Colab-MCP (unofficial)
PYPI · COLAB-CLI-MCP
Unofficial MCP server for Google Colab: runtimes, code, long jobs, files and notebooks.
Available components
Last scanned (16 hours ago)
Scores higher than 87% of PyPI servers
Category AI and Machine Learning
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 1 of 45 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to amgallego8/Colab-MCP). View diagnostics → Pass
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 20 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability63
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 2456 tokens (~58/item across 42 items; 42 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management67
- Stability observed for 20 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 6 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "colab_exec" implies "exec" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 42 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Checks we ran (16)
- Malware scan
- Known CVEs
- Install scripts
- Dependency health
- Source repository
- Provenance
- License
- Maintenance
- Security disclosure
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this package (2)
- Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
- Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.
- 30 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.
- 26 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.
- 24 Oct 26 +4
- Stability: unverified → 0.27 ▲ functional
- 17 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 16 Oct 26 60
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed pypi/colab-cli-mcp@0.1.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | pypi |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | amgallego8/Colab-MCP |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/amgallego8/Colab-MCP/.github/workflows/publish-to-pypi.yml@refs/tags/v0.1.0 |
| Rekor log index | 3273306881 |
| Predicate type | PyPI publish attestation https://docs.pypi.org/attestations/publish/v1 |
| Subject digest | sha256:938afd3140e782111ad3ea599ec4fed53fb7dea486ef422b1b1b350034020d24 |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | Known build tool | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 45 packages
| Packages resolved | 45 |
|---|---|
| Stale | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
colab_download ~41
Download one file from the VM into the working directory.
| Name | Type | Req | Description |
|---|---|---|---|
| local_path | string | yes | – |
| remote_path | string | yes | – |
| session | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_download_dir ~74
Download a whole VM folder into `local_dir` (inside the working directory) via one zip. Refuses archives whose paths escape the target or exceed COLAB_MCP_MAX_DOWNLOAD_MB (default 1024).
| Name | Type | Req | Description |
|---|---|---|---|
| local_dir | string | yes | – |
| remote_dir | string | yes | – |
| session | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_drive_mount_finish ~64
Step 2 of mounting Google Drive: call it AFTER the user says they clicked Allow. Completes the mount; then verify with colab_drive_status. cancel=true abandons a pending mount.
| Name | Type | Req | Description |
|---|---|---|---|
| cancel | boolean | – | – |
| session | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_drive_mount_start ~124
Step 1 of mounting Google Drive on a session: opens Google's approval page in the user's browser. The link itself is NOT returned (it contains the account e-mail) unless the browser could not be opened or show_link=true. The USER must click Allow; never ask for or handle passwords or codes. WARNING: once mounted, code running on the VM can reach the user's WHOLE Drive; mount only when asked, and stop the session afterwards. Then call colab_drive_mount_finish.
| Name | Type | Req | Description |
|---|---|---|---|
| session | string | yes | – |
| show_link | boolean | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_drive_project_dir ~77
Create (if missing) and return a project folder on the mounted Drive: /content/drive/MyDrive/<projects folder>/<name>. Use it for big datasets, checkpoints and results that must survive the session. Requires Drive to be mounted (see colab_drive_status).
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | – |
| session | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_drive_status ~56
Is Google Drive mounted on this session? Reports yes/no and free space only (never lists your files). If it is not mounted, use colab_drive_mount_start (the user approves in the browser).
| Name | Type | Req | Description |
|---|---|---|---|
| session | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_ensure_session ~64
Make sure a named session exists: reuse it if `colab status` finds it, otherwise create it. Safe to call repeatedly.
| Name | Type | Req | Description |
|---|---|---|---|
| gpu | – | – | – |
| high_mem | boolean | – | – |
| session | string | yes | – |
| tpu | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_exec ~195
Run Python on the runtime; variables persist between calls (same kernel). Give `code` (text) or `file` (local .py/.ipynb inside the working directory), not both. A .ipynb `file` runs the whole notebook and the CLI writes '<name>_output.ipynb' beside it; for cell-by-cell work use the colab_notebook_* tools. `secrets`: NAMES of variables from the user's secrets file (e.g. ["OPENROUTER_API_KEY"]); they become environment variables in the kernel and their values are never returned. `plot_path`: local path (inside the working directory) where a displayed image is saved. `timeout`: seconds (the CLI default is 30).
| Name | Type | Req | Description |
|---|---|---|---|
| code | – | – | – |
| file | – | – | – |
| plot_path | – | – | – |
| secrets | – | – | – |
| session | – | – | – |
| timeout | number | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_install ~57
Install Python packages on the runtime (uses uv, falls back to pip). Names/specifiers only, e.g. 'qiskit', 'pandas>=2.0'.
| Name | Type | Req | Description |
|---|---|---|---|
| packages | array | yes | – |
| session | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_job_cancel ~37
Terminate a running background job (SIGTERM to its process group).
