Metadata-Version: 2.4
Name: ipinb
Version: 0.2.0
Summary: Persistent IPython notebooks for MCP agents
Author-email: Nima Shoghi <nimashoghi@gmail.com>
License-Expression: MIT
Project-URL: Repository, https://github.com/nimashoghi/ipi
Keywords: agent,mcp,ipython,jupyter,coding-agent
Classifier: Development Status :: 2 - Pre-Alpha
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Software Development
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: beniget==0.5.0
Requires-Dist: fastmcp<5,>=4.1.1
Requires-Dist: ipykernel==7.2.0
Requires-Dist: ipython==9.13.0
Requires-Dist: jupyter-client==8.8.0
Requires-Dist: jsonschema==4.26.0
Requires-Dist: mcp<3,>=2.2
Requires-Dist: nbformat==5.10.4
Requires-Dist: packaging==26.2
Requires-Dist: pydantic<3,>=2.14.1
Requires-Dist: requests==2.34.2
Requires-Dist: starlette==1.3.1
Requires-Dist: toolfuncs<4,>=3
Requires-Dist: traitlets==5.14.3
Requires-Dist: typing-extensions<5,>=4.16
Provides-Extra: publish
Requires-Dist: jupyter-collaboration==4.4.1; extra == "publish"
Requires-Dist: jupyter-server==2.18.2; extra == "publish"
Requires-Dist: jupyter-server-ydoc==2.4.1; extra == "publish"
Requires-Dist: notebook==7.5.6; extra == "publish"
Requires-Dist: pycrdt==0.13.1; extra == "publish"
Requires-Dist: tornado==6.5.5; extra == "publish"
Dynamic: license-file

# IPi

IPi gives MCP agents persistent IPython kernels, Jupyter notebooks, and durable
local output artifacts. It is designed for Codex and Claude Code.

IPi is not an LLM harness. It has no provider client, agent turn loop, terminal
UI, prompt manager, or context-window manager. The external harness owns the
conversation; IPi owns notebook execution. IPi installs no host hooks.

The PyPI distribution and its command are [`ipinb`](https://pypi.org/project/ipinb/); the Python import is `ipi`. MCP dependencies are included by default.

## Run

IPi supports Linux and macOS and requires Python 3.11 or newer plus `uv`. Run
the published package without installing it permanently:

```bash
uvx ipinb
```

`uvx ipinb` with no arguments starts a stdio MCP server. Add it to the host's MCP configuration yourself, for example in Codex's `.codex/config.toml`:

```toml
[mcp_servers.ipi]
command = "uvx"
args = ["ipinb@0.2.0"]
```

or in Claude Code's `.mcp.json`:

```json
{"mcpServers": {"ipi": {"command": "uvx", "args": ["ipinb@0.2.0"]}}}
```

Pin an exact version so that every process of one host session runs the same IPi. Do not use `uvx ipi`: the PyPI name `ipi` belongs to an unrelated package.

Set `IPI_INSTALL_REQUIREMENT` to an authenticated requirement when child
kernels must reconstruct a private Git-installed IPi host. The value is used
only at launch and is removed from published runtime state.

## Tools And Storage

The same core MCP catalog serves stdio and HTTP:

- `create_kernel`, `list_kernels`, and `close_kernel` manage explicit kernel resources.
- `ipython(kernel_id, code)` accepts Python and observes it for a bounded interval. Calls to one kernel may overlap and share globals. `yield_time_ms=0` always returns an accepted cell handle.
- `ipdb` provides optional exception inspection and real breakpoint/stepping control. Ordinary failures finish normally and include one inspection hint.
- `read_cell` retrieves Python state and output or Markdown source and metadata, optionally waiting for Python output or completion; `interrupt` requests cancellation of one cell. Each reader owns its output cursor; cancelling observation does not cancel Python.
- `list_cells` and `markdown` inspect and author retained notebook work.
- `publish(kernel_id, cells={cell_id: caption})` retains a full live executable Notebook 7 publication and optionally highlights terminal Python cells with captions.

Wait for a predecessor to succeed before submitting dependent code. `interrupt` is best effort and never escalates to killing a sibling or kernel. `close_kernel` deliberately discards one kernel's live state while preserving retained records and other kernels. There is no active-kernel selector or agent-facing whole-service shutdown.

