Build my server

Directory / Developer Tools

Jupyter MCP Server (Datalayer)

Datalayer's open-source MCP server for Jupyter, run locally with uvx or Docker, to read and edit notebooks and run cells or any code on a Jupyter kernel.

Verdict: Jupyter MCP Server (Datalayer) is graded C (usable with care) in TrustedMCP's assessment from public signals, last updated 8 Nov 2026. It is at full marks on 1 of 4 checks (upkeep) and loses points on login, known bugs and connection, most of all on connection. It can run model-controlled code or uses a plaintext remote connection, so run it isolated with no credentials.

Grade C Login: login required, broad accessUpkeep: actively maintainedKnown bugs: past CVEs fixed slowlyConnection: unsafe connection by default

1 of 4 checks at full marks · How we check

Source Docs
VendorDatalayer
CategoryDeveloper Tools
Connects overstdio, http

Our grade: 4 checks

Login Login required, broad access
Upkeep Active · 2026-11
Known bugs past CVEs fixed slowly
Connection stdio, http

Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.

Community rating

3.2 16 reviews
44% would trust it in production
  • 5 1
  • 4 6
  • 3 4
  • 2 5
  • 1 0

Trust in production

  • Trust it - 44%
  • With caveats - 31%
  • Wouldn't - 25%

63% would recommend this server

How reviewers scored it

  • Setup & docs 3.1
  • Auth experience 3.5
  • Reliability 3.0
  • Maintainer responsiveness 3.8

Why it got a C

Datalayer's MCP server for Jupyter (BSD-3-Clause, Python, PyPI jupyter-mcp-server 2.2.5, about 1.3K GitHub stars, 15 committers in the last 60 days). It connects to a JupyterLab or JupyterHub you already run, or to a cloud sandbox such as Colab or Daytona, and lets the AI open, read and edit notebooks, move and clear cells, and run cells or any code on the kernel. Datalayer also hosts it at mcp.datalayer.run with a browser sign-in and per-agent scopes; this listing scores the self-run package. Three advisories in 2026 hit its HTTP mode: the management routes had no login and could be reached by DNS rebinding, and the first fix trusted the Host header, so a forged header got past it until 2.1.3 (2026-09-01). Stay on 2.1.3 or later, keep MCP_TOKEN set, and start JupyterLab on 127.0.0.1, not the 0.0.0.0 the README example shows. Biggest deduction: running model-written code on your kernel is the point of the server and cannot be switched off, so give it a kernel and files you would let the AI run anything on.

How to connect

// claude_desktop_config.json (README, uvx quick start)
{ "mcpServers": { "jupyter": { "command": "uvx",
  "args": ["jupyter-mcp-server@latest"],
  "env": { "JUPYTER_URL": "http://localhost:8888",
           "JUPYTER_TOKEN": "MY_TOKEN",
           "ALLOW_IMG_OUTPUT": "true" } } } }

Is Jupyter MCP Server (Datalayer) safe?

Is Jupyter MCP Server (Datalayer) safe to use?

Jupyter MCP Server (Datalayer) grades C (usable with care). Login is required, but access is coarse: one sign-in or key covers more than your agent needs, so grant the narrowest account you can. Past advisories were fixed slowly, so stay on the latest release. It can run model-controlled code or uses a plaintext remote connection, so run it isolated with no credentials.

Does Jupyter MCP Server (Datalayer) have known vulnerabilities?

Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.

Does Jupyter MCP Server (Datalayer) support authentication?

Yes. It requires a login, so access can be tied to a person or a scoped key.

Alternatives in Developer Tools

Compare all Developer Tools MCP servers

Embed this badge

Maintain this server? Add the grade to your README.

TrustedMCP grade C

Markdown

[![TrustedMCP grade C](https://trustedmcp.io/badge/jupyter-mcp-server.svg)](https://trustedmcp.io/servers/jupyter-mcp-server)

HTML

<a href="https://trustedmcp.io/servers/jupyter-mcp-server"><img src="https://trustedmcp.io/badge/jupyter-mcp-server.svg" alt="TrustedMCP grade C" height="80"></a>

Community reviews

Raj Malhotra Developer, healthtech
Would not trust in production

Fine for a demo, not for prod

It works in a demo, but things got shaky under real use. Token setup is the fiddliest part, after that it is smooth. I will check back in a few releases.

Used for Code review summaries for pull requests

  • Setup & docs 3/5
  • Auth experience 3/5
  • Reliability 2/5
  • Maintainer responsiveness 3/5
Arjun Patel Full-stack developer
Trusts in production Recommends

Quietly reliable

Been running this for about a month now. It drives a real browser, so I give it a separate profile with no saved logins. Sign-in flow was painless and I never had to paste a key into a config file. It is in our production agent and I sleep fine.

Used for Pairing with Claude Code on a monorepo

  • Setup & docs 4/5
  • Auth experience 5/5
  • Reliability 3/5
  • Maintainer responsiveness 3/5
Chloe Martin CTO, early-stage startup
Trusts with caveats Recommends

Works, just lock it down

Good for experimenting, still deciding about production. Auth is handled properly, and revoking access later was one click. I would use it in prod, but only with a human approving writes.

Used for Keeping project tickets in sync with code changes

  • Setup & docs 4/5
  • Auth experience 3/5
  • Reliability 2/5
  • Maintainer responsiveness 4/5
Nina Hoffmann Eng lead, fintech
Trusts in production Recommends

Good defaults, good docs

Of the Jupyter (Datalayer) integrations I tried, this one is the most predictable. Scoped the token to just what the agent needs and it respected that. Would recommend without hesitation.

