B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
AI agent skill · Developer tools, Web & browsing
notebooklm-py
Unofficial Python API and agentic skill for Google Gemini Notebook. Full programmatic access to Gemini Notebook's features—including capabilities the web UI doesn't expose—via Python, CLI, and AI agents like Claude Code, Codex, and OpenClaw.
Bottom line: Signal-based grade (4/7 points): very widely starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
- Popularity score
- 48/100
- Rank
- #158 of 500
- GitHub stars
- 19.8k
What it does
Provides programmatic Python access to Google Gemini Notebook features via an unofficial API, enabling AI agents and CLI tools to interact with Notebook capabilities that aren't exposed in the web UI. Supports automation, integration with Claude Code and other agentic frameworks, and batch operations on Notebook projects.
Who it’s for
Python developers and AI agent builders who need to automate Gemini Notebook workflows or integrate Notebook into larger agent-driven systems. Engineering teams looking to programmatically manage, analyze, or transform Notebook-based research and documentation.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Install via pip:
pip install notebooklm-py
For agentic use with Claude Desktop, configure in claude_desktop_config.json (verify against the repo README (opens external site) for exact MCP server syntax and authentication requirements, as this is an unofficial library).
Risks
- Unofficial API dependency: No guarantee of stability or compatibility as Google may change or revoke the underlying Notebook API; library could break with service updates.
- Credential scope: Requires Google authentication that may grant broad access to your Notebook account; unclear what permissions the library requests or enforces.
- Data exfiltration: Programmatic access to Notebook contents increases surface area for accidental or malicious export of sensitive research, notes, or proprietary information.
- Prompt injection via Notebook content: If agents fetch and process Notebook data as part of agentic workflows, untrusted or adversarially-crafted Notebook content could influence agent behavior.
- Supply-chain risk: Unmaintained or compromised dependency; verify library integrity and audit its code before deploying in production systems.
How to stay secure
Least-privilege permissions
- Use a dedicated Google service account for
notebooklm-pywith minimal scopes; restrict to read-only access unless programmatic writes are essential - Rotate authentication tokens frequently and store credentials in a secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager), never in code or environment files
- Configure notebook-level access controls: grant the service account access only to specific, non-sensitive notebooks rather than blanket account access
- Disable agent's ability to export or share notebooks unless explicitly required; audit and revoke unused API permissions quarterly
Network isolation
- Run agents using
notebooklm-pyin isolated network segments or containers with egress filtering to prevent exfiltration - Proxy all API calls through a monitoring gateway that can rate-limit and inspect requests before they reach Google's servers
- Disable agent internet access except for authenticated connections to Google's API endpoints; whitelist only required domains
- Use VPC service controls or firewall rules to restrict data movement between notebook access points and untrusted environments
Monitoring
- Log all
notebooklm-pyAPI calls (authentication, queries, exports) with timestamps and user context; alert on unusual volume or data retrieval patterns - Monitor for unexpected modifications to notebooks or new access grants; set up change detection on sensitive notebooks
- Audit agent prompts and Notebook content fetched during execution; flag queries that reference sensitive terms or large data exports
- Track library version and dependencies; set up alerts for upstream changes or security advisories affecting
notebooklm-pyor its transitive packages
Red flags to watch for
- Upstream library goes unmaintained, receives negative security audits, or Google officially deprecates the Notebook API endpoint
- Agent behavior diverges from expected workflows after Notebook content changes, suggesting successful prompt injection
- Unauthorized export attempts, bulk downloads, or sharing actions originating from service account credentials
- Credential leaks in logs, CI/CD pipelines, or error messages; simultaneous access from multiple unexpected geographic locations or IPs
Alternatives
- Google Notebooks API (official) – Use Google's official REST API if available for your use case, though it may have more limited scope than this unofficial wrapper.
- Claude with web browsing + manual Notebook access – Have AI agents interact with Notebook via the web UI rather than a programmatic API.
- Vertex AI Notebooks – Google's enterprise notebook offering with full official API support; consider migrating if you need production-grade programmatic access.
- LangChain / LlamaIndex integrations – Use framework-native document loaders and API connectors for Google services rather than a single-purpose library.