← Back to directory
J

Jupyter MCP Server

Community
An MCP server for AI to connect and manage Jupyter Notebooks in real time
Category
Dev Tools #50 of 438
Stars
★ 1.3k Very popular
Transport
stdio (local process) · Streamable HTTP
Runtime
Python · Docker · Hosted (no local runtime)
Credentials
API key / credential required
License
BSD-3-Clause
Last commit
Tools
6
65FMRS · C

Jupyter MCP Server is a mature, well-documented open-source MCP server maintained by Datalayer, focused on letting AI agents operate Jupyter Notebooks in real time. Its strengths are multimodal output, multi-notebook support, execution that adapts from cell output feedback, and the ability to route execution to a dozen-plus cloud sandbox backends. The main caveats are that agents can execute arbitrary code, so tokens and network exposure must be managed carefully, and that code-sandboxes plus the mcp SDK have strict version pairing requirements that should be checked before upgrading.

Strongest · Setup experience 15/20 Weakest · Reliability 10/20

Reliability
10/20
Security and permissions
12/20
Maintenance
13/20
Documentation
15/20
Setup experience
15/20
Why each score
Reliability 10/20
The documented happy path looks plausible: three launch routes (pip/uvx/Docker), a JupyterLab collaboration pre-check, and a `pytest tests/` entry point suggest some verifiable behavior. However this is a static review only, the server manifest is not cached, and the README contains no committed CI workflow, coverage data, or tool schema (it explicitly defers the tool table to a live online snapshot). Tool-vs-behavior parity, init handshake, and error handling therefore cannot be confirmed, and missing evidence is a deduction; capped at the static ceiling of 12, scored 10.
Security and permissions 12/20
Permissions and data flow are documented well: OAuth 2.1 sign-in, agent never sees the password, tokens scoped to notebooks:read/write, code:execute, data:read, personal access tokens as an alternative, and existing Datalayer permissions still constraining reachable notebooks. Risks remain visible but unresolved: example configs start Jupyter bound to 0.0.0.0 with a token, `code:execute` is arbitrary code execution by design, and the README does not state whether dangerous operations (arbitrary execution, terminate_sandbox) require per-action confirmation. Sample tokens are placeholders only, so no red line; scored 12 for visible-but-incomplete scoping/confirmation evidence.
Maintenance 13/20
Strong maintenance signals: explicit BSD-3-Clause license, 1276 stars, not archived, and a well-documented version history (v1.3.2 rename, v1.5.0 sandbox pinning, v2.0.0 MCP SDK 2 migration) with releases, a contributing guide, and a Discord community; 32 open issues is normal for an active project. No CI config, dependency-update policy, or security-response channel (SECURITY.md) is visible, and much governance/compat material lives on an external site rather than reviewable repo files, so this maps to 'active but with governance/versioning gaps' — 13.
Documentation 15/20
Documentation is layered: install (uvx/Docker), auth (token/OAuth), parameters (JUPYTER_URL, DOCUMENT_ID, SANDBOX_VARIANT, etc.), compatibility matrices (code-sandboxes and mcp SDK), a sandbox-engine variable table, test env vars, and best practices, with links to external docs and examples. Deductions: tool/parameter details are outsourced to an online snapshot rather than reviewable in-repo, cost model is not disclosed, troubleshooting is shallow (e.g. `Unknown sandbox variant`), and key limits depend on external pages, which weakens static verifiability — 15.
Setup experience 15/20
Setup is well described across routes: uvx quick start, Docker (with macOS/Windows vs Linux `--network=host` differences), the `jupyter lab` command, and a verification step for collaborative auto-save, plus copy-paste client JSON configs. Deductions: it requires installing several components (jupyterlab, jupyter-collaboration, jupyter-mcp-tools, ipykernel), and the code-sandboxes / mcp SDK version matrices are easy to get wrong (the README itself notes a mismatch only fails at first execution), plus manual token and port setup; capped at the static ceiling of 15 — scored 15.