For Codex, a kernel created by `create_kernel` gets `CODEX_THREAD_ID` from that call's `_meta["x-codex-turn-metadata"]["thread_id"]`, so notebook code and its subprocesses see the same thread as Codex's own shell tools. It is set before bootstrap cells run; kernel plugin callbacks run earlier and do not see it. The prewarm kernel starts without a request and does not get it.

Bash is disabled by default. Set `IPI_MCP_ENABLE_BASH_TOOL=1` before startup to expose it; `0` disables it. Optional Bash and plugin tools also require `kernel_id`. The `ipdb` tool requires `kernel_id` on every call. Add `cell_id` for execution-specific inspection or control; omit it to configure kernel-wide breakpoints and exception stops. See [Debugging](docs/debugging.md).

The notebook skill includes locally readable guides for [execution and result recovery](docs/execution-and-results.md), [kernel environments and SSH](docs/kernel-environments.md), [debugging](docs/debugging.md), [publishing](docs/notebook-publishing.md), and [rich output](docs/rich-output.md). Agents load the relevant guide when needed. `docs/` owns their content; matching copies ship in the skill and package, with packaging checks guarding against drift.

Execution requires an explicit `kernel_id`. The default observation window is five seconds for `ipython` and zero for `read_cell`; both accept `yield_time_ms` from zero through 30,000. Zero returns an accepted handle for `ipython` and an immediate snapshot for `read_cell`. Python `read_cell` replies contain state and output without source or submission metadata; Markdown replies include their source and metadata. Observation is independent of execution lifetime.

Managed kernels keep IPython history in memory because the notebook and registry are the durable execution record. Kernel creation is explicit, apart from optional discoverable startup prewarming. A closed or lost handle never creates a replacement.

Handles are registry-local counters beginning with `k` for kernels and `c` for cells, such as `k0` and `c1`. Pass them unchanged to their originating registry; IDs are never reused within that registry. Tool responses provide one structured JSON payload with typed resource, handle, cell, inventory, or error envelopes. Output cursors belong to each reader. Large sources and events provide immutable MCP resource URIs and byte counts. Use `read_cell(..., include_artifact_metadata=True)` for artifact filesystem paths, SHA-256 checksums, and MIME types.

`ipython` returns its bounded cell record plus any images the cell displayed as MCP
image content, so `plt.show()` is one step instead of a path the model has to
fetch. `[tools] inline_images = "off"` disables that; images past
`inline_image_max_px` or `inline_image_max_bytes` are skipped rather than
resized, since IPi carries no imaging dependency.

Each notebook runtime gets a new session. Local sessions are stored under:

```text
<initial-cwd>/.agents/sessions/<session-id>/
  session.jsonl
  kernels/k1/notebook.ipynb
  kernels/k1/outputs/manifest.json
  kernels/k1/outputs/c1/g-<sha256-prefix>/input.py
  kernels/k1/outputs/c1/g-<sha256-prefix>/o1-stdout.txt
```

Every input and every retained Jupyter MIME output has a durable local
destination. Output available for the first MCP result is persisted before IPi
builds that bounded response. Returned and recorded paths identify immutable
response-time generations. Browser, yielded, and late output publishes a new
generation as it arrives; `manifest.json` atomically points to the latest
reduced state, including Jupyter clear and display updates. Unfinished agent or
browser cells are recorded as aborted during shutdown. Kernels and Python state
live until the MCP process exits; IPi does not resume them after restart.
Execution and plugins are trusted local Python, not a sandbox.

Generation directories normally use eight hexadecimal prefix characters and
extend on collision. Their `.sha256` file and the manifest retain the complete
digest.

## Importing Python Scripts From Paths

Kernels can import `toolfuncs`, an IPi dependency. `toolfuncs.load(path)` runs one Python script in the kernel without its `__main__` block and returns a namespace of the functions, classes, and other callables that the script defines:

```python
import toolfuncs

tool = toolfuncs.load("/absolute/project/scripts/report.py")
tool.summarize("results.csv")
```

When the script has [PEP 723](https://peps.python.org/pep-0723/) metadata, `load` first installs the dependencies whose distributions are absent from the kernel with `uv pip install --python sys.executable`. It does not replace a distribution that is already installed; when the installed version does not satisfy the script, `load` warns and keeps it. This changes the disposable environment of the running kernel, like `%pip`, and needs `uv` on the kernel's `PATH` (on an SSH target too). Loading runs the source inside the kernel process, so review untrusted source and metadata first.

