sumulige-notebooklm-mcp

The server handles Google authentication locally by opening a browser for manual login and persisting session state in a local Chrome profile. Credentials are not exposed or sent over the network by the server itself, adhering to a client-side authentication model. It utilizes `Patchright` (a Playwright fork) for browser automation, which runs locally. The `cleanup_data` tool provides robust options for removing sensitive data. No direct use of `eval` or blatant obfuscation was found. The main risk involves the inherent nature of browser automation: if a malicious NotebookLM URL were used or if the underlying Google service itself were compromised, the local browser could potentially be exploited. However, the server itself minimizes risks by keeping authentication local and clearly documenting cleanup procedures. The use of 'stealth mode' for human-like interaction is to avoid bot detection, not for malicious purposes.