Static review · not runListed 2026-09-10

Read the FMRS scoring method →

Fit and risk

What it can accessReads local filesWrites / deletes local filesRuns commands or code

Best for

  • Users already running a local JupyterLab or JupyterHub who want to attach an AI agent
  • Data science and machine learning workflows needing multimodal output (images, plots, text)
  • Teams wanting to extend code execution from local to cloud sandboxes such as Datalayer, Kaggle or Google Colab
  • Users who want notebook sessions to keep running after the agent disconnects

Not for

  • Users who do not run any Jupyter Server and do not need Jupyter Notebooks
  • Users whose LLM or client cannot handle multimodal image output and who do not want to disable ALLOW_IMG_OUTPUT
  • Users who need cloud sandbox variants without network access or the required credentials

Required permissions

  • Access to the Jupyter Server URL (JUPYTER_URL / DOCUMENT_URL / CODE_SANDBOX_URL)
  • The Jupyter access token (JUPYTER_TOKEN, or DOCUMENT_TOKEN and CODE_SANDBOX_TOKEN separately)
  • Permission to read and write notebook documents and execute code
  • Vendor credentials when using cloud sandboxes (e.g. DAYTONA_API_KEY, E2B_API_KEY, CWSANDBOX_API_KEY, CLOUDFLARE_SANDBOX_API_URL / CLOUDFLARE_SANDBOX_API_KEY, Kaggle credentials, Modal credentials)
  • Optional OAuth 2.1 scopes with Datalayer hosting: notebooks:read, notebooks:write, code:execute, data:read

Risks and side effects

  • The AI agent can execute arbitrary code in notebooks, which may lead to data leakage, data corruption or resource abuse
  • A leaked token grants the same Jupyter access as the token itself
  • Starting JupyterLab with --ip 0.0.0.0 by default widens the network exposure surface
  • Cloud sandboxes incur vendor-side costs and may run beyond local resource limits
  • A version mismatch between jupyter-mcp-server and code-sandboxes fails on first execution with Unknown sandbox variant: jupyter

Setup

Before you start

Runtime:Python · Docker · Hosted (no local runtime)

JUPYTER_URL required URL of your Jupyter service (e.g. http://localhost:8888), pointing at your running JupyterLab/Jupyter Server.
JUPYTER_TOKEN requiredsecret Jupyter auth token, set via --IdentityProvider.token when starting the server.
DOCUMENT_TOKEN optionalsecret Separate auth token for the document service.
CODE_SANDBOX_TOKEN optionalsecret Auth token for the code sandbox service.
DAYTONA_API_KEY optionalsecret API key required for the Daytona sandbox engine, obtained from Daytona.
E2B_API_KEY optionalsecret API key required for the E2B sandbox engine, obtained from E2B.
CWSANDBOX_API_KEY optionalsecret API key required for the CoreWeave sandbox engine.
CLOUDFLARE_SANDBOX_API_KEY optionalsecret API key required for the Cloudflare sandbox engine.
Other optional settings (7)
ALLOW_IMG_OUTPUT optional Set to true to allow image outputs; set false if your LLM lacks multimodal support.
DOCUMENT_URL optional Separate URL for the notebook document service (used when storage and execution are split).
DOCUMENT_ID optional Path to the default notebook, relative to the JupyterLab start directory; omit to select interactively.
CODE_SANDBOX_URL optional URL of the code sandbox service (e.g. JupyterHub).
SANDBOX_VARIANT optional Selects the sandbox engine, e.g. jupyter-server, datalayer, e2b, kaggle.
SANDBOX_ENVIRONMENT optional Optional cloud environment name override (e.g. ai-agents-env) for Datalayer-style engines.
CLOUDFLARE_SANDBOX_API_URL optional URL of the Cloudflare sandbox API.
  1. Set up the environment: pip install jupyterlab jupyter-collaboration jupyter-mcp-tools ipykernel.
  2. Start JupyterLab, e.g. jupyter lab --port 8888 --IdentityProvider.token MY_TOKEN --ip 0.0.0.0.
  3. Verify collaboration works: open a notebook in JupyterLab, edit any cell, and confirm the tab indicator changes from “×” to “●” automatically.
  4. Configure your MCP client. For a quick start use uvx (uv 0.6.14 or higher): set command to uvx, args to ["jupyter-mcp-server@latest"], and provide the environment variables JUPYTER_URL, JUPYTER_TOKEN and ALLOW_IMG_OUTPUT.
  5. For production, use the Docker image datalayer/jupyter-mcp-server:latest; use host.docker.internal on macOS/Windows and --network=host on Linux.
  6. For sandbox lifecycle tools or non-jupyter-server sandbox variants, install the extension: pip install jupyter_mcp_sandboxes.
claude_desktop_config.json
{
  "mcpServers": {
    "jupyter": {
      "command": "uvx",
      "args": ["jupyter-mcp-server@latest"],
      "env": {
        "JUPYTER_URL": "http://localhost:8888",
        "JUPYTER_TOKEN": "MY_TOKEN",
        "ALLOW_IMG_OUTPUT": "true"
      }
    }
  }
}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "jupyter": {
      "command": "uvx",
      "args": [
        "jupyter-mcp-server@latest"
      ],
      "env": {
        "JUPYTER_URL": "http://localhost:8888",
        "JUPYTER_TOKEN": "MY_TOKEN",
        "ALLOW_IMG_OUTPUT": "true"
      }
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add jupyter -e JUPYTER_URL=http://localhost:8888 -e JUPYTER_TOKEN=MY_TOKEN -e ALLOW_IMG_OUTPUT=true -- uvx jupyter-mcp-server@latest

