Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Colab-MCP (unofficial)

PYPI · COLAB-CLI-MCP

Unofficial MCP server for Google Colab: runtimes, code, long jobs, files and notebooks.

Available components

+3 this week 84 Trust /100

Last scanned (16 hours ago)

Scores higher than 87% of PyPI servers

Category AI and Machine Learning

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
  • 1 of 45 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to amgallego8/Colab-MCP). View diagnostics → Pass
  • Clear OSI-approved license (Apache-2.0).Pass
  • Actively maintained (last published 20 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability63
  • AI-judged instruction clarity (good).Pass
  • Tool/resource definitions use about 2456 tokens (~58/item across 42 items; 42 tools + 0 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management67
  • Stability observed for 20 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 0% of tool parameters carry a description.Fail
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 6 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "colab_exec" implies "exec" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 42 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
What we tested

Checks we ran (16)

  • Malware scan
  • Known CVEs
  • Install scripts
  • Dependency health
  • Source repository
  • Provenance
  • License
  • Maintenance
  • Security disclosure
  • Schema quality
  • Stability
  • Tool coverage
  • Injection markers
  • Destructive annotations
  • Judged manipulation
  • MCP protocol

Does not apply to this package (2)

  • Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
  • Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.

The score does not measure everything. What the score does not measure →

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.

  • 2 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

  • 30 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

  • 28 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

  • 26 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

  • 24 Oct 26 +4
    • Stability: unverified → 0.27 ▲ functional
  • 17 Oct 26 +15
    • Malware scan: unverified → pass ▲ security
  • 16 Oct 26 60

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed pypi/colab-cli-mcp@0.1.0

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem pypi
Reason Verified
Discovered via Registry attestation endpoint
Source repo amgallego8/Colab-MCP
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/amgallego8/Colab-MCP/.github/workflows/publish-to-pypi.yml@refs/tags/v0.1.0
Rekor log index 3273306881
Predicate type PyPI publish attestation https://docs.pypi.org/attestations/publish/v1
Subject digest sha256:938afd3140e782111ad3ea599ec4fed53fb7dea486ef422b1b1b350034020d24

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend Known build tool hatchling.build

Background: Why install scripts are a supply-chain risk →

Dependencies 45 packages
Packages resolved 45
Stale 1
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 42 exposed · ~2,456 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
colab_download ~41

Download one file from the VM into the working directory.

NameTypeReqDescription
local_pathstringyes–
remote_pathstringyes–
session–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_download_dir ~74

Download a whole VM folder into `local_dir` (inside the working directory) via one zip. Refuses archives whose paths escape the target or exceed COLAB_MCP_MAX_DOWNLOAD_MB (default 1024).

NameTypeReqDescription
local_dirstringyes–
remote_dirstringyes–
session–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_drive_mount_finish ~64

Step 2 of mounting Google Drive: call it AFTER the user says they clicked Allow. Completes the mount; then verify with colab_drive_status. cancel=true abandons a pending mount.

NameTypeReqDescription
cancelboolean––
sessionstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_drive_mount_start ~124

Step 1 of mounting Google Drive on a session: opens Google's approval page in the user's browser. The link itself is NOT returned (it contains the account e-mail) unless the browser could not be opened or show_link=true. The USER must click Allow; never ask for or handle passwords or codes. WARNING: once mounted, code running on the VM can reach the user's WHOLE Drive; mount only when asked, and stop the session afterwards. Then call colab_drive_mount_finish.

NameTypeReqDescription
sessionstringyes–
show_linkboolean––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_drive_project_dir ~77

Create (if missing) and return a project folder on the mounted Drive: /content/drive/MyDrive/<projects folder>/<name>. Use it for big datasets, checkpoints and results that must survive the session. Requires Drive to be mounted (see colab_drive_status).

NameTypeReqDescription
namestringyes–
session–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_drive_status ~56

Is Google Drive mounted on this session? Reports yes/no and free space only (never lists your files). If it is not mounted, use colab_drive_mount_start (the user approves in the browser).

NameTypeReqDescription
session–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_ensure_session ~64

Make sure a named session exists: reuse it if `colab status` finds it, otherwise create it. Safe to call repeatedly.

