PlugWiki
jupyter-mcp-server logo

Jupyter MCP Server by Datalayer: Let Your Assistant Read, Edit and Run Notebooks

CommunityLocal
GetPyPIjupyter-mcp-serverdatalayer/jupyter-mcp-server

Lets Claude, Cursor and other assistants open, edit and run the cells of your Jupyter notebooks.

This server connects your assistant to a Jupyter server you already run, local or JupyterHub. It can read notebooks, change cells, and run code on the notebook's kernel. It is built and maintained by Datalayer.

You start JupyterLab with a token first and then give that address and token to the server. The code runs on your Jupyter server, so the assistant can do whatever that kernel can do. Datalayer also offers a hosted version.

Good for

  • Data scientists who want an assistant to write and run notebook cells with them
  • Developers debugging notebook code with a live kernel
  • Teams on JupyterHub or Datalayer who want agents to work in shared notebooks

Works in

12 should work

Tap an app to see how to set it up and any known problems.

Install jupyter-mcp-server

Claude Code

  1. 1

    Copy this prompt.

    Add the jupyter-mcp-server server to Claude Code. Run this command:
    
    claude mcp add jupyter -e JUPYTER_URL=<JUPYTER_URL> -e JUPYTER_TOKEN=<JUPYTER_TOKEN> -- uvx jupyter-mcp-server@latest
    
    Ask me for JUPYTER_URL, JUPYTER_TOKEN and only put the values in that config, nowhere else.
    
    Then check that it loaded and tell me if I need to sign in or restart.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires uv (Python).

Start JupyterLab with a token first, with jupyter-collaboration and jupyter-mcp-tools installed in the same environment; the README quick start shows how. Replace the address and token with yours. The uvx method runs jupyter-mcp-server@latest, as the README does. The Docker method runs the datalayer/jupyter-mcp-server image: the address below is for macOS and Windows (host.docker.internal); on Linux, add "--network=host" before the image name in args and use http://localhost:8888. Set ALLOW_IMG_OUTPUT to false if your model cannot read images.

Built from the package data we hold. Not yet tested by us.

Tools

  • Browses the Jupyter server's files

    Lists files and folders on the Jupyter server recursively, with a depth limit, paging and a name pattern. Use it to find a notebook before opening it.

    Try: “List the notebooks in the projects folder on my Jupyter server.”

    Files · list_files

  • Lists running and available kernels

    Shows each kernel on the Jupyter server with its id, name, state and connection details, so the assistant can pick one to run code in.

    Try: “Which kernels are running on my Jupyter server?”

    Read · list_kernels

  • Opens a notebook and makes it active

    Connects to a notebook by path, or creates it, and sets it as the one later cell tools work on. You can attach a kernel that is already running.

    Try: “Open analysis/sales.ipynb and make it the active notebook.”

    Runs code · use_notebook

  • Lists the notebooks opened this session

    Shows the notebooks that were opened with the open tool in this session and which one is active.

    Try: “Which notebooks do we have open?”

    Read · list_notebooks

  • Restarts a notebook's kernel

    Restarts the kernel behind one notebook, which clears its variables and in-memory state.

    Try: “Restart the kernel for sales.ipynb.”

    Runs code · restart_notebook

  • Disconnects from a notebook

    Stops working with one notebook and releases the resources held for it. The notebook file stays on the server.

    Try: “Disconnect from sales.ipynb.”

    Write · unuse_notebook

  • Reads a notebook's cells

    Returns each cell's index, source, type and execution count. A brief format gives a quick map, and a detailed format gives full content for a range of cells.

    Try: “Give me a brief overview of the active notebook.”

    Read · read_notebook

  • Adds a cell at a position

    Inserts a new code or markdown cell at the position you choose in the active notebook.

    Try: “Add a markdown cell at the top that explains this analysis.”

    Write · insert_cell

  • Replaces a cell's whole source

    Replaces everything in a cell with new text and returns a diff of the change. Meant for full rewrites; the targeted edit tool is safer for small changes.

    Try: “Rewrite cell 4 to use a rolling average instead.”

    Write · overwrite_cell_source

  • Finds and replaces text inside a cell

    Replaces literal text in a cell, which must match exactly once unless you ask to replace all, and returns a diff. Only the matched part changes.

    Try: “In cell 3, rename the variable df to sales_df.”

    Write · edit_cell_source

  • Runs a cell and returns the output

    Runs one cell of the active notebook on its kernel with a timeout, and returns the outputs, including plots as images when allowed.