Used for Internal developer assistant

  • Setup & docs 4/5
  • Auth experience 4/5
  • Reliability 4/5
  • Maintainer responsiveness 4/5
Olivia Brown AI engineer
Trusts with caveats Recommends

Fine once configured properly

Works well enough for what I need. The scope options are worth reading carefully, the defaults are broader than I wanted. Worth it, just do not skip the hardening steps.

Used for Onboarding new devs with an agent that answers repo questions

  • Setup & docs 3/5
  • Auth experience 2/5
  • Reliability 2/5
  • Maintainer responsiveness 3/5
Jakub Nowak Senior developer
Trusts with caveats

Does the job, docs could be better

It does the job, but it took some tweaking. Narrowing the scopes took ten minutes and made me much happier running it. I like that access goes through a proper sign-in instead of a long-lived secret on disk. Recommended, with sensible guardrails.

Used for Letting a coding agent open and triage issues

  • Setup & docs 2/5
  • Auth experience 4/5
  • Reliability 3/5
  • Maintainer responsiveness 5/5
Ivan Horvat Security engineer
Trusts in production Recommends

Recommended it to two teams already

Started with it as an experiment, now it is a fixture. Scoped the token to just what the agent needs and it respected that. Running it in Docker keeps it away from the rest of my machine. Happy to run it in production.

Used for Scripting routine maintenance tasks

  • Setup & docs 3/5
  • Auth experience 4/5
  • Reliability 4/5
  • Maintainer responsiveness 5/5
Omar Haddad Software engineer, agency
Would not trust in production

Went back to calling the API directly

Setup was rough and the result was flaky. Auth is handled properly, and revoking access later was one click. The scope options are worth reading carefully, the defaults are broader than I wanted. For anything real I would look elsewhere.

Used for Looking up Jupyter (Datalayer) data without leaving the editor

  • Setup & docs 3/5
  • Auth experience 2/5
  • Reliability 2/5
  • Maintainer responsiveness 3/5
Elif Yilmaz Indie hacker
Would not trust in production

Would not run this unattended

Ran into problems pretty quickly. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. Sign-in flow was painless and I never had to paste a key into a config file. Keeping it to local experiments for now.

Used for Generating boilerplate from existing patterns

  • Setup & docs 1/5
  • Auth experience 3/5
  • Reliability 1/5
  • Maintainer responsiveness 3/5
Eva Novak Staff engineer
Trusts with caveats Recommends

Decent, not set-and-forget

Some tools are great, a couple feel half finished. I like that access goes through a proper sign-in instead of a long-lived secret on disk.

Used for Looking up Jupyter (Datalayer) data without leaving the editor

  • Setup & docs 2/5
  • Auth experience 3/5
  • Reliability 4/5
  • Maintainer responsiveness 4/5
Aditi Rao Senior developer
Trusts in production Recommends

Easy win for our agent setup

Simple to set up in Cursor, simple to reason about. Auth is handled properly, and revoking access later was one click. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent.

Used for Onboarding new devs with an agent that answers repo questions

  • Setup & docs 5/5
  • Auth experience 4/5
  • Reliability 5/5
  • Maintainer responsiveness 5/5
Maya Johnson Solo founder
Trusts in production Recommends

Clean integration, sensible permissions

I use this almost daily. I like that access goes through a proper sign-in instead of a long-lived secret on disk. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. Good choice if you need Jupyter (Datalayer) in your agent.

Used for Code review summaries for pull requests

  • Setup & docs 4/5
  • Auth experience 4/5
  • Reliability 4/5
  • Maintainer responsiveness 4/5
Sam Rivera Platform engineer
Trusts with caveats

Not ready for anything that matters

Gave it a fair shot over two weeks. Sign-in flow was painless and I never had to paste a key into a config file. Fine in production if you sandbox it.

Used for CI failure investigation

  • Setup & docs 2/5
  • Auth experience 4/5
  • Reliability 1/5
  • Maintainer responsiveness 3/5
Karan Mehta Backend engineer
Trusts in production Recommends

Exactly what I needed from Jupyter (Datalayer)

Replaced a homegrown script with Jupyter MCP Server (Datalayer) and have not looked back. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. Scoped the token to just what the agent needs and it respected that. Easy recommendation.

Used for Internal developer assistant

  • Setup & docs 5/5
  • Auth experience 4/5
  • Reliability 5/5
  • Maintainer responsiveness 4/5
Andre Dubois ML engineer
Would not trust in production

Struggled to get it stable

I wanted to like this one. It drives a real browser, so I give it a separate profile with no saved logins. Not something I would put in production yet.

Used for Debugging sessions in Cursor

  • Setup & docs 1/5
  • Auth experience 3/5
  • Reliability 2/5
  • Maintainer responsiveness 3/5
Ethan Walker Freelance developer
Trusts in production Recommends

Better than the DIY script it replaced

Installed it on a Friday, it was part of my workflow by Monday. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. Easy recommendation.

Used for Automating release notes

  • Setup & docs 3/5
  • Auth experience 4/5
  • Reliability 4/5
  • Maintainer responsiveness 4/5

Write a review

Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.

How was it overall?

Would you trust it in production?
Would you recommend it to another team?

Score the details

Setup & docs
Auth experience
Reliability
Maintainer responsiveness

Tell other teams how it went

About you