker build. Token CLI (token show/rotate). 168 tests.
v2026.2.9	performSetup no longer wipes credentials before Chrome opens — prevents auth destruction on failed launch
v2026.2.8	cleanup_data never deletes auth dirs (browser_state/, chrome_profile/) — auth survives all cleanup paths
v2026.2.7	Block headless setup_auth calls; robust auth-now.mjs standalone script with Chrome profile lock handling
v2026.2.6	New add_folder tool for bulk PDF/file uploads; improved tier detection for NotebookLM Plus
v2026.2.5	Fix show_browser silently ignored in setup_auth — browser now reliably opens for auth
v2026.2.4	Auth stability: 7-day state expiry, touchStateFile on validation, block headless re_auth
v2026.2.3	Studio Panel tools restored: Video Overview, Data Table generation re-enabled
v2026.2.1	Standard profile expanded: 14 → 33 tools — notebook creation, audio, source management now visible by default
v2026.2.0	Gemini 3 models (2.5 retiring March 31), Video Overviews, Data Tables, thinking level, structured JSON, SDK 1.41
v2026.1.12	Security hardening: constant-time auth, command injection fix, memory leak fixes, MCP SDK 1.26.0
v2026.1.11	Notebook sync extraction for new Angular UI, NOTEBOOKLM_NO_GEMINI env var
v2026.1.10	Tool description clarity for multi-LLM compatibility
v2026.1.9	Documentation & UX improvements, npm audit fix
v2026.1.8	Major dependency updates (zod 4.x, dotenv 17.x, post-quantum 0.5.4)
v2026.1.7	MCP Protocol UX: tool icons, human-friendly titles, behavior annotations
v2026.1.4	Defense-in-depth path validation, security hardening
v2026.1.1	Deep health checks, chat history extraction, context management

# Quick install
claude mcp add notebooklm -- npx @pan-sec/notebooklm-mcp@latest

Why Choose This MCP?

Capability	Other MCPs	This MCP
Query NotebookLM	✅ Basic	✅ + session management, quotas
Create notebooks programmatically	❌	✅ UNIQUE
Gemini Deep Research	❌	✅ EXCLUSIVE
Document API (no browser)	❌	✅ EXCLUSIVE
Post-quantum encryption	❌	✅ Hybrid PQ at-rest
Enterprise compliance	❌	✅ GDPR/SOC2/CSSF-ready
Video Overview generation	❌	✅ NEW
Data Table extraction	❌	✅ NEW
Chat history extraction	❌	✅
Deep health verification	❌	✅

---

🔬 Security Audit 2026 — What We Found and Fixed

In April 2026, we commissioned a parallel deep-audit of v2026.2.11 (main @ 2973097) using four specialised AI code reviewers, each focused on a different attack surface: security vulnerabilities, protocol correctness, architecture quality, and testing gaps and edge cases. The four reviewers operated independently so their findings wouldn't influence each other. Together they produced a 334-item master issue list covering protocol correctness, security vulnerabilities, architecture flaws, test gaps, and documentation accuracy. All 334 issues are resolved across v2026.3.0 and v2026.3.1.

Audit by the Numbers

Metric	Before (v2026.2.11)	After (v2026.3.1)
Tests	139	631 across 50 files
Test suites	~6	50
TypeScript errors (tsc --noEmit)	0	0 (maintained)
npm audit vulnerabilities	0	0 (maintained)
MCP protocol compliance	Partial	Full (structuredContent, isError, transport tags)
Audit log integrity	Basic	Hash-chain verified on read
Concurrent write safety	❌	✅ Write-locked
Webhook SSRF	❌	✅ Blocked

What the Four Reviewers Found

Security reviewer: Identified the forceAuth bypass in validateToken() allowing unauthenticated access to filesystem tools; webhook SSRF via unvalidated delivery targets; audit log hash chain not verified on read; concurrent audit writes interleaving entries; auth token salt not persisted (tokens invalidated on restart).

Protocol reviewer: Found 38 tools returning incorrect response shapes (missing structuredContent, wrong isError semantics, transport tags leaking into content); all 48 tools had incorrect or missing readOnlyHint/idempotentHint/destructiveHint annotations; 9 tool schemas lacked numeric bounds, enabling out-of-range inputs.