NameTypeReqDescription
gpu–––
high_memboolean––
sessionstringyes–
tpu–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_exec ~195

Run Python on the runtime; variables persist between calls (same kernel). Give `code` (text) or `file` (local .py/.ipynb inside the working directory), not both. A .ipynb `file` runs the whole notebook and the CLI writes '<name>_output.ipynb' beside it; for cell-by-cell work use the colab_notebook_* tools. `secrets`: NAMES of variables from the user's secrets file (e.g. ["OPENROUTER_API_KEY"]); they become environment variables in the kernel and their values are never returned. `plot_path`: local path (inside the working directory) where a displayed image is saved. `timeout`: seconds (the CLI default is 30).

NameTypeReqDescription
code–––
file–––
plot_path–––
secrets–––
session–––
timeoutnumber––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_install ~57

Install Python packages on the runtime (uses uv, falls back to pip). Names/specifiers only, e.g. 'qiskit', 'pandas>=2.0'.

NameTypeReqDescription
packagesarrayyes–
session–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_job_cancel ~37

Terminate a running background job (SIGTERM to its process group).

NameTypeReqDescription
job_idstringyes–
session–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_job_list ~24

List all background jobs started on this VM.

NameTypeReqDescription
session–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_job_logs ~49

Last `tail` lines of a background job's combined stdout/stderr, plus its state.

NameTypeReqDescription
job_idstringyes–
session–––
tailinteger––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_job_start ~87

Start a shell command in the background on the VM (e.g. 'python -u train.py --epochs 50') and return a job id. Use for anything longer than a few minutes; poll with colab_job_status / colab_job_logs. Jobs die if the VM is stopped.

NameTypeReqDescription
commandstringyes–
name–––
session–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_job_status ~42

State of a background job: running, finished (with exit code), cancelled, or lost.

NameTypeReqDescription
job_idstringyes–
session–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_local_cleanup ~44

Delete everything this tool keeps only temporarily on your computer: transfer zips, saved plots and old local trash. Never touches your notebooks, data or anything outside those folders.

Input schema present but exposes no named parameters.

NameTypeReqDescription
resultstringyes–

No examples provided.

colab_local_footprint ~41

Show how much this tool keeps on your computer (temp files, plots, local trash), free disk and the working-directory budget. Read-only.

Input schema present but exposes no named parameters.

NameTypeReqDescription
resultstringyes–

No examples provided.

colab_log ~58

Last `lines` entries of a session's history (event_type e.g. execution, file_operation). Without a session, lists sessions that have logs.

NameTypeReqDescription
event_type–––
linesinteger––
session–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_ls ~32

List files in a VM directory (default /content).

NameTypeReqDescription
pathstring––
session–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_new ~85

Create a runtime. CPU by default; gpu: T4, L4, G4, H100 or A100; tpu: v5e1 or v6e1; high_mem needs Colab Pro. Consumes compute units until stopped.

NameTypeReqDescription
gpu–––
high_memboolean––
session–––
tpu–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_notebook_add_cell ~78

Insert a cell. Default is at the end; or give `position` (index) or `after` (cell id/index). cell_type: code or markdown.

NameTypeReqDescription
after–––
cell_typestring––
pathstringyes–
position–––
sourcestringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_notebook_clear_outputs ~36

Clear saved outputs of one cell, or of all cells.

NameTypeReqDescription
cell–––
pathstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_notebook_create ~62

Create a local .ipynb inside the working directory. `cells`: list of {"type": "code"|"markdown", "source": "..."}.

NameTypeReqDescription
cells–––
overwriteboolean––
pathstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_notebook_delete ~46

Delete a local notebook by moving it to .colab-mcp-trash/ inside the working directory (recoverable, never a hard delete).

NameTypeReqDescription
pathstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_notebook_delete_cell ~34

Delete one cell by id or index.

NameTypeReqDescription
cellstringyes–
pathstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_notebook_edit_cell ~67

Replace a cell's source (and optionally its type). `cell` is an id or an index. Clears that cell's stale outputs.

NameTypeReqDescription
cellstringyes–
cell_type–––
pathstringyes–
sourcestringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_notebook_list ~32

List .ipynb files under a directory of the working directory.

NameTypeReqDescription
directorystring––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_notebook_move_cell ~42

Move a cell to a new index.

NameTypeReqDescription
cellstringyes–
pathstringyes–
to_indexintegeryes–
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_notebook_read ~74

Show a notebook's cells (index, id, type, source) and, optionally, their saved outputs. Use `start`/`end` to page through big notebooks.

NameTypeReqDescription
end–––
include_outputsboolean––
pathstringyes–
startinteger––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_notebook_run_all ~80

Run every code cell in order (from index `start`), storing outputs in the notebook. Stops at the first failing cell unless stop_on_error=false.