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | – |
| session | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_job_list ~24
List all background jobs started on this VM.
| Name | Type | Req | Description |
|---|---|---|---|
| session | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_job_logs ~49
Last `tail` lines of a background job's combined stdout/stderr, plus its state.
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | – |
| session | – | – | – |
| tail | integer | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_job_start ~87
Start a shell command in the background on the VM (e.g. 'python -u train.py --epochs 50') and return a job id. Use for anything longer than a few minutes; poll with colab_job_status / colab_job_logs. Jobs die if the VM is stopped.
| Name | Type | Req | Description |
|---|---|---|---|
| command | string | yes | – |
| name | – | – | – |
| session | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_job_status ~42
State of a background job: running, finished (with exit code), cancelled, or lost.
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | – |
| session | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_local_cleanup ~44
Delete everything this tool keeps only temporarily on your computer: transfer zips, saved plots and old local trash. Never touches your notebooks, data or anything outside those folders.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_local_footprint ~41
Show how much this tool keeps on your computer (temp files, plots, local trash), free disk and the working-directory budget. Read-only.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_log ~58
Last `lines` entries of a session's history (event_type e.g. execution, file_operation). Without a session, lists sessions that have logs.
| Name | Type | Req | Description |
|---|---|---|---|
| event_type | – | – | – |
| lines | integer | – | – |
| session | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_ls ~32
List files in a VM directory (default /content).
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | – | – |
| session | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_new ~85
Create a runtime. CPU by default; gpu: T4, L4, G4, H100 or A100; tpu: v5e1 or v6e1; high_mem needs Colab Pro. Consumes compute units until stopped.
| Name | Type | Req | Description |
|---|---|---|---|
| gpu | – | – | – |
| high_mem | boolean | – | – |
| session | – | – | – |
| tpu | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_notebook_add_cell ~78
Insert a cell. Default is at the end; or give `position` (index) or `after` (cell id/index). cell_type: code or markdown.
| Name | Type | Req | Description |
|---|---|---|---|
| after | – | – | – |
| cell_type | string | – | – |
| path | string | yes | – |
| position | – | – | – |
| source | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_notebook_clear_outputs ~36
Clear saved outputs of one cell, or of all cells.
| Name | Type | Req | Description |
|---|---|---|---|
| cell | – | – | – |
| path | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_notebook_create ~62
Create a local .ipynb inside the working directory. `cells`: list of {"type": "code"|"markdown", "source": "..."}.
| Name | Type | Req | Description |
|---|---|---|---|
| cells | – | – | – |
| overwrite | boolean | – | – |
| path | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_notebook_delete ~46
Delete a local notebook by moving it to .colab-mcp-trash/ inside the working directory (recoverable, never a hard delete).
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_notebook_delete_cell ~34
Delete one cell by id or index.
| Name | Type | Req | Description |
|---|---|---|---|
| cell | string | yes | – |
| path | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_notebook_edit_cell ~67
Replace a cell's source (and optionally its type). `cell` is an id or an index. Clears that cell's stale outputs.
| Name | Type | Req | Description |
|---|---|---|---|
| cell | string | yes | – |
| cell_type | – | – | – |
| path | string | yes | – |
| source | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_notebook_list ~32
List .ipynb files under a directory of the working directory.
| Name | Type | Req | Description |
|---|---|---|---|
| directory | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_notebook_move_cell ~42
Move a cell to a new index.
| Name | Type | Req | Description |
|---|---|---|---|
| cell | string | yes | – |
| path | string | yes | – |
| to_index | integer | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_notebook_read ~74
Show a notebook's cells (index, id, type, source) and, optionally, their saved outputs. Use `start`/`end` to page through big notebooks.
| Name | Type | Req | Description |
|---|---|---|---|
| end | – | – | – |
| include_outputs | boolean | – | – |
| path | string | yes | – |
| start | integer | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_notebook_run_all ~80
Run every code cell in order (from index `start`), storing outputs in the notebook. Stops at the first failing cell unless stop_on_error=false.