`load` is not a module import: it runs the script again on each call, returns only the callables, does not register a module in `sys.modules`, and `importlib.reload` does not apply. Functions that must be pickled, for example for a process pool, belong in an importable module.

## Publishing a Notebook

Kernels always write an archival `notebook.ipynb`. Publish a specific live
notebook only when someone needs to open it:

```text
publish(kernel_id="k1", cells={"c1": "Result"})
```

The tool starts one private Notebook 7 child attached to the existing IPi
kernel, starts one Cloudflare quick tunnel, and returns the complete URL with
its access token. The recipient can view and execute the notebook against the
same live Python state. Browser interrupts are forwarded; browser launch,
restart, and shutdown actions cannot create or destroy IPi-owned kernels.

Publication is lazy, explicit, and per kernel. There is no global daemon,
dashboard, rendezvous file, registration table, or `[jupyter]` configuration.
An unpublished kernel owns no Jupyter or tunnel process. A published kernel is
exempt from ordinary idle expiry until the kernel is
killed or its owning IPi process exits; teardown closes the Jupyter child and
tunnel and invalidates the URL. Repeating `publish` returns the same
URL while it remains live and repairs a failed child or tunnel otherwise.

The Notebook 7 stack is a lazy `publish` extra, not part of normal MCP-host startup. The first publication builds one process-cached wheel from the exact running IPi code and starts it in an isolated `uv run` environment. Set `UV_CACHE_DIR` to node-local storage when the home directory is remote. Jupyter configuration, runtime data, IPython state, logs, and collaboration data always live in a private operating-system temporary directory and are removed with the publication.

Quick tunnels require an installed `cloudflared`. Publication fails without
returning a local fallback if Jupyter or the public tunnel cannot become ready.
Treat the returned URL as a bearer credential and share it only with intended
recipients. See [Notebook publishing](docs/notebook-publishing.md) for the
lifecycle and security contract.

## HTTP

Stdio is the primary transport. FastMCP HTTP is also available:

```bash
uvx ipinb --transport http --host 127.0.0.1 --port 8000
```

The process registry owns kernels and cells independently of HTTP transport sessions. Reconnecting clients use the same explicit `kernel_id` and `cell_id`; resource IDs are not authentication credentials. Both transports use the same schemas, observation windows, and lifecycle. No `server.session_mode` setting is needed.

`server.running_capacity` defaults to eight execution lanes per kernel, `server.queue_capacity` to 64 waiting submissions, and `server.kernel_capacity` to eight live or starting kernels. Saturation rejects a new submission before acceptance. The registry retains terminal records and retry keys indefinitely by default. Set `server.registry_root` to retain and reopen the same on-disk registry across server restarts; live Python state is reported lost, never reconstructed implicitly. Only one process may own that directory at a time.

Unpublished, inactive kernels expire after `server.kernel_idle_timeout_s` (one hour by default; zero disables it). Published kernels are retained until explicit close or process exit. The repeatable `-c/--config key=value` option overrides strict configuration fields using dotted keys and TOML values.

Set `IPI_MCP_HTTP_AUTH_TOKEN` to require the token as either a bearer token or
the `token` query parameter. Authentication does not define runtime ownership.

Pass `--connection-file PATH` when another local process needs a machine-readable
endpoint. IPi removes a stale file before startup, waits until the HTTP origin
is accepting requests, and atomically publishes a private `0600` JSON manifest:

```json
{
  "headers": {"Authorization": "Bearer <token>"},
  "transport": "http",
  "url": "http://127.0.0.1:8000/mcp?token=%3Ctoken%3E",
  "version": 1
}
```

The URL includes the query token only when query authentication is enabled, and
the header appears only when bearer authentication is enabled. Without a token,
`headers` is empty and the URL has no token. The last successfully published
manifest remains after shutdown as a diagnostic record; the next launch removes
it before starting. Treat the file as a secret whenever authentication is
enabled.

An installed `cloudflared` can expose the MCP endpoint directly. Public tunnels
require `IPI_MCP_HTTP_AUTH_TOKEN`:

```bash
IPI_MCP_HTTP_AUTH_TOKEN='<token>' \
uvx ipinb --transport http --host 127.0.0.1 --port 0 --tunnel
```

Tunnels are accountless Cloudflare quick tunnels, so the public
`*.trycloudflare.com` URL changes every time the tunnel starts. IPi
prints the public endpoint to stderr after the local origin and tunnel are both
ready; tunnel setup failure stops the public server instead of silently falling
back to a local-only URL. Combining `--tunnel` with `--connection-file` delays
manifest publication until the public endpoint is ready and records that public
URL.

