AI agents use plain_text_to_notebook_file to create or update resources in Notebookllm — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Notebookllm environment.
This tool converts plain text back into Jupyter notebook files, which is a write operation that creates or modifies data. While the description is empty, the name and server context make clear it produces notebook files. It's Write rather than Execute because it transforms data format rather than running code.
From the tool's definition Tool name 'plain_text_to_notebook_file' indicates conversion and file creation/modification. Server description states it 'can convert back' (from plain text to notebook format) and 'Enables loading, editing, and saving notebooks via MCP tools.' Sibling tools…
Documented attack patterns abuse exactly the kind of access plain_text_to_notebook_file gives an agent:
PolicyLayer is an MCP gateway — it sits between your AI agents and Notebookllm, and nothing reaches the server without passing your rules. This is the rule we recommend for plain_text_to_notebook_file:
{
"version": "1",
"default": "deny",
"tools": {
"plain_text_to_notebook_file": {
"limits": [
{
"counter": "plain_text_to_notebook_file_rate",
"window": "minute",
"max": 30,
"scope": "grant"
}
]
}
}
}plain_text_to_notebook_file stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.
Free to start. No card required.
plain_text_to_notebook_file. It is categorised as a Write tool in the Notebookllm MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.
Register the Notebookllm MCP server in PolicyLayer and add a rule for plain_text_to_notebook_file: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Notebookllm. Nothing to install.
plain_text_to_notebook_file is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.
Yes. Add a rate_limit block to the plain_text_to_notebook_file rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for plain_text_to_notebook_file. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
plain_text_to_notebook_file is provided by the Notebookllm MCP server (yasirrazaa/notebookllm_mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Start from Notebookllm, add the rest of your stack, and see everything your agents can call. Then put policy on all of it.
Free to start. No card required.
6 Notebookllm tools catalogued and risk-classified — across an index of 43,000+ MCP servers.