B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
App connector · Web & browsing, Memory & knowledge
zotero-mcp
Zotero MCP: Connects your Zotero research library with Claude and other AI assistants via the Model Context Protocol to discuss papers, get summaries, analyze citations, and more.
Bottom line: Signal-based grade (4/7 points): very widely starred on GitHub, public source code. This reflects adoption and transparency, not a code audit.
- Popularity score
- 42/100
- Rank
- #267 of 500
- GitHub stars
- 5.4k
What it does
Zotero MCP bridges your Zotero research library with Claude and other AI assistants via the Model Context Protocol, enabling you to discuss papers, generate summaries, and analyze citations directly within AI conversations. It acts as a connector that exposes your research collection to AI models while keeping data within your local environment or Zotero sync.
Who it’s for
Researchers, academics, and knowledge workers who use Zotero for bibliography management and want to leverage AI assistants to analyze, summarize, and discuss papers without manual copying. Teams building AI-powered research workflows or document analysis pipelines.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README at https://github.com/54yyyu/zotero-mcp (opens external site) for authoritative setup steps. Likely installation via npm or manual server setup; configuration typically involves adding MCP server details to Claude Desktop's mcpServers JSON or equivalent AI client config. Exact steps should be confirmed in official documentation.
Risks
- Credentials and API exposure: If Zotero credentials or API tokens are embedded in MCP configuration, they may be accessible to the AI model or logged in conversation history.
- Prompt injection via metadata: Paper titles, author names, or abstracts in Zotero could be maliciously crafted to inject prompts into the AI, especially if not sanitized before model input.
- Research library disclosure: Connecting your full Zotero library exposes your research interests, reading patterns, and potentially proprietary or sensitive citations to the AI platform and its operators.
- Supply-chain trust: The connector is maintained by a single contributor (GitHub user 54yyyu) with no visible organization backing; updates or security patches may be delayed or unavailable.
- Data exfiltration risk: Depending on Zotero MCP's architecture, paper metadata or full-text content could potentially be cached, logged, or transmitted to third-party AI services without explicit user awareness.
How to stay secure
Least-privilege permissions
- Create a dedicated Zotero account with a separate API token (not your main account credentials) that only has read access to your research library, never write or delete permissions.
- Limit library access: Instead of connecting your entire Zotero library, create a separate collection containing only papers you're comfortable discussing with the AI; exclude proprietary, confidential, or sensitive research.
- Use read-only API keys: Generate Zotero API tokens with minimal scope—request only access to read metadata (titles, authors, abstracts), not full-text PDFs or notes.
- Rotate credentials regularly: Change your Zotero API token every 30–90 days in case it's been exposed during logging or data transmission.
Network isolation
- Store credentials outside conversation history: Keep your Zotero API token in a secure local configuration file, never paste it directly into chat or let it appear in message logs.
- Use environment variables: Configure the MCP connector to read credentials from your system's environment variables rather than hardcoded configuration files.
- Disable auto-sync of full content: Ensure the connector only pulls metadata (titles and abstracts), not full-text PDFs or private notes, to reduce data exposure.
- Check for data persistence: Verify with your AI platform whether Zotero data is cached, stored in logs, or shared with third parties; if unclear, assume it may be retained.
Monitoring
- Review your Zotero access logs monthly: Check your Zotero account's recent activity and API token usage to detect unauthorized access attempts.
- Track what the AI discusses: Manually spot-check a sample of AI responses about your papers to ensure it's not inventing citations or revealing sensitive research details.
- Set up alerts: If your AI platform offers activity logging, enable notifications for any unusual data access or large data transfers from your Zotero connection.
- Audit your library visibility: Periodically review which Zotero items have been accessed by the MCP connector and remove any papers you no longer want analyzed.
Red flags to watch for
- Credentials appearing in chat: If your API key or password ever shows up in a conversation, immediately revoke it in Zotero and generate a new one.
- Unexpected papers mentioned: If the AI references papers or details you never shared with it, the connector may be pulling data you didn't intend to expose.
- Vague MCP updates or no updates: If the zotero-mcp tool hasn't been updated in over 6 months or the maintainer becomes unresponsive, consider pausing use until security is independently verified.
- AI repeating private notes: If the AI quotes from your personal annotations or private Zotero notes, the connector is accessing more than intended and should be reconfigured immediately.
Alternatives
- Obsidian with AI plugins (e.g., Copilot, Claude integration): Local markdown-based PKM with built-in AI features; better data control but less specialized for citations.
- Elicit or Semantic Scholar APIs: Standalone AI-powered research tools designed for paper discovery and analysis; no local library integration but purpose-built for research.
- Claude + manual file upload: Upload papers or Zotero exports directly to Claude per session; slower workflow but maximum control over data sharing.
- Custom RAG pipeline (LlamaIndex, LangChain + Zotero export): Self-hosted retrieval-augmented generation over your Zotero collection; requires technical setup but offers full transparency.