Run it in a terminal; replace any <…> placeholders with your own values first.

Check that it works

After connecting your MCP client, the tool list should include launch_sandbox, list_sandboxes, use_sandbox and terminate_sandbox; calling list_sandboxes confirms the connection works.

Troubleshooting

  1. Make sure the port in JUPYTER_URL matches the port used in the jupyter lab command
  2. Check that JUPYTER_TOKEN is correct, or set DOCUMENT_TOKEN and CODE_SANDBOX_TOKEN separately
  3. Confirm jupyter-collaboration is installed and that the unsaved indicator changes to “●” automatically
  4. If your LLM does not support multimodal input, set ALLOW_IMG_OUTPUT to false
  5. With Docker, use host.docker.internal on macOS/Windows and --network=host on Linux
  6. Run pytest tests/ to verify the server; use TEST_MCP_SERVER and TEST_JUPYTER_SERVER to toggle test modes
  7. Match versions per the table: jupyter-mcp-server >= 1.5.0 with code-sandboxes >= 1.1.1, and jupyter-mcp-server < 1.5.0 with code-sandboxes <= 1.0.9
  8. jupyter-mcp-server >= 2.0.0 requires mcp >= 2 while older versions require mcp < 2; an environment with another package still pinning mcp<2 must stay on jupyter-mcp-server<2

Things to try

Once connected, you can ask your AI assistant things like:

  • List the available code sandboxes
  • Launch a sandbox and run a snippet of Python code in it
  • Run all cells in the current notebook
  • Show me the content of the currently selected cell

Tools 6

launch_sandbox writes
Launch a code sandbox (requires the optional jupyter_mcp_sandboxes extension).
list_sandboxes read-only
List the available code sandboxes (requires the optional jupyter_mcp_sandboxes extension).
use_sandbox writes
Select and switch to a given code sandbox (requires the optional jupyter_mcp_sandboxes extension).
terminate_sandbox destructive
Terminate a given code sandbox (requires the optional jupyter_mcp_sandboxes extension).
notebook_run-all-cells writes
Run all cells in the notebook (JupyterLab integration tool exposed by default via jupyter-mcp-tools).
notebook_get-selected-cell read-only
Get the currently selected cell (JupyterLab integration tool exposed by default via jupyter-mcp-tools).

Use cases

Let an AI assistant read and modify a running Jupyter Notebook in real time
Have an AI run a data science workflow step by step (data cleaning, feature engineering, training, evaluation)
Switch between multiple notebooks and manage their kernels
Produce and inspect visual outputs including images and plots
Scale code execution to cloud GPU environments through sandbox variants

Supported clients

Claude Desktop
Cursor
Windsurf
VS Code
Cline
Claude Code

Listed from the project's documentation, not tested by this site.

Overview

Jupyter MCP Server is an MCP server developed by Datalayer (BSD 3-Clause licensed) that lets AI clients connect to and manage Jupyter Notebooks in real time. It offers live view of notebook changes, smart execution that adjusts from cell output feedback, full notebook context awareness, multimodal output support (images, plots, text), and multi-notebook switching. It works with any MCP client (Claude Desktop, Cursor, Windsurf, and more) and with any Jupyter deployment such as a local JupyterLab or JupyterHub. Through the optional jupyter_mcp_sandboxes extension, code execution can be routed to sandbox engines including Datalayer, Kaggle, Google Colab, Modal, Daytona, E2B, CoreWeave and Cloudflare. The project also ships JupyterLab integration (enabled by default), a jupyter-cite prompt, OAuth 2.1 sign-in, and OpenTelemetry-based observability.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 63.3k · Tools 2 Compare with this →

Source revision ef47e8b9c9bf Data synced 2026-10-19 Read the FMRS scoring method