Architecture reviewer: Flagged the 3,611-line handlers.ts as a maintenance liability; singleton imports throughout domain functions preventing unit testing; the 500-line switch/case dispatch adding O(n) overhead and making tool registration error-prone.

Testing & edge-case reviewer: Found test suite at 139 tests with minimal coverage of security-critical modules; mcp-auth.ts at near-zero coverage; no tests for prompt injection patterns, audit log tampering, or concurrent browser session state; the DSAR handler had an undetected race condition.

Key Fixes

• 17 security vulnerabilities addressed (auth bypass, SSRF, audit integrity, race conditions, selector injection vectors)
• MCP protocol fully compliant — all 48 tools return correct structuredContent/isError shapes; annotations accurate; schema bounds enforced
• Architecture decomposed — handlers.ts split into 9 domain modules with HandlerContext dependency injection; 100% unit-testable without process mocks
• Test coverage — 15 new security-critical test suites including browser session, auth, prompt injection, audit log, webhook, DSAR, and compliance
• Claims aligned — certificate pinning removed (implementation was retracted in Day 1 of the audit); PQ encryption scope documented accurately; compliance language uses "controls implemented" not "certified"

Core NotebookLM (No API Key Required)

Tool	Description
ask_question	Query notebooks with source-grounded answers
add_notebook	Add a notebook to your library
list_notebooks	List all notebooks in library
select_notebook	Set active notebook
update_notebook	Update notebook metadata
remove_notebook	Remove from library
create_notebook	Programmatically create new notebooks
batch_create_notebooks	Create multiple notebooks at once
sync_library	Sync library with NotebookLM
list_sources	List sources in a notebook
add_source	Add source to notebook
add_folder	Bulk upload PDFs/files from a local folder to a notebook
remove_source	Remove source from notebook
generate_audio_overview	Create podcast-style audio
get_audio_status	Check audio generation status
download_audio	Download generated audio
generate_video_overview	Create AI video overview (10 styles)
get_video_status	Check video generation status
generate_data_table	Generate structured data table
get_data_table	Extract data table as JSON
list_sessions	List active sessions
close_session	Close a session
reset_session	Reset session history
get_health	Check server & auth status
setup_auth	Initial authentication
re_auth	Re-authenticate
cleanup_data	Clean up local data
get_quota	Check usage quotas
set_quota_tier	Set quota tier
get_query_history	View past queries
get_notebook_chat_history	Extract browser chat history
get_project_info	Get project context
export_library	Export library backup

Gemini API (Optional - Requires GEMINI_API_KEY)

Tool	Description
deep_research	Comprehensive research agent
gemini_query	Fast grounded queries
get_research_status	Check research progress
upload_document	Upload docs to Gemini
query_document	Query uploaded documents
query_chunked_document	Query large documents
list_documents	List uploaded documents
delete_document	Delete uploaded document

Webhooks & Integrations

Tool	Description
configure_webhook	Set up webhook notifications
list_webhooks	List configured webhooks
test_webhook	Test webhook delivery
remove_webhook	Remove a webhook

Enterprise Compliance (16 additional tools)

See Compliance Documentation for full list.

---

Gemini Deep Research (v1.8.0)

The most powerful research capability for AI agents — now in your MCP toolkit.

v1.8.0 introduces the Gemini Interactions API as a stable, API-based research backend alongside browser automation. This gives your agents access to Google's state-of-the-art Deep Research agent.

Why This Matters

Challenge	Solution
Browser UI changes break automation	Gemini API is stable and versioned
Need comprehensive research but no research agent	Deep Research agent does it for you
Want current information with citations	Google Search grounding built-in
Need reliable, fast queries	API-based = no UI dependencies

New Tools

deep_research — Comprehensive Research Agent

"Research the security implications of post-quantum cryptography adoption in financial services"

• Runs Google's Deep Research agent (same as Gemini Advanced)
• Takes 1-5 minutes for comprehensive, web-grounded analysis
• Returns structured answers with citations and sources
• Perfect for complex topics requiring multi-source synthesis

gemini_query — Fast Grounded Queries

"What are the latest CVEs for Log4j in 2025?" (with Google Search)
"Calculate the compound interest on $10,000 at 5% over 10 years" (with code execution)
"Summarize this security advisory: [URL]" (with URL context)

