Downloads a .xpi file (1.2 MB). In Zotero, open Tools → Plugins and install it from the file.
StarsPeople who starred the repository on GitHub: a rough measure of interest.
65
DownloadsAll-time downloads of its release files from GitHub. Installs from elsewhere aren't counted.
126,884
ContributorsPeople who have committed code to the repository.
1
LicenceThe licence the code is published under, as GitHub reports it.
None stated
B
Atlas gradeUse with care
A+ABBC
because it contacts developers' servers: gpt.magiczotero.top and soil.magiczotero.top, and 4 more findings
Next rung: A, once every finding in the code comes out low.
Applies to v0.2.10, released 17 Sep 2026Code checked · tested installed in Zotero 10.0.3 on 27 Sep 2026
What we found in the codeSets the gradeThe worst finding in these three areas sets the grade.
Code transparencyReadable code; not yet checked against the published sourceThe developer uploaded the release file from the l0o0 account. We haven't yet checked whether this file matches the public source code.UnknownWe couldn't check this yet.
Updates
Updates come from this project's GitHub repositoryThe update address has no version for Zotero 10
Where your data goesContacts developers' servers: gpt.magiczotero.top and soil.magiczotero.top23 addresses in 4 groups.MediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Developer's servers (2)
gpt.magiczotero.topsoil.magiczotero.top
AI services (19)
api.anthropic.comapi.cohere.aiapi.deepseek.comapi.minimax.chatapi.mistral.aiapi.moonshot.cnapi.openai.comapi.siliconflow.cnapi.xiaomimimo.comark.cn-beijing.volces.comcloud.siliconflow.cnnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.console.anthropic.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.dashscope.aliyuncs.comgenerativelanguage.googleapis.comintegrate.api.nvidia.comopen.bigmodel.cnopenrouter.aiplatform.deepseek.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.wanqing.streamlakeapi.com
Zotero (1)
www.zotero.orgnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
On your computer (1)
localhostnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Where we found it
gpt.magiczotero.topcontent/garden-app/garden-app.js · line 39440
soil.magiczotero.topcontent/garden-app/garden-app.js · line 10483
this.baseUrl = "https://soil.magiczotero.top";
api.anthropic.comcontent/garden-app/garden-app.js · line 47504
baseUrl: "https://api.anthropic.com/v1",
Powerful capabilitiesChanges settings in other programs or on your computer, and 7 moreMediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Changes settings in other programs or on your computermediumMedium concern: worth reading before you install.Installs other add-onsmediumMedium concern: worth reading before you install.A zotero:// link (a web page can open one) can make it install add-ons without asking you (from zotero-plugin-toolkit)mediumMedium concern: worth reading before you install.A zotero:// link can make it run code if you approve a prompt (from zotero-plugin-toolkit)mediumMedium concern: worth reading before you install.Uses the clipboardlowLow concern.Stores API keys or passwordslowLow concern.Works with files on your computerlowLow concern.Keeps its own database filelowLow concern.
Where we found it
Changes settings in other programs or on your computercontent/scripts/garden.js · line 5814
Changes the settings of CC Switch, Claude Code and Codex CLI
"cc-switch.db"
Installs other add-onscontent/garden-app/garden-app.js · line 56247
From its catalogue at soil.magiczotero.top via ftp.zotero-chinese.com
Description coming soon. We haven't written a summary yet. The line above is the developer's own description; the developer's README is linked above.
What you'll need
Detected automatically
An API key for some featuresWorks without one: the built-in free model quota and CSL style downloads. Needs a key (DeepSeek, OpenAI, Anthropic, Google AI Studio, SiliconFlow and other LLM providers): your own keys are needed only for the third-party model providers it configures.
Or: a model on your own computerIt can use a local model such as Ollama
Where your data goes
We found: contacts developers' servers: gpt.magiczotero.top and soil.magiczotero.top. 23 addresses in 4 groups.
Developer's servers (2)
gpt.magiczotero.topsoil.magiczotero.top
AI services (19)
api.anthropic.comapi.cohere.aiapi.deepseek.comapi.minimax.chatapi.mistral.aiapi.moonshot.cnapi.openai.comapi.siliconflow.cnapi.xiaomimimo.comark.cn-beijing.volces.comcloud.siliconflow.cnnamed in its codeconsole.anthropic.comnamed in its codedashscope.aliyuncs.comgenerativelanguage.googleapis.comintegrate.api.nvidia.comopen.bigmodel.cnopenrouter.aiplatform.deepseek.comnamed in its codewanqing.streamlakeapi.com
Zotero (1)
www.zotero.orgnamed in its code
On your computer (1)
localhostnamed in its code
Evidence · file and line
gpt.magiczotero.topcontent/garden-app/garden-app.js · line 39440