/ 100

13 days ago

glama

Penny NotebookLM Research

MCP server that automates YouTube research by finding viral videos, analyzing transcripts via Google NotebookLM, and generating content ideas and scripts.

→ pennydinh/penny-notebooklm-research · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

3 flows detected: APIFY_TOKEN. We can’t prove the destination matches the brand the credential belongs to.

⚠️

Known vulnerabilities in dependencies: 2 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

🔐

You'll be asked for 3 credentials: APIFY_TOKEN, BRAVE_API_KEY, LOGIN_PASSWORD

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// known CVEs in dependencies2 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.0.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.0.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

lowzod@3.22.0GHSA-m95q-7qp3-xv42

Zod denial of service vulnerability

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configANSWER_TIMEOUT_MS

🔐 secretAPIFY_TOKEN— [](https://www.apify.com?fpr=get-api) — tùy chọn, scrape view count chính xác ($5 free credit/tháng)

configAUTO_LOGIN_ENABLED

configAUTO_LOGIN_TIMEOUT_MS

🔐 secretBRAVE_API_KEY— [](https://brave.com/search/api/) — miễn phí, 2000 queries/tháng

configBROWSER_CHANNEL

configBROWSER_TIMEOUT

configHEADLESS

configLOGIN_EMAIL

🔐 secretLOGIN_PASSWORD

configMAX_DELAY_MS

configMAX_SESSIONS

configMIN_DELAY_MS

configNOTEBOOKLM_ACCOUNT

configNOTEBOOKLM_AI_MARKER

configNOTEBOOKLM_AI_MARKER_PREFIX

configNOTEBOOKLM_BROWSER_CHANNEL

configNOTEBOOKLM_DISABLED_TOOLS

configNOTEBOOKLM_FOLLOW_UP_REMINDER

configNOTEBOOKLM_HOST

configNOTEBOOKLM_PORT

configNOTEBOOKLM_PROFILE

configNOTEBOOKLM_TRANSPORT

configNOTEBOOK_CLEANUP_ON_SHUTDOWN

configNOTEBOOK_CLEANUP_ON_STARTUP

configNOTEBOOK_CLONE_PROFILE

configNOTEBOOK_CONTENT_TYPES

configNOTEBOOK_DESCRIPTION

configNOTEBOOK_INSTANCE_MAX_COUNT

configNOTEBOOK_INSTANCE_TTL_HOURS

configNOTEBOOK_PROFILE_STRATEGY

configNOTEBOOK_TOPICS

configNOTEBOOK_URL

configNOTEBOOK_USE_CASES

configSESSION_TIMEOUT

configSTEALTH_ENABLED

configSTEALTH_HUMAN_TYPING

configSTEALTH_MOUSE_MOVEMENTS

configSTEALTH_RANDOM_DELAYS

configTYPING_WPM_MAX

configTYPING_WPM_MIN

configWEB_PORT

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/pennydinh-penny-notebooklm-research-c4ov9p)](https://m8ven.ai/mcp/pennydinh-penny-notebooklm-research-c4ov9p)

commit: cb85fcbf5413a49a1c35289aed3b54ca4704bca0

code hash: 7cf8dc87a064462d817653d88cd80c5fb1adf3da888c782712e6801db73ef21b

verified: 6/30/2026, 9:49:16 AM

view raw JSON →