Skip to content

feat: Implement a FastMCP server to expose NotebookLM functionalities for listing, creating, adding sources, and chatting. #156

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
StudioPi048 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat: Implement a FastMCP server to expose NotebookLM functionalities for listing, creating, adding sources, and chatting. #156

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions mcp_server.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
import asyncio
from fastmcp import FastMCP
from notebooklm import NotebookLMClient

mcp = FastMCP("NotebookLM")

@mcp.tool()
async def list_notebooks():
"""List all NotebookLM notebooks available in the account."""
async with await NotebookLMClient.from_storage() as client:
Copy link

@gemini-code-assist gemini-code-assist bot Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The pattern async with await NotebookLMClient.from_storage() as client: is repeated in every tool function. This is inefficient for a server application because it creates a new NotebookLMClient instance for every API call. This involves I/O for reading storage state and setting up a new HTTP client each time. A NotebookLMClient is designed to be long-lived and should be reused across requests.

Consider creating a single client instance when the application starts and closing it on shutdown. This will significantly improve performance and resource management. You can likely achieve this using your server framework's startup and shutdown lifecycle events.

notebooks = await client.notebooks.list()
return [{"id": nb.id, "title": nb.title} for nb in notebooks]

@mcp.tool()
async def create_notebook(title: str):
"""Create a new NotebookLM notebook."""
async with await NotebookLMClient.from_storage() as client:
nb = await client.notebooks.create(title)
return {"id": nb.id, "title": nb.title}

@mcp.tool()
async def add_source_url(notebook_id: str, url: str):
Copy link

@gemini-code-assist gemini-code-assist bot Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

The notebook_id parameter is used to construct the URL path for RPC calls to Google's NotebookLM API without any validation. An attacker could provide a malicious notebook_id containing path traversal sequences (e.g., ../../) to manipulate the request path and potentially call unintended API endpoints on the notebooklm.google.com domain using the user's authenticated session. This is possible because the notebook_id is directly interpolated into the source_path in the underlying library calls. Validate that notebook_id matches the expected format (e.g., a UUID or alphanumeric string) before using it in API calls.

"""Add a web URL source to the NotebookLM notebook."""
async with await NotebookLMClient.from_storage() as client:
await client.sources.add_url(notebook_id, url, wait=True)
return {"status": "success", "url": url}

@mcp.tool()
async def chat_ask(notebook_id: str, message: str):
Copy link

@gemini-code-assist gemini-code-assist bot Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

The notebook_id parameter is used to construct the URL path for RPC calls to Google's NotebookLM API without any validation. An attacker could provide a malicious notebook_id containing path traversal sequences (e.g., ../../) to manipulate the request path and potentially call unintended API endpoints on the notebooklm.google.com domain using the user's authenticated session. This is possible because the notebook_id is directly interpolated into the source_path in the underlying library calls. Validate that notebook_id matches the expected format (e.g., a UUID or alphanumeric string) before using it in API calls.

"""Ask a question to the NotebookLM notebook and get an answer based on its sources."""
async with await NotebookLMClient.from_storage() as client:
result = await client.chat.ask(notebook_id, message)
return {"answer": result.text if hasattr(result, 'text') else result.answer}
Copy link

@gemini-code-assist gemini-code-assist bot Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The expression result.text if hasattr(result, 'text') else result.answer suggests uncertainty about the structure of the AskResult object. Based on the notebooklm library's implementation, client.chat.ask returns an AskResult object that consistently has an answer attribute. Relying on this attribute directly makes the code cleaner and easier to maintain. If there's a specific reason to check for a .text attribute (e.g., for backward compatibility), it would be helpful to add a comment explaining why.

Suggested change
return {"answer": result.text if hasattr(result, 'text') else result.answer}
return {"answer": result.answer}


if __name__ == "__main__":
mcp.run()