Zotero DevSAFE
Give your AI assistant superpowers for Zotero plugin development. 28 tools for screenshots, DOM inspection, JavaScript execution, build integration, and debugging via Model Context Protocol.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Give your AI assistant superpowers for Zotero plugin development
[](LICENSE) [](https://www.zotero.org)
Architecture · Getting Started · Available Tools
A Model Context Protocol (MCP) server that enables AI assistants like Claude, Cursor, and Windsurf to build, test, and debug Zotero 7, 8, 9, and 10 plugins. Screenshots, DOM state, debug logs, and JavaScript execution give the AI rich context to understand what's happening—and tools to help you fix it.
✨ Features
🚀 Quick Start
Prerequisites
- Node.js 20+ and npm
- Zotero 7+ — Works on all Zotero 7, 8, 9, and 10 builds (release, beta, dev)
- For plugin development: zotero-plugin-scaffold
1. Install MCP Server
Use install-mcp to add the server to your AI assistant:
npx -y install-mcp @introfini/mcp-server-zotero-dev --client claude-code
Supported clients: claude-code, cursor, `win
a5c0b6e11425OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-server-zotero-dev -- npx -y @introfini/[email protected]
Exposed tools (36)
23 read · 12 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
api | read | API to explore (e.g., |
debug-plugin | write | Connect to Zotero and start debugging your plugin |
fix-errors | read | Find and fix errors from Zotero |
inspect-api | read | Interactive exploration of Zotero |
migrate-z7 | read | Help migrate a plugin from Zotero 6 to Zotero 7 |
pluginName | read | Name for your new plugin (e.g., |
projectPath | read | Path to the plugin project to migrate |
setup-dev | write | Set up Zotero plugin development environment from scratch |
zotero_clear_logs | destructive | Clear the debug log buffer and error console. |
zotero_click_element | read | Click an element in a Zotero window by CSS selector (toolbar/menu button, |
zotero_db_query | write | Execute a SELECT query on Zotero |
zotero_db_schema | read | Get database schema information. |
zotero_db_stats | read | Get database statistics: item counts, file size, etc. |
zotero_execute_js | write | Execute JavaScript code in Zotero |
zotero_get_dom_tree | read | Get a simplified DOM tree structure. |
zotero_get_pref | read | Get a Zotero preference value. |
zotero_get_styles | read | Get computed CSS styles for an element. |
zotero_inspect_element | read | Find DOM elements by CSS selector and return their details. |
zotero_inspect_object | read | Inspect a Zotero/JavaScript object to discover its methods and properties. |
zotero_list_windows | read | List all open Zotero windows with their IDs, types, and titles. |
zotero_open_preferences | read | Open Zotero |
zotero_ping | read | Test connection to Zotero and get version info. |
zotero_plugin_install | write | Install a Zotero plugin from a local XPI file. |
zotero_plugin_list | write | List all installed Zotero plugins/add-ons with their IDs, names, versions, and status. |
zotero_plugin_reload | read | Reload a Zotero plugin. |
zotero_read_errors | read | Read errors from Zotero |
zotero_read_logs | read | Read Zotero |
zotero_scaffold_build | read | Build a Zotero plugin project using zotero-plugin-scaffold. |
zotero_scaffold_lint | write | Run ESLint on a Zotero plugin project. |
zotero_scaffold_serve | write | Start/stop the zotero-plugin-scaffold dev server with hot reload. |
zotero_scaffold_typecheck | write | Run TypeScript type checking on a Zotero plugin project. |
zotero_screenshot | read | Capture a screenshot of Zotero. Can capture the main window, a specific window, |
zotero_search_prefs | read | Search and list Zotero/Firefox preferences. |
zotero_send_keys | write | Type text into an element in a Zotero window (an input/textarea or any |
zotero_set_pref | write | Set a Zotero preference value. |
zotero_watch_logs | write | Start/stop watching for new log messages. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (4)
zotero_clear_logs
@modelcontextprotocol/sdk, @types/node, @typescript-eslint/eslint-plugin, @typescript-eslint/parser, eslint, typescript, vitest
adm-zip
docs/images/demo.png
Gates applied: no_behavioural_pass.
a5c0b6e11425full audit observations/trust-audit/mcp-server/introfini__zotero-dev.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | a5c0b6e11425 | SAFE | B | 89 | first audit |
Questions
What is the Zotero Dev MCP server?
Give your AI assistant superpowers for Zotero plugin development. 28 tools for screenshots, DOM inspection, JavaScript execution, build integration, and debugging via Model Context Protocol.
What tools does Zotero Dev expose?
36 in total: 23 read-only, 12 that write, and 1 that can delete or overwrite (zotero_clear_logs). Every one is listed on this page with its risk.
Is Zotero Dev safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Zotero Dev need?
No credential environment variables were found in its source, so it appears to need none.
How does Zotero Dev run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as zotero-plugin-mcp-rdp at 1.0.6.
How current is this page?
The grade is for one exact copy of the source (a5c0b6e11425), read on 2026-10-08. The repository is watched and re-audited when it changes.