• Google Search grounding — Current information, not just training data
• Code execution — Run calculations, data analysis
• URL context — Analyze web pages on demand
• Models: gemini-3-flash-preview (default), gemini-3-pro-preview (powerful), gemini-2.5-flash (legacy)

get_research_status — Background Task Monitoring

Run deep research in the background and check progress:

"Start researching [topic] in the background"
... continue other work ...
"Check research status for interaction_abc123"

Hybrid Architecture

┌──────────────────────────────────────────────────────────────────────────────┐
│                      NotebookLM MCP Server v2026.3.x                         │
├──────────────────────────────────────────────────────────────────────────────┤
│                                                                              │
│  ┌────────────────────────────────┐    ┌──────────────────────────────────┐  │
│  │      BROWSER AUTOMATION        │    │          GEMINI API              │  │
│  │    ✅ NO API KEY NEEDED        │    │    ⚡ OPTIONAL - needs API key   │  │
│  ├────────────────────────────────┤    ├──────────────────────────────────┤  │
│  │                                │    │                                  │  │
│  │  QUERY                         │    │  RESEARCH                        │  │
│  │  • ask_question                │    │  • deep_research                 │  │
│  │  • get_notebook_chat_history   │    │  • gemini_query                  │  │
│  │                                │    │  • get_research_status           │  │
│  │  CREATE & MANAGE               │    │                                  │  │
│  │  • create_notebook             │    │  DOCUMENTS                       │  │
│  │  • batch_create_notebooks      │    │  • upload_document               │  │
│  │  • manage_sources              │    │  • query_document                │  │
│  │  • generate_audio              │    │  • query_chunked_document        │  │
│  │  • generate_video_overview     │    │  • list/delete_document          │  │
│  │  • generate_data_table         │    │                                  │  │
│  │  • sync_notebook               │    │                                  │  │
│  │                                │    │                                  │  │
│  │  HEALTH & SESSIONS     v2026   │    │                                  │  │
│  │  • get_health (deep_check)     │    │  Fast API • 48h retention        │  │
│  │  • get_query_history           │    │  Auto-chunking for large PDFs    │  │
│  └────────────────────────────────┘    └──────────────────────────────────┘  │
│                                                                              │
│                      ┌─────────────────────────────────┐                     │
│                      │       17 SECURITY LAYERS        │                     │
│                      │   Post-Quantum • Audit Logs     │                     │
│                      │   Secrets Scan • Memory Wipe    │                     │
│                      │  GDPR • SOC2 • CSSF Ready*      │                     │
│                      └─────────────────────────────────┘                     │
└──────────────────────────────────────────────────────────────────────────────┘

💡 Gemini API is completely optional! All core NotebookLM features (ask_question, notebooks, sessions, audio) work via browser automation with no API key required. The Gemini tools below are bonus features for users who want direct API access.

Gemini Configuration (Optional)

# Only required if you want Gemini API features (deep_research, gemini_query, upload_document)
GEMINI_API_KEY=your-api-key          # Get from https://aistudio.google.com/apikey

# Optional settings
GEMINI_DEFAULT_MODEL=gemini-3-flash-preview  # Default model (was gemini-2.5-flash)
GEMINI_DEEP_RESEARCH_ENABLED=true            # Enable Deep Research
GEMINI_TIMEOUT_MS=30000                      # API timeout

When to Use Which

Task	Best Tool	Why
Questions about YOUR documents	ask_question	Grounded on your uploaded sources
Comprehensive topic research	deep_research	Multi-source synthesis with citations
Current events / recent info	gemini_query + google_search	Live web data
Code calculations	gemini_query + code_execution	Reliable computation
Analyze a webpage	gemini_query + url_context	Direct page analysis
Quick PDF/document analysis	upload_document + query_document	Fast API, no browser (NEW!)

---

📄 Document API (v1.9.0)

Upload and query documents directly via Gemini API — no browser automation needed.

v1.9.0 introduces the Gemini Files API for fast, reliable document analysis. Upload PDFs, analyze them instantly, and delete when done.

