
Jupyter MCP Server by Datalayer: Let Your Assistant Read, Edit and Run Notebooks
Lets Claude, Cursor and other assistants open, edit and run the cells of your Jupyter notebooks.
This server connects your assistant to a Jupyter server you already run, local or JupyterHub. It can read notebooks, change cells, and run code on the notebook's kernel. It is built and maintained by Datalayer.
You start JupyterLab with a token first and then give that address and token to the server. The code runs on your Jupyter server, so the assistant can do whatever that kernel can do. Datalayer also offers a hosted version.
Good for
- Data scientists who want an assistant to write and run notebook cells with them
- Developers debugging notebook code with a live kernel
- Teams on JupyterHub or Datalayer who want agents to work in shared notebooks
Works in
12 should work
Tap an app to see how to set it up and any known problems.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Client does not support this transport.
Client does not support this transport.
Install jupyter-mcp-server
Claude Code
- 1
Copy this prompt.
Add the jupyter-mcp-server server to Claude Code. Run this command: claude mcp add jupyter -e JUPYTER_URL=<JUPYTER_URL> -e JUPYTER_TOKEN=<JUPYTER_TOKEN> -- uvx jupyter-mcp-server@latest Ask me for JUPYTER_URL, JUPYTER_TOKEN and only put the values in that config, nowhere else. Then check that it loaded and tell me if I need to sign in or restart.
- 2
Paste it into Claude Code. It shows the change and asks before running it.
Requires uv (Python).
Start JupyterLab with a token first, with jupyter-collaboration and jupyter-mcp-tools installed in the same environment; the README quick start shows how. Replace the address and token with yours. The uvx method runs jupyter-mcp-server@latest, as the README does. The Docker method runs the datalayer/jupyter-mcp-server image: the address below is for macOS and Windows (host.docker.internal); on Linux, add "--network=host" before the image name in args and use http://localhost:8888. Set ALLOW_IMG_OUTPUT to false if your model cannot read images.
Built from the package data we hold. Not yet tested by us.
Tools
Browses the Jupyter server's files
Lists files and folders on the Jupyter server recursively, with a depth limit, paging and a name pattern. Use it to find a notebook before opening it.
Try: “List the notebooks in the projects folder on my Jupyter server.”
Files ·
list_filesLists running and available kernels
Shows each kernel on the Jupyter server with its id, name, state and connection details, so the assistant can pick one to run code in.
Try: “Which kernels are running on my Jupyter server?”
Read ·
list_kernelsOpens a notebook and makes it active
Connects to a notebook by path, or creates it, and sets it as the one later cell tools work on. You can attach a kernel that is already running.
Try: “Open analysis/sales.ipynb and make it the active notebook.”
Runs code ·
use_notebookLists the notebooks opened this session
Shows the notebooks that were opened with the open tool in this session and which one is active.
Try: “Which notebooks do we have open?”
Read ·
list_notebooksRestarts a notebook's kernel
Restarts the kernel behind one notebook, which clears its variables and in-memory state.
Try: “Restart the kernel for sales.ipynb.”
Runs code ·
restart_notebookDisconnects from a notebook
Stops working with one notebook and releases the resources held for it. The notebook file stays on the server.
Try: “Disconnect from sales.ipynb.”
Write ·
unuse_notebookReads a notebook's cells
Returns each cell's index, source, type and execution count. A brief format gives a quick map, and a detailed format gives full content for a range of cells.
Try: “Give me a brief overview of the active notebook.”
Read ·
read_notebookAdds a cell at a position
Inserts a new code or markdown cell at the position you choose in the active notebook.
Try: “Add a markdown cell at the top that explains this analysis.”
Write ·
insert_cellReplaces a cell's whole source
Replaces everything in a cell with new text and returns a diff of the change. Meant for full rewrites; the targeted edit tool is safer for small changes.
Try: “Rewrite cell 4 to use a rolling average instead.”
Write ·
overwrite_cell_sourceFinds and replaces text inside a cell
Replaces literal text in a cell, which must match exactly once unless you ask to replace all, and returns a diff. Only the matched part changes.
Try: “In cell 3, rename the variable df to sales_df.”
Write ·
edit_cell_sourceRuns a cell and returns the output
Runs one cell of the active notebook on its kernel with a timeout, and returns the outputs, including plots as images when allowed.
Try: “Run cell 5 and show me the chart.”
Runs code ·
execute_cellAdds a code cell and runs it
Inserts a new code cell at a position and runs it in one step, with a timeout, optional streaming and progress updates.
Try: “Add a cell that prints df.describe() and run it.”
Runs code ·
insert_execute_code_cellReads one cell with its output
Returns a cell's metadata and source, and its output as readable text rather than raw notebook data.
Try: “Show cell 5 and what it printed.”
Read ·
read_cellDeletes cells from a notebook
Removes the cells you name from the active notebook and can return their source so you can restore them.
Try: “Delete cells 7 to 9.”
Delete ·
delete_cellClears one cell's output
Removes the saved output and execution count of a code cell without deleting the cell.
Try: “Clear the output of cell 6.”
Delete ·
clear_cell_outputMoves a cell to a new position
Moves one cell from one index to another and keeps its type, source and outputs. The cells in between shift to make room.
Try: “Move cell 1 to the end of the notebook.”
