DSH-for-Zotero has Atlas grade B (use with care) because a zotero:// link (a web page can open one) can make it install add-ons without asking you (from zotero-plugin-toolkit), and 2 more findings. It works with Zotero 10. Last checked 6 Nov 2026.
Downloads a .xpi file (0.3 MB). In Zotero, open Tools → Plugins and install it from the file.
In useAn estimate of how many copies of Zotero have it: Zotero downloads each new version once for every copy that has the plugin, so we count the downloads of its most-downloaded recent release. Rounded. Plugins that update from outside GitHub count low.
30
DownloadsAll-time downloads of its release files from GitHub, counting every update. Installs from elsewhere aren't counted.
39
ReleasesVersions published on GitHub. Everyone who has the plugin downloads each one again, which adds up in Downloads.
8
StarsPeople who starred the repository on GitHub: a rough measure of interest.
2
ContributorsPeople who have committed code to the repository.
1
LicenceThe licence the code is published under, as GitHub reports it.
NOASSERTION
B
Atlas gradeUse with care
A+ABBC
because a zotero:// link (a web page can open one) can make it install add-ons without asking you (from zotero-plugin-toolkit), and 2 more findings
Next rung: A, once every finding in the code comes out low.
Applies to v0.31.0, released 25 Oct 2026Code checked · not yet tested in a live Zotero
What we found in the codeSets the gradeThe worst finding in these three areas sets the grade.
Code transparencyReadable code, uploaded by the project's automated GitHub buildThe release file was uploaded by the project's automated GitHub build. We haven't yet rebuilt it from the source to compare. 1 code file couldn't be parsed and was only scanned for known patternsLowLow concern: normal for plugins that do this job. Listed so you know.
Updates
Updates come from laofashi666/dsh-for-zotero on GiteeThe update address lists version 0.33.1, but its download link is broken, so Zotero can't update it
Where your data goesIts code only names services we could identify6 addresses in 3 groups.LowLow concern: normal for plugins that do this job. Listed so you know.
AI services (2)
api.deepseek.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.open.bigmodel.cnnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Scholarly services (3)
api.crossref.orgnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.datacite.orgnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.openalex.orgnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
On your computer (1)
127.0.0.1
Powerful capabilitiesA zotero:// link (a web page can open one) can make it install add-ons without asking you, and 4 moreMediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Medium concern (3)
A zotero:// link (a web page can open one) can make it install add-ons without asking you (from zotero-plugin-toolkit)A zotero:// link can make it run code if you approve a prompt (from zotero-plugin-toolkit)Launches programs on your computer
Low concern (2)
Stores API keys or passwordsWorks with files on your computer
Where we found it
A zotero:// link (a web page can open one) can make it install add-o…content/scripts/dshforzotero.js · line 129
zotero://plugin. zotero-plugin-toolkit removed this link in version 6.0.0; this plugin is built with an older version
Runs the DeepSeek Harness agent inside Zotero 10. The agent reads your papers and annotations, answers questions, searches your library, edits tags and notes, and finds papers through Crossref and DataCite. Deleting or creating items always needs your confirmation.
Chatting with a model and pasting answers back loses context. This gives the agent tools to work on your library directly. Needs the DeepSeek Harness desktop app installed locally.
What you'll need
Detected automatically
We haven't detected any setup requirements. That isn't the same as none: check the developer's README.
Where your data goes
We found: its code only names services we could identify. 6 addresses in 3 groups.
AI services (2)
api.deepseek.comnamed in its codeopen.bigmodel.cnnamed in its code
Scholarly services (3)
api.crossref.orgnamed in its codeapi.datacite.orgnamed in its codeapi.openalex.orgnamed in its code
On your computer (1)
127.0.0.1
Forks and copies
No forks listed.
The developer's response
The developer hasn't responded. Developers can reply here, and their reply sits next to our findings.I'm the developer
Ratings and reviews
What people who use it say. This is separate from the grade, which is what the code does, and never changes it.
No ratings yet.
Write a review
Google Analytics stays off unless you accept.When it's on, it counts your visit: Google gets your IP address, your browser and the pages you view here, searches included, and sets its cookies. More about this