ipython-kernel-mcp
Provides integration with Jupyter/IPython kernels, allowing MCP clients to connect to a running kernel and execute Python code persistently with shared state, check kernel status, and interrupt running executions.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ipython-kernel-mcpRun this Python code and keep the variable for later: total = sum(range(100))"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ipython-kernel-mcp
An MCP (Model Context Protocol) server that connects to an existing IPython kernel, providing persistent code execution with shared state across calls.
Based on ipython-mcp by
gabiteodoru, rewritten for the MCP Python SDK 2.x
(MCPServer instead of the removed FastMCP).
How it works
The server connects to a running IPython kernel via a Jupyter connection file (ZMQ). Variables, imports, and computed results persist between tool calls. Multiple clients can share the same kernel — for example, VS Code's variable explorer and an AI agent connected via MCP.
Related MCP server: notebook-agent-mcp
Installation
pip install git+https://github.com/asanchezleache/ipython-kernel-mcp.gitRequires mcp>=2 and jupyter-client>=8 (installed automatically).
Usage
1. Start an IPython kernel
ipython kernel --ConnectionFileMixin.connection_file=~/ipython-mcp-connection.json2. Register with your MCP client
For Vibe CLI:
vibe mcp add ipython-kernel --transport stdio \
--command ipython-kernel-mcp \
--env IPYTHON_MCP_CONNECTION=~/ipython-mcp-connection.jsonFor other MCP clients (Claude Desktop, etc.), add to your config:
{
"mcpServers": {
"ipython-kernel": {
"command": "ipython-kernel-mcp",
"env": {
"IPYTHON_MCP_CONNECTION": "~/ipython-mcp-connection.json"
}
}
}
}3. Connect VS Code (optional)
Cmd+Shift+P → "Jupyter: Connect to Existing Kernel" → select the connection
file. VS Code's variable explorer, inline plots, and tqdm bars share the same
kernel.
Tools
Tool | Description |
| Connect to a running IPython kernel via connection file |
| Execute Python code in the persistent kernel |
| Check connection status |
| Interrupt a running execution |
Notes
The kernel must be started separately. This server connects to an existing kernel; it does not start one.
stdout/stderr is collected and returned when execution completes. There is no real-time streaming to the MCP client. For live output (tqdm bars, print statements), use VS Code or a terminal connected to the same kernel.
The connection file path is resolved from the
connection_fileparameter, then theIPYTHON_MCP_CONNECTIONenvironment variable.
License
MIT. See LICENSE.
Available Tools
4 toolsconnect_to_kernelA
Connect to an existing IPython kernel using its connection file.
Args: connection_file: Path to the kernel connection JSON file. If not provided, uses the IPYTHON_MCP_CONNECTION environment variable.
Returns: Connection status message.
| Name | Required | Description | Default |
|---|---|---|---|
| connection_file | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the behavioral burden. It discloses that the tool connects to an existing kernel, uses a connection file or environment variable fallback, and returns a status message. It does not mention side effects, idempotency, failure behavior, or whether an already-connected state matters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured with a clear first sentence followed by Args and Returns sections. Every line adds useful information with no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one optional parameter and an output schema, the description covers the essential purpose, parameter semantics, fallback behavior, and return value. It omits edge cases like error handling or what happens if the connection file is invalid, but the basic invocation context is fully supplied.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description compensates well for the single parameter by explaining that connection_file is the path to a kernel connection JSON file, is optional, and falls back to the IPYTHON_MCP_CONNECTION environment variable when not provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Connect to an existing IPython kernel using its connection file.' This clearly differentiates it from sibling tools like execute_code, kernel_status, and interrupt_kernel, which serve obviously different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used to establish a connection to an existing kernel, and the fallback to the IPYTHON_MCP_CONNECTION environment variable provides some context. However, it does not explicitly state when to prefer this over siblings, such as before executing code, nor does it mention any exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execute_codeA
Execute Python code on the connected IPython kernel.
Variables persist between calls. Output (stdout, results, errors) is collected and returned as a single string when execution completes.
Args: code: Python code to execute.
Returns: Execution output (stdout, expression results, or error messages).
