Jupyter MCP Server — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track notebook, kernel, and client compatibility because execution environments vary

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

AI-assisted notebook management and execution

What we know

Connects AI clients to Jupyter notebooks for browsing, editing, execution and optional sandbox workflows.

Maintenance / activity evidence

Observed Oct 5, 2026 (UTC)docs: review architecture diagrams ( 483)

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Read/mutate notebooks, cells and kernels; execute code. Writes: Edit cells; Clear outputs; Restart/release kernels; Execute code.
Hosted sign-in/approval; local keyless.
Sensitive access: Notebook contents, Executable code

Notebook mutation and arbitrary code execution are high-authority operations.

Security source · repository notice ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

1,296 repository stars

Stars observed Oct 6, 2026.

30-day package downloads intentionally left null because the package-stats provider ran out of credits during Batch 3 QA.

All limitations / Review context

Which Jupyter actions and execution boundaries does the server document?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

Notebook mutation and arbitrary code execution are high-authority operations.
Read/mutate notebooks, cells and kernels; execute code.
Hosted sign-in/approval; local keyless.
Notebook/code outputs are returned to the client; hosted retention not established.
Reviewed write actions: Edit cells; Clear outputs; Restart/release kernels; Execute code
Sensitive access: Notebook contents, Executable code
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
The fetched official SECURITY.md path returned HTTP 404; it was not treated as positive evidence.
Hosted pricing/retention
Exact local transport command
Sandbox tools require an optional extension.
Hosted mode requires sign-in and approval.

Original activity observations

2026-10-05T11:18:53Z: docs: review architecture diagrams ( 483)

Technical identity

github.com/datalayer/jupyter-mcp-server

Exact implementation source: https://github.com/datalayer/jupyter-mcp-server ↗
Reviewed resource type: MCP Server
Repository identity: datalayer/jupyter-mcp-server
Package identity: pypi:jupyter-mcp-server
Service endpoint: https://mcp.datalayer.run/mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
datalayer/jupyter-mcp-server
Recorded repository material and project history.
Evidence source ↗
jupyter-mcp-server.datalayer.tech/
Source material retained for this review.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 13, 2026.

Additional setup details required — see the specific gaps below.

Warning

Notebook tool can execute Python/code; treat as code execution authority.
Exact vendor-specific credential revoke procedure not established from checked official Setup documentation; may be external or not applicable. Do not invent.
Installer may modify local system or require credentials; review publisher documentation before running.
Replace the supplied credential/path placeholders privately; use only the named configuration schema.
stopping JupyterLab is a separate action that may terminate running kernels or unsaved notebooks.
Uninstall Python dependencies only after confirming other notebooks do not rely on them.
MCP100 client-scope note: this Claude Code CLI example applies only to that client and the exact registered name in the command. Desktop, Cursor and other clients use their own configuration; do not run it for a differently named entry.

Install / connect
Publisher instructions
Publisher-specific setup path. Follow prerequisites, then register or connect to your MCP host.
publisher documented install or connect · Publisher instructions · Review before use
```
pip install "jupyter-mcp-server>=1.5.0" "code-sandboxes>=1.1.1"
```
Configure / authenticate
Publisher instructions
Publisher also offers remote https://mcp.datalayer.run/mcp with browser OAuth (no local install). Local mode requires JupyterLab and compatible code-sandboxes version.
Advanced configuration · claude desktop json · Publisher instructions
claude desktop json · Publisher instructions
{ "mcpServers": { "jupyter": { "args": [ "jupyter-mcp-server@latest" ], "command": "uvx", "env": { "ALLOW_IMG_OUTPUT": "true", "JUPYTER_TOKEN": "REPLACE_WITH_YOUR_TOKEN", "JUPYTER_URL": "http://localhost:8888" } } } }
Check connection
Suggested check
For remote OAuth discover notebook tools; for local check Jupyter collaboration/autosave before querying notebooks.
Remove / uninstall / revoke
MCP100 setup guide
Disconnect Datalayer connector in the MCP client, or delete local Jupyter registration. Stop local JupyterLab only if started for this MCP.
MCP100 client-scope guidance: each CLI removal example targets only its named client and exact registered entry. Package names, Desktop/Cursor configuration keys and Codex/Claude registration names may differ; use the entry you actually registered. Client removal does not revoke provider credentials.
claude mcp remove jupyter

Official Documentation & Sources

What it does

Connects AI clients to Jupyter notebooks for browsing, editing, execution and optional sandbox workflows.

Capability: Developer Tools
Resource type: MCP Server
Industry: Education & Research
Best fit: AI-assisted notebook management and execution

Representative uses

Browse Jupyter files and kernels
Create/read/edit/reorder notebook cells
Execute code
Launch/manage optional code sandboxes

Limitations

Sandbox tools require an optional extension.
Hosted mode requires sign-in and approval.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Hosted sign-in/approval; local keyless.
Permissions: Read/mutate notebooks, cells and kernels; execute code.
Data handling: Notebook/code outputs are returned to the client; hosted retention not established.
Cost: freemium
Risk and cautions: Notebook mutation and arbitrary code execution are high-authority operations.

Access scope and cautions

Write actions: Edit cells Clear outputs Restart/release kernels Execute code
Sensitive access: Notebook contents Executable code
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Browse Jupyter files and kernels; Create/read/edit/reorder notebook cells; Execute code; Launch/manage optional code sandboxes.

What setup and authentication are documented?

Recorded installation/entrypoint step: pip install jupyter-mcp-server. Recorded endpoint: https://mcp.datalayer.run/mcp. Recorded transport: streamable_http, other. Prerequisites: Jupyter/JupyterHub. Client notes: JupyterLab integration and Claude Code plugin are documented. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Local mode keyless; hosted mode requires browser sign-in/approval. A demo or keyless description is not independently verified read-only authority. Check the documented tool permissions rather than inferring authority from that label.

Can it modify data or perform write operations?

Documented write actions include: Edit cells; Clear outputs; Restart/release kernels; Execute code. Recorded permission boundary: Read/mutate notebooks, cells and kernels; execute code.

What data-handling boundary should I consider?

Notebook/code outputs are returned to the client; hosted retention not established. Recorded sensitive-access context: Notebook contents; Executable code.

What limitations and risks should I check before use?

Notebook mutation and arbitrary code execution are high-authority operations. Sandbox tools require an optional extension. Hosted mode requires sign-in and approval. A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.

Is this an official MCP?

Datalayer is listed as First-party MCP in MCP100’s current evidence.