NameTypeReqDescription
pathstringyes–
session–––
startinteger––
stop_on_errorboolean––
timeout_per_cellnumber––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_notebook_run_cell ~78

Run ONE code cell on the runtime (state persists between cells) and store its output in the notebook. Reports ok/ERROR status. A displayed plot is saved under .colab-mcp/images/.

NameTypeReqDescription
cellstringyes–
pathstringyes–
session–––
timeoutnumber––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_notebook_to_script ~68

Convert a notebook to a .py script (markdown becomes comments; lines starting with ! or % are commented out). With `out_path`, writes the file; otherwise returns the text. Handy before colab_run.

NameTypeReqDescription
out_path–––
pathstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_restart_kernel ~36

Restart the Jupyter kernel of a session: clears all Python variables but keeps the VM and its files.

NameTypeReqDescription
session–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_rm ~40

Delete ONE file on the VM (not on the user's computer). Refuses root-like paths.

NameTypeReqDescription
pathstringyes–
session–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_run ~83

One-shot job: allocate a fresh VM, run a local script (inside the working directory) with `args`, then release the VM (or keep it with keep=true).

NameTypeReqDescription
args–––
gpu–––
high_memboolean––
keepboolean––
scriptstringyes–
timeoutnumber––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_runtime_info ~34

Report the VM's Python version, CPUs, RAM, free disk and GPU (if any).

NameTypeReqDescription
session–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_sessions ~28

List active Colab runtimes (sessions). Also a quick check that Google sign-in works.

Input schema present but exposes no named parameters.

NameTypeReqDescription
resultstringyes–

No examples provided.

colab_status ~31

Show hardware, machine shape and state of a session (or the only active one).

NameTypeReqDescription
session–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_stop ~34

Stop a session and release the VM (stops consuming compute units). Files not downloaded are lost.

NameTypeReqDescription
session–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_upload ~88

Upload one local file (inside the working directory) to the VM, e.g. remote_path '/content/data.csv'. Limited by COLAB_MCP_MAX_UPLOAD_MB (default 100): for big data, download it on the VM instead (colab_exec / colab_job_start).

NameTypeReqDescription
local_pathstringyes–
remote_pathstringyes–
session–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_upload_dir ~79

Upload a whole local folder (inside the working directory) to the VM as one zip, extracted at `remote_dir`. Skips .git, caches, symlinks and likely secret files (.env, *.key, *.pem...).

NameTypeReqDescription
local_dirstringyes–
remote_dirstringyes–
session–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_url ~34

Print the browser URL that attaches the Colab UI to this session (does not open a browser).

NameTypeReqDescription
session–––
NameTypeReqDescription
resultstringyes–

No examples provided.

colab_usage ~21

Show the account's compute-unit balance and current burn rate.

Input schema present but exposes no named parameters.

NameTypeReqDescription
resultstringyes–

No examples provided.

Install

How do I install the Colab-MCP (unofficial) server?

Colab-MCP (unofficial) runs locally as a PyPI package, launched with uvx colab-cli-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · colab-cli-mcp

# add to Claude Code
claude mcp add amgallego8-colab-mcp -- uvx colab-cli-mcp
Common questions

What is the Colab-MCP (unofficial) server?

Colab-MCP (unofficial) is listed in the public MCP registry as io.github.amgallego8/colab-mcp. Unofficial MCP server for Google Colab: runtimes, code, long jobs, files and notebooks. This page covers its PyPI package (colab-cli-mcp).

Is the Colab-MCP (unofficial) server safe to use?

Colab-MCP (unofficial) scores 84 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Colab-MCP (unofficial) server expose?

Colab-MCP (unofficial) exposes 42 tools: colab_sessions, colab_status, colab_usage, colab_new, colab_ensure_session, and 37 more. Their descriptions and schemas cost roughly 2,456 tokens of context every time the server is loaded.

Is the Colab-MCP (unofficial) server still maintained?

Colab-MCP (unofficial) is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Colab-MCP (unofficial) server under?

Colab-MCP (unofficial) declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

What did VerifyMCP test on the Colab-MCP (unofficial) server?

VerifyMCP ran 16 checks on Colab-MCP (unofficial), covering Malware scan, Known CVEs, Install scripts, Dependency health and 12 more. Endpoint Security and Transport & Reachability do not apply to a PyPI package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.