    Try: “Run cell 5 and show me the chart.”

    Runs code · execute_cell

  • Adds a code cell and runs it

    Inserts a new code cell at a position and runs it in one step, with a timeout, optional streaming and progress updates.

    Try: “Add a cell that prints df.describe() and run it.”

    Runs code · insert_execute_code_cell

Read from the source code

Permissions

high risk · 4 things to watch · 3 advisories

High risk

The server can run any code the assistant writes on your Jupyter kernel and can overwrite or delete notebook cells. Run it against a Jupyter that holds only data you can risk, keep your notebooks backed up, and bind Jupyter to 127.0.0.1.

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • It runs code on your Jupyter kernel

    execute_code, execute_cell and insert_execute_code_cell run whatever the assistant writes, with the same access as your notebook (files, network, installed packages). There is no read-only mode, so approve runs in your client and use a Jupyter with only the data you can risk. github.com

  • It can overwrite and delete cells

    The edit, overwrite, move and delete tools change the notebook, and the open notebook is saved as you work. Keep notebooks in git or a backup before a long session. github.com

  • The README starts Jupyter on every interface

    The quick start runs JupyterLab with --ip 0.0.0.0 and a short example token. Anyone who can reach that port and has the token can run code, so use 127.0.0.1 and a long random token. github.com

  • Older versions had critical security holes

    Versions through 1.0.2 had unauthenticated management routes and a DNS-rebinding flaw, and a Host-header bypass of that fix was open until 2.1.3. The current release 2.2.4 is past all three; install the latest and avoid anything older than 2.1.3. github.com

Security advisories

Technical details
Turning on read-onlyNo read-only mode is documented; the run tools execute code on the kernel.
Talks toYour Jupyter server at JUPYTER_URL. Optional code sandbox services you choose (Datalayer, Kaggle, Modal, E2B and others) receive the code you run there
Sign-in and keysThe Jupyter token goes in the env block of your MCP client config. With the hosted version you sign in through the browser instead.
Scopes
  • JUPYTER_TOKEN: full access to the Jupyter server it points at

Questions

Is the Jupyter MCP server official?

No. It is built and maintained by Datalayer, a company, and is not from Project Jupyter. Datalayer ships it from its own repository. We found no MCP server published by Project Jupyter itself. A separate community project, jupyter-server-mcp, lives under the jupyter-ai-contrib GitHub organization and works differently: it registers Python functions as tools from a running Jupyter Server.

What do I need before I install it?

A running JupyterLab with real-time collaboration, started with a token. Install the collaboration and MCP tools packages in the same environment, then give the server your Jupyter address and token. The README steps cover this.

Does it work with JupyterHub or cloud notebooks?

Yes for JupyterHub, using a separate sandbox address and token. The README also lists code sandbox options such as Datalayer, Kaggle, Google Colab, Modal, Daytona, E2B, CoreWeave and Cloudflare, each with its own extra install.

Can I use the hosted version instead?

Yes. The README says Datalayer hosts this server at https://mcp.datalayer.run/mcp, with browser sign-in to your Datalayer account. Its pricing and the clients it supports are not listed in the README.

Can it run read-only?

No. The README documents no read-only mode, and the run tools execute code. If you only need to read notebooks, look at the read tools and approve each call by hand.

Are there more tools than the list shows?

Yes. With JupyterLab mode on and the MCP tools package installed, two JupyterLab tools are added by default. Four sandbox tools need the optional sandboxes extension.

Can it delete my notebook?

None of its tools deletes a notebook file, but they can delete, overwrite and move cells. Restore from your own backup or git history.

Does it work with ChatGPT or Claude on the web?

The README does not document it. The local setup runs on your computer, so web chat apps cannot reach it. Use Claude Desktop, Cursor, VS Code or another client that runs local servers.

Information

updated Nov 2, 2026

Publisher
Community
Package
jupyter-mcp-server
Registry
PyPI
Transport
stdio
Auth
token in env
Version
2.2.4
License
BSD-3-Clause
Last commit
Oct 27, 2026
Open issues
30

WebsiteGitHubPyPIChangelogIssues

Sources

Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.

Show all 4
  1. jupyter-mcp-server README · github.com
  2. jupyter-mcp-server 2.2.4 on PyPI (jupyter_mcp_server/server.py) · pypi.org
  3. server.py tool registrations (v2.2.4) · github.com
  4. jupyter-server-mcp repository · github.com

Facts from the official MCP registry, GitHub, npm, PyPI and the Docker catalog. Updated Nov 2, 2026.