Zero Code Execution: Building a Safe Jupyter Notebook Connector for Cognee GraphRAG

说明与用途

该连接器安全解析 Jupyter 笔记本，去除噪声输出和秘密，并自动清理过时的图节点。

问题

Ingesting Jupyter notebooks into enterprise knowledge graphs risks code execution, noise bloat, and stale entities.

结果

The connector enables secure, noise‑free ingestion of notebooks into Cognee’s GraphRAG, preserving data integrity and privacy while automatically cleaning stale graph entities.

工作流

• 1. Read .ipynb as raw JSON with json.load (no kernel).
• 2. Extract cells: markdown, code, outputs.
• 3. Strip Base64 images and ANSI escape codes; truncate long outputs.
• 4. Apply regex redaction for API keys, PATs, AWS keys, bearer tokens.
• 5. Generate dlt document with cognee_document_source='jupyter'.
• 6. Ingest into Cognee; entity extraction via LLM; store in graph and vector DB.
• 7. On notebook deletion, use write_disposition='replace' to trigger forget-on-delete cleanup.

证据

Ingesting external notebooks that contain untrusted Python or shell magics risks accidental code execution

来源

Base64-encoded PNG/JPEG plots are stripped entirely from outputs

来源

The connector runs a compiled regex redaction pipeline over all Markdown prose, code blocks, and output buffers

来源