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | yes | – |
| session | – | – | – |
| start | integer | – | – |
| stop_on_error | boolean | – | – |
| timeout_per_cell | number | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_notebook_run_cell ~78
Run ONE code cell on the runtime (state persists between cells) and store its output in the notebook. Reports ok/ERROR status. A displayed plot is saved under .colab-mcp/images/.
| Name | Type | Req | Description |
|---|---|---|---|
| cell | string | yes | – |
| path | string | yes | – |
| session | – | – | – |
| timeout | number | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_notebook_to_script ~68
Convert a notebook to a .py script (markdown becomes comments; lines starting with ! or % are commented out). With `out_path`, writes the file; otherwise returns the text. Handy before colab_run.
| Name | Type | Req | Description |
|---|---|---|---|
| out_path | – | – | – |
| path | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_restart_kernel ~36
Restart the Jupyter kernel of a session: clears all Python variables but keeps the VM and its files.
| Name | Type | Req | Description |
|---|---|---|---|
| session | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_rm ~40
Delete ONE file on the VM (not on the user's computer). Refuses root-like paths.
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | yes | – |
| session | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_run ~83
One-shot job: allocate a fresh VM, run a local script (inside the working directory) with `args`, then release the VM (or keep it with keep=true).
| Name | Type | Req | Description |
|---|---|---|---|
| args | – | – | – |
| gpu | – | – | – |
| high_mem | boolean | – | – |
| keep | boolean | – | – |
| script | string | yes | – |
| timeout | number | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_runtime_info ~34
Report the VM's Python version, CPUs, RAM, free disk and GPU (if any).
| Name | Type | Req | Description |
|---|---|---|---|
| session | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_sessions ~28
List active Colab runtimes (sessions). Also a quick check that Google sign-in works.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_status ~31
Show hardware, machine shape and state of a session (or the only active one).
| Name | Type | Req | Description |
|---|---|---|---|
| session | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_stop ~34
Stop a session and release the VM (stops consuming compute units). Files not downloaded are lost.
| Name | Type | Req | Description |
|---|---|---|---|
| session | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_upload ~88
Upload one local file (inside the working directory) to the VM, e.g. remote_path '/content/data.csv'. Limited by COLAB_MCP_MAX_UPLOAD_MB (default 100): for big data, download it on the VM instead (colab_exec / colab_job_start).
| Name | Type | Req | Description |
|---|---|---|---|
| local_path | string | yes | – |
| remote_path | string | yes | – |
| session | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_upload_dir ~79
Upload a whole local folder (inside the working directory) to the VM as one zip, extracted at `remote_dir`. Skips .git, caches, symlinks and likely secret files (.env, *.key, *.pem...).
| Name | Type | Req | Description |
|---|---|---|---|
| local_dir | string | yes | – |
| remote_dir | string | yes | – |
| session | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_url ~34
Print the browser URL that attaches the Colab UI to this session (does not open a browser).
| Name | Type | Req | Description |
|---|---|---|---|
| session | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
colab_usage ~21
Show the account's compute-unit balance and current burn rate.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
How do I install the Colab-MCP (unofficial) server?
Colab-MCP (unofficial) runs locally as a PyPI package, launched with uvx colab-cli-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · colab-cli-mcp
claude mcp add amgallego8-colab-mcp -- uvx colab-cli-mcp
What is the Colab-MCP (unofficial) server?
Colab-MCP (unofficial) is listed in the public MCP registry as io.github.amgallego8/colab-mcp. Unofficial MCP server for Google Colab: runtimes, code, long jobs, files and notebooks. This page covers its PyPI package (colab-cli-mcp).
Is the Colab-MCP (unofficial) server safe to use?
Colab-MCP (unofficial) scores 84 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Colab-MCP (unofficial) server expose?
Colab-MCP (unofficial) exposes 42 tools: colab_sessions, colab_status, colab_usage, colab_new, colab_ensure_session, and 37 more. Their descriptions and schemas cost roughly 2,456 tokens of context every time the server is loaded.
Is the Colab-MCP (unofficial) server still maintained?
Colab-MCP (unofficial) is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Colab-MCP (unofficial) server under?
Colab-MCP (unofficial) declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.
What did VerifyMCP test on the Colab-MCP (unofficial) server?
VerifyMCP ran 16 checks on Colab-MCP (unofficial), covering Malware scan, Known CVEs, Install scripts, Dependency health and 12 more. Endpoint Security and Transport & Reachability do not apply to a PyPI package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.