## SSH Kernels

`create_kernel(cwd=...)` accepts either a local absolute path or a per-kernel
SSH URI:

```python
create_kernel(cwd="/Users/me/local-project")
create_kernel(cwd="ssh://gpu-box/opt/projects/model")
create_kernel(cwd="ssh://alice@gpu-box:2222/opt/projects/model", venv=".venv")
```

The URI path is the absolute working directory on the target. Host aliases,
keys, agents, ports, `ProxyJump`, and host-key policy come from normal OpenSSH
configuration. Authentication is non-interactive: IPi never accepts a password
in the URI, prompts for credentials or host trust, weakens host-key checking, or
forwards the SSH agent. Establish host trust and verify `ssh -T <alias>` works
before creating the kernel.

Each remote kernel owns a private OpenSSH master, five target-loopback Jupyter
forwards, and a mode-`0700` target session under `/tmp`. IPi resolves the latest
official portable `uv` release at launch, verifies its publisher checksum on
the host and target, stages the exact running IPi build, and removes the staged
runtime at shutdown. The target project does not need a host mirror and IPi
does not install target system software. The target must provide `python3`
3.10 or newer for the isolated, standard-library-only session owner that guards
the workspace until the exact staged supervisor takes ownership. Normal `uv` Python and dependency
resolution still needs network or pre-populated artifacts; failures retain the
bounded `uv` diagnostic.

Remote kernels run built-in plugins only. Project, user, and installed external
plugins are parsed as data but are not imported, executed, or staged for that
kernel. Creation emits one `The following plugins have been ignored` warning
with every ignored plugin and a redacted source. A single server can mix local
kernels with kernels on multiple SSH targets; listing, switching, recreation,
idle reaping, notebook attachment, PDB, images, and
cleanup retain each kernel's immutable location.

Windows, WSL path mapping, the `ipi-windows`/`ipi-remote` provisioners, and all
process-wide `IPI_KERNEL_*` settings have been removed. If a removed variable
is present, IPi exits with migration guidance to use an `ssh://` cwd. See
[Architecture](docs/architecture.md) for transport ownership and
[Breaking Changes](BREAKING_CHANGES.md) for migration details.

### SSH troubleshooting and cleanup

Before launching, inspect the effective alias with `ssh -G <alias>` and prove
non-interactive authentication with `ssh -o BatchMode=yes -T <alias> true`.
Resolve an unknown host key or changed trust record through ordinary OpenSSH
administration first; IPi deliberately does not prompt, disable checking, or
edit `known_hosts`. A configured local agent may authenticate the client, but
IPi does not forward that agent to the target. Existing `ProxyJump`, port, and
identity settings remain OpenSSH's responsibility.

Resolving the latest portable `uv` requires host HTTPS access to GitHub. Later
Python and dependency resolution runs on the target and therefore needs its
normal `uv` cache or target network access. Both failures identify which side
needs access. A lost SSH connection may prevent immediate target verification;
the supervisor's owner lease then kills its kernel and removes its private
`/tmp/ipi-session.*` directory after roughly 60 seconds. Cleanup diagnostics
name the exact redacted SSH URI and owned paths. Audit only those exact paths
and processes; never delete a broad `/tmp` pattern. Passwords, Jupyter keys,
tokens, private-key paths, and signed query strings are not included in IPi
diagnostics.

## Configuration And Plugins

IPi resolves the uv project or workspace member for each kernel cwd. Configuration merges `~/.ipi/config.toml`, the workspace root's `.ipi.toml`, and the selected member's `.ipi.toml`, in that order. Outside a uv project, it uses `<cwd>/.ipi.toml`. Project plugins also come from the selected member. Each kernel retains its requested working directory. Missing config files are optional; invalid or inaccessible config fails.

Use `ipinb --plugin DISTRIBUTION` to add an already installed plugin for every local kernel location. Repeat it for more distributions. Existing per-location plugin selections and their version or source constraints remain in effect. This is useful for integrations owned by the server session when `UV_PROJECT` points outside its launch directory. Remote kernels continue to ignore external plugins with a warning.

```toml
[server]
kernel_idle_timeout_s = 0     # keep idle kernels alive; set a positive timeout to reap them
prewarm_kernel = true         # start the default kernel in the background at startup

[tools]
inline_images = "all"

[kernel]
install_default_dependencies = true
additional_dependencies = []
scratch_dependencies = []     # personal packages only outside a uv project
locked = false                # true requires an existing, current uv.lock

[publication]
shared_dependencies = []
scratch_shared_dependencies = [] # personal widget packages outside a uv project

[plugins]
installed = []
disabled = []
```

Fresh kernels make a small general-purpose module set available: `typing_extensions`, `attrs`, `packaging`, `platformdirs`, `pydantic`, `requests`, `dateutil`, `psutil`, `tqdm`, `filelock`, `more_itertools`, `yaml`, `tenacity`, and `dotenv`. The last six come from bare, unversioned overlay requirements for `tqdm`, `filelock`, `more-itertools`, `PyYAML`, `tenacity`, and `python-dotenv`. Set `kernel.install_default_dependencies = false` to omit those six, or add PEP 508 requirements with `kernel.additional_dependencies`. A caller's explicit `additional_dependencies` value wins when it names the same distribution.

Use `publication.shared_dependencies` for packages that must be installed in both the kernel and the lazily created Notebook 7 environment, such as packages that ship a JupyterLab frontend extension. Shared entries are automatically included in every kernel, so do not duplicate them under `kernel.additional_dependencies`. The publisher uses the exact package versions and sources selected by its kernel. Ordinary kernel-only packages remain in `kernel.additional_dependencies`; installing one live with `%pip` requires no publication change. Put personal scientific and widget defaults in `kernel.scratch_dependencies` and `publication.scratch_shared_dependencies` to keep them out of project kernels.

Local and SSH kernels use ephemeral `uv run --isolated` environments. uv selects the project, workspace membership, Python interpreter, sources, and normal default groups. IPi does not enable all extras or groups. Missing or stale locks are resolved temporarily without writing `uv.lock`, and IPi does not create or synchronize `.venv`. Set `kernel.locked = true` to require an existing current lock. An explicit `venv` remains supported and is reused without synchronization; it cannot be combined with locked project preparation.

IPi captures the base environment selected by uv and constrains added kernel packages to that selection. Incompatible additions fail instead of shadowing project packages. Approved direnv settings apply to preparation and launch; IPi does not approve an `.envrc`.

When `tools.view_image` is omitted, the public tool is disabled on stdio and
enabled on HTTP, SSE, and streamable HTTP. Set it explicitly to `true` or
`false` to override that transport default. Kernel-side image-output guidance
follows the same resolution: it recommends `view_image` only when the tool is
actually registered, and otherwise lists absolute paths for the client's own
file/image reading.

IPi's bundled Notebook 7 extension shows the execution intent of each cell and collapses kernel setup and plugin bootstrap cells under one Setup group. Each execution and the Setup group has its own disclosure control, and a reader's manual choice is kept across later metadata updates. `publish(kernel_id, cells={cell_id: caption})` opens the target execution once; the reader can collapse it again until a later promotion revision requests another reveal. The published notebook keeps JupyterLab's native `contentVisibility` windowing and output-trimming behavior instead of forcing every cell or thousands of discrete outputs to render eagerly.

Plugins are ordinary `Plugin(server=..., environment=..., kernel=...)` values.
They can come from built-ins, selected `ipi.extensions` entry points,
`~/.ipi/extensions/`, or `<cwd>/.ipi/extensions/`. See
[Developing External IPi Plugins](docs/your-first-extension.md) for the API and
[Architecture](docs/architecture.md) for ownership and lifecycle details.
Coding agents that create or debug plugins can opt into the
[`developing-ipi-plugins` skill](ipi/skills/developing-ipi-plugins/SKILL.md);
it is not auto-read by the MCP server.

## Development

```bash
uv sync --all-extras --all-groups
uv run ruff check .
uv run ruff format --check .
uv run basedpyright
uv run pytest -m "not kernel and not live_api" -q
uv run pytest -m kernel -q
uv run python benchmarks/model_output_tokens.py
```

Breaking API changes are recorded in [BREAKING_CHANGES.md](BREAKING_CHANGES.md).
Release procedure is documented in [docs/releasing.md](docs/releasing.md).

## Optional notebook startup in Codex

Configure the notebook MCP server as optional and set a positive `mcp_optional_startup_grace_ms` in Codex to let the first turn proceed while it starts. Zero disables the grace deadline and waits for startup. Newly ready tools appear at subsequent native catalog boundaries. Ordinary chat remains available if optional notebook startup fails.