Why This Matters

Feature	Browser Mode	Document API
Speed	Seconds	Milliseconds
Reliability	UI-dependent	API-stable
File Support	Via NotebookLM	50MB PDFs, 1000 pages
Retention	Permanent	48 hours
Setup	Auth + cookies	Just API key

New Tools

upload_document — Fast Document Upload

Upload any document to Gemini for instant querying:

Upload /path/to/research-paper.pdf

• Supported: PDF (50MB, 1000 pages), TXT, MD, HTML, CSV, JSON, DOCX, images, audio, video
• 48-hour retention — files auto-expire, or delete manually
• Returns a file ID for querying

query_document — Ask Questions About Documents

"What are the main findings in this research paper?"
"Summarize section 3 of the document"
"Extract all statistics mentioned in the PDF"

• Full document understanding (text, tables, charts, diagrams)
• Multi-document queries (compare multiple files)
• Fast API response (no browser wait)

list_documents — See All Uploaded Files

List all my uploaded documents

Shows file names, sizes, MIME types, and expiration times.

delete_document — Clean Up Sensitive Files

Delete file xyz123

Immediately remove files (don't wait for 48h expiration).

Workflow Example

1. upload_document("/research/paper.pdf")
   → Returns: files/abc123

2. query_document("files/abc123", "What methodology was used?")
   → Returns: "The paper uses a mixed-methods approach combining..."

3. query_document("files/abc123", "List all cited authors")
   → Returns: "Smith et al. (2024), Johnson (2023)..."

4. delete_document("files/abc123")
   → File removed

Auto-Chunking for Large PDFs (v1.10.0)

No file size limits — PDFs of any size are automatically handled.

When you upload a PDF that exceeds Gemini's limits (50MB or 1000 pages), the system automatically:

1. Detects the oversized PDF
2. Splits it into optimal chunks (500 pages each)
3. Uploads all chunks in parallel
4. Returns chunk metadata for querying

upload_document("/research/massive-2000-page-report.pdf")

→ Returns:
{
  "wasChunked": true,
  "totalPages": 2000,
  "chunks": [
    { "fileName": "files/abc1", "pageStart": 1, "pageEnd": 500 },
    { "fileName": "files/abc2", "pageStart": 501, "pageEnd": 1000 },
    { "fileName": "files/abc3", "pageStart": 1001, "pageEnd": 1500 },
    { "fileName": "files/abc4", "pageStart": 1501, "pageEnd": 2000 }
  ],
  "allFileNames": ["files/abc1", "files/abc2", "files/abc3", "files/abc4"]
}

query_chunked_document — Query All Chunks at Once

For chunked documents, use this tool to query all parts and get an aggregated answer:

query_chunked_document(
  file_names: ["files/abc1", "files/abc2", "files/abc3", "files/abc4"],
  query: "What are the key recommendations in this report?"
)

→ Queries each chunk, then synthesizes a unified answer

When to Use Document API vs NotebookLM

Scenario	Use
Quick one-off document analysis	Document API — fast, no setup
Building a permanent knowledge base	NotebookLM — permanent storage
Analyzing sensitive documents	Document API — 48h auto-delete
Multi-source research over time	NotebookLM — organized notebooks
CI/CD pipeline document processing	Document API — API-native
Large PDFs (1000+ pages)	Document API — auto-chunking

---

Programmatic Notebook Creation (v1.7.0+)

Create NotebookLM notebooks entirely from code — no manual clicks required.

Most MCP servers can only read from NotebookLM. This one can create notebooks, add sources, and generate audio — all programmatically.

create_notebook — Build Notebooks Instantly

Create a complete notebook with multiple sources in one command:

{
  "name": "Security Research 2025",
  "sources": [
    { "type": "url", "value": "https://owasp.org/Top10" },
    { "type": "file", "value": "/path/to/security-report.pdf" },
    { "type": "text", "value": "Custom analysis notes...", "title": "My Notes" }
  ],
  "description": "OWASP security best practices",
  "topics": ["security", "owasp", "vulnerabilities"]
}

Supported source types:

• URL — Web pages, documentation, articles
• File — PDF, DOCX, TXT, and more
• Text — Raw text, code snippets, notes

batch_create_notebooks — Scale Up

Create up to 10 notebooks in a single operation: