// SCAN REPORT

Zeppelin

14 tools. 11 can modify or destroy data without limits.

2 destructive tools with no built-in limits. Policy required.

Last updated: 29 Jun 2026

11 can modify or destroy data

3 read-only

14 tools total

Community server · catalogue entry verified 29/06/2026

How to control Zeppelin ↓

TOOL MAP

What Zeppelin exposes to your agents

Read (3) Write / Execute (9) Destructive / Financial (2)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Zeppelin tools

Destructive · High delete_notebook This tool irreversibly removes a notebook and its contents from the Zeppelin server. Destructive · High delete_paragraph This tool permanently deletes a paragraph from a notebook, which cannot be undone. Execute · High restart_interpreter This tool executes a command to restart an interpreter, which is an external operation whose effects depend on which interpreter is specified. Execute · High run_all_paragraphs This tool executes arbitrary code with effects determined by the notebook contents, which an AI agent may not fully understand.

11 of Zeppelin's 14 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Zeppelin

PolicyLayer is an MCP gateway — it sits between your AI agents and Zeppelin, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "delete_notebook": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "create_notebook": {
    "limits": [
      {
        "counter": "create_notebook_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "get_notebook": {
    "limits": [
      {
        "counter": "get_notebook_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Zeppelin — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON ZEPPELIN →

Instant setup, no code required.

FULL CATALOGUE

All 14 Zeppelin tools

DESTRUCTIVE 2 tools

Destructive delete_notebook Delete a notebook by ID. This action is irreversible. Destructive delete_paragraph Remove a paragraph from a notebook.

EXECUTE 5 tools

Execute restart_interpreter Restart a Zeppelin interpreter by setting name (e.g. Execute run_all_paragraphs Execute all paragraphs in a notebook sequentially. Execute run_paragraph Execute a single paragraph and return its output. This is a synchronous call that waits for execution to compl Execute stop_all_paragraphs Cancel all running paragraphs in a notebook. Execute stop_paragraph Cancel a running paragraph.

WRITE 4 tools

Write create_notebook Create a new notebook at the given path. Path uses Write create_paragraph Add a new paragraph to a notebook. Optionally specify text and position index. Write update_paragraph Update a paragraph Write zeppelin_login Authenticate with Apache Zeppelin using username and password. Must be called before any other tools. Stores s

READ 3 tools

Read get_notebook Get a notebook Read get_paragraph Read a single paragraph Read list_notebooks List notebooks in Zeppelin. Use the query parameter to filter by path (case-insensitive substring match). With

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Zeppelin

Can an AI agent delete data through the Zeppelin MCP server? +

Yes. The Zeppelin server exposes 2 destructive tools including delete_notebook, delete_paragraph. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Zeppelin? +

The Zeppelin server has 4 write tools including create_notebook, create_paragraph, update_paragraph. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Zeppelin.

How many tools does the Zeppelin MCP server expose? +

14 tools across 4 categories: Destructive, Execute, Read, Write. 3 are read-only. 11 can modify, create, or delete data.

How do I enforce a policy on Zeppelin? +

Register the Zeppelin MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Zeppelin tool call.

Deterministic rules across all 14 Zeppelin tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON ZEPPELIN →

Instant setup, no code required.

14 Zeppelin tools catalogued and risk-classified — across an index of 43,000+ MCP servers.