Write ·
move_cellRuns code in a kernel without saving it
Runs code straight in the notebook's kernel, or in a kernel you name, and does not add it to the notebook. Good for magic commands, installs and quick checks of variables.
Try: “Run %pip install seaborn in the kernel, then print df.head().”
Runs code ·
execute_codePoints the server at another Jupyter
Connects to a different Jupyter server by URL and token while running, after checking the server's status address. If the check fails, the old connection stays.
Try: “Connect to the Jupyter server at http://localhost:8889 with this token.”
Network ·
connect_to_jupyter
Read from the source code
Permissions
high risk · 4 things to watch · 3 advisories
High risk
The server can run any code the assistant writes on your Jupyter kernel and can overwrite or delete notebook cells. Run it against a Jupyter that holds only data you can risk, keep your notebooks backed up, and bind Jupyter to 127.0.0.1.
What it can do
- Read your data
- Create and change things
- Delete things
- Read-only mode
Watch out for
It runs code on your Jupyter kernel
execute_code, execute_cell and insert_execute_code_cell run whatever the assistant writes, with the same access as your notebook (files, network, installed packages). There is no read-only mode, so approve runs in your client and use a Jupyter with only the data you can risk. github.com
It can overwrite and delete cells
The edit, overwrite, move and delete tools change the notebook, and the open notebook is saved as you work. Keep notebooks in git or a backup before a long session. github.com
The README starts Jupyter on every interface
The quick start runs JupyterLab with --ip 0.0.0.0 and a short example token. Anyone who can reach that port and has the token can run code, so use 127.0.0.1 and a long random token. github.com
Older versions had critical security holes
Versions through 1.0.2 had unauthenticated management routes and a DNS-rebinding flaw, and a Host-header bypass of that fix was open until 2.1.3. The current release 2.2.4 is past all three; install the latest and avoid anything older than 2.1.3. github.com
Security advisories
3 known advisories, 2 with no fixed version yet.
- Host-header spoof bypassed the fix for CVE-2026-77359 because the management route check trusted the client-supplied Host header.critical · Fixed in 2.1.3 · GHSA-f8rf-rcrx-h6r9
- CVE-2026-77359: browser DNS rebinding could hijack the Jupyter backend through management routes. Affects versions up to 1.0.2.critical · GHSA-9x8x-crjq-g64h
- CVE-2026-77318: unauthenticated management routes could hijack the Jupyter backend in standalone HTTP mode. Affects versions up to 1.0.2.high · GHSA-24pw-rf5p-mgp7
Technical details
| Turning on read-only | No read-only mode is documented; the run tools execute code on the kernel. |
|---|---|
| Talks to | Your Jupyter server at JUPYTER_URL. Optional code sandbox services you choose (Datalayer, Kaggle, Modal, E2B and others) receive the code you run there |
| Sign-in and keys | The Jupyter token goes in the env block of your MCP client config. With the hosted version you sign in through the browser instead. |
| Scopes |
|
Questions
Is the Jupyter MCP server official?
No. It is built and maintained by Datalayer, a company, and is not from Project Jupyter. Datalayer ships it from its own repository. We found no MCP server published by Project Jupyter itself. A separate community project, jupyter-server-mcp, lives under the jupyter-ai-contrib GitHub organization and works differently: it registers Python functions as tools from a running Jupyter Server.
What do I need before I install it?
A running JupyterLab with real-time collaboration, started with a token. Install the collaboration and MCP tools packages in the same environment, then give the server your Jupyter address and token. The README steps cover this.
Does it work with JupyterHub or cloud notebooks?
Yes for JupyterHub, using a separate sandbox address and token. The README also lists code sandbox options such as Datalayer, Kaggle, Google Colab, Modal, Daytona, E2B, CoreWeave and Cloudflare, each with its own extra install.
Can I use the hosted version instead?
Yes. The README says Datalayer hosts this server at https://mcp.datalayer.run/mcp, with browser sign-in to your Datalayer account. Its pricing and the clients it supports are not listed in the README.
Can it run read-only?
No. The README documents no read-only mode, and the run tools execute code. If you only need to read notebooks, look at the read tools and approve each call by hand.
Are there more tools than the list shows?
Yes. With JupyterLab mode on and the MCP tools package installed, two JupyterLab tools are added by default. Four sandbox tools need the optional sandboxes extension.
Can it delete my notebook?
None of its tools deletes a notebook file, but they can delete, overwrite and move cells. Restore from your own backup or git history.
Does it work with ChatGPT or Claude on the web?
The README does not document it. The local setup runs on your computer, so web chat apps cannot reach it. Use Claude Desktop, Cursor, VS Code or another client that runs local servers.
Information
updated Nov 2, 2026
- Publisher
- Community
- Package
jupyter-mcp-server- Registry
- PyPI
- Transport
- stdio
- Auth
- token in env
- Version
- 2.2.4
- License
- BSD-3-Clause
- Last commit
- Oct 27, 2026
- Open issues
- 30
Sources
Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.
Show all 4Hide
- jupyter-mcp-server README · github.com
- jupyter-mcp-server 2.2.4 on PyPI (jupyter_mcp_server/server.py) · pypi.org
- server.py tool registrations (v2.2.4) · github.com
- jupyter-server-mcp repository · github.com