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full disclosure burden. It usefully states that variables persist between calls and that all output (stdout, results, errors) is collected and returned as a single string when execution completes, which is valuable behavioral context. It does not mention potential side effects of running arbitrary code or timeout/interruption behavior, but the disclosed persistence and output capture are meaningful.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured: a one-sentence purpose, two sentences of behavioral context, and short Args/Returns sections. Every line contributes information and the format is easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with an output schema, the description covers the action, the parameter, persistence, and return format. The only notable gaps are that it does not explicitly state the requirement to connect to a kernel first or mention that interrupt_kernel can stop a long-running execution, though 'connected IPython kernel' strongly implies the prerequisite.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides only the property name and type with 0% description coverage, so the description must explain the parameter. The Args section says 'code: Python code to execute,' which clarifies that the string is a code snippet rather than a file path or command. It adds little beyond restating the tool's purpose and gives no examples or constraints, so it only partially compensates for the missing schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence states that the tool executes Python code on the connected IPython kernel, giving a specific verb and resource. It is immediately clear this is the tool for running code, and the sibling tools (connect, status, interrupt) are distinct actions. However, it does not explicitly compare itself to those siblings, so it stops short of a full 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage only when a kernel is already connected ('connected IPython kernel'), but it gives no explicit guidance on when to use execute_code as opposed to kernel_status or interrupt_kernel. There is no stated prerequisite action such as 'call connect_to_kernel first', and no discussion of alternatives. This is sufficient to understand the basic purpose but leaves usage decisions mostly to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
interrupt_kernelA
Interrupt the current kernel execution by sending SIGINT.
Useful for stopping long-running code or infinite loops.
Returns: Interrupt status message.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses the core behavior (sending SIGINT to interrupt execution) and the return value. It does not cover edge cases like no active kernel or loss of execution state, but for a zero-parameter signal tool this is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences: mechanism, use case, and return value. It is front-loaded with the most important information and contains no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple zero-parameter tool with an output schema, the description covers the action, purpose, and response. It does not explicitly state that a kernel must already be connected, but the operation and related sibling tools make this reasonably clear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. No parameter documentation is needed, and the description correctly avoids describing nonexistent arguments.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: interrupt the current kernel execution by sending SIGINT. This distinguishes it from siblings like execute_code, connect_to_kernel, and kernel_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit use cases: stopping long-running code or infinite loops. It does not explicitly mention alternatives or when not to use it, but the context is sufficient for an agent to choose this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kernel_statusA
Check the current kernel connection status.
Returns: Status message indicating whether a kernel is connected.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the disclosure burden. It clearly labels the operation as a check and states the return type (status message). It does not mention side effects, but 'check' reasonably implies a read-only operation and the output schema covers further return details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences: the first states the action and target, the second states the return value. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, output-schema-backed status check, the description is nearly complete. It could add an explicit note about being non-mutating or about prerequisites, but given the low complexity, the current definition is sufficient for reliable selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema is empty, so there is nothing for the description to add. The baseline of 4 applies because no parameter semantics are needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Check') with a clear resource ('kernel connection status'), and that purpose is plainly distinct from the sibling tools, which connect, execute code, or interrupt rather than report status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to call this versus the sibling tools or whether a kernel must exist first. The agent can infer usage from the name, but the description itself offers no explicit context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
4 tool updates
v0.1.0- First observed
connect_to_kernel - First observed
execute_code - First observed
interrupt_kernel - First observed
kernel_status
TDQS
Each tool performs a clearly distinct function: connecting, executing, checking status, and interrupting. There is no meaningful overlap or ambiguity between tool purposes.
Most tools follow a verb-first naming pattern (connect_to_kernel, execute_code, interrupt_kernel), but kernel_status is noun-first and breaks the pattern slightly. Overall the naming remains predictable and readable.
Four tools is a well-scoped count for a focused IPython kernel integration. Each tool fills a necessary role without unnecessary bloat.
The core lifecycle of connect, execute, check status, and interrupt is covered. Missing disconnect or restart operations are minor gaps that agents can work around, but the main workflows are supported.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Connect AI agents to Replynodes over the Model Context Protocol.
- mcp-serverOAuthai.cdbx
Build Apps and run code in 30 languages — sandboxed, with persistent sessions for agent loops.
Connect your agent to branchly: manage content, prompts, actions, learn from analytics and insights
Shared memory for coding agents. Stop re-explaining your codebase every session.
Related MCP Servers
- AlicenseAqualityDmaintenanceEnables AI agents to execute Python, TypeScript, and JavaScript code in persistent Jupyter kernels with stateful variables and imports across interactions.74MIT
- FlicenseNot gradedqualityDmaintenanceEnables AI agents to execute Jupyter notebook cells with persistent kernel state, output persistence, and structured JSON control surface.2-
- AlicenseAqualityAmaintenanceEnables interactive Python execution with a persistent IPython kernel through MCP, retaining namespace state and providing structured output logs for agent and tool integrations.8Apache 2.0
- AlicenseNot gradedqualityCmaintenanceConnects Claude Code to local Jupyter kernels for code execution, kernel management, and notebook execution, with security gating and output capture.PolyForm Noncommercial 1.0.0
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/asanchezleache/ipython-kernel-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server