Zotero Plugins Atlas
Plugins / AI & summaries

LLM-for-Zotero — UI Edition

by TCXM · github.com/TCXM/llm-for-zotero-ui

An interface-focused edition of llm-for-zotero with a quieter, denser chat panel in the reader sidebar.

LLM-for-Zotero — UI Edition has Atlas grade C (not recommended) because its AI agent can run commands on your computer without asking you. It works with Zotero 7–10, 11 beta. Last checked 6 Nov 2026.

AI & summariesReading & PDFs
View source
Downloads a .xpi file (3.3 MB). In Zotero, open Tools → Plugins and install it from the file.
In useAn estimate of how many copies of Zotero have it: Zotero downloads each new version once for every copy that has the plugin, so we count the downloads of its most-downloaded recent release. Rounded. Plugins that update from outside GitHub count low.
12
DownloadsAll-time downloads of its release files from GitHub, counting every update. Installs from elsewhere aren't counted.
26
ReleasesVersions published on GitHub. Everyone who has the plugin downloads each one again, which adds up in Downloads.
7
StarsPeople who starred the repository on GitHub: a rough measure of interest.
1
ContributorsPeople who have committed code to the repository.
27
LicenceThe licence the code is published under, as GitHub reports it.
AGPL-3.0
C
Atlas gradeNot recommended
because its AI agent can run commands on your computer without asking you
Applies to v3.8.33, released 28 Sep 2026Code checked · not yet tested in a live Zotero
Another plugin uses the same ID15 other plugins share this add-on ID. Zotero can only install one of them.
What we found in the codeSets the gradeThe worst finding in these three areas sets the grade.
Code transparencyReadable code, uploaded by the project's automated GitHub buildThe release file was uploaded by the project's automated GitHub build. We haven't yet rebuilt it from the source to compare.LowLow concern: normal for plugins that do this job. Listed so you know.
Updates
Updates come from this project's GitHub repositoryThe update address offers this version
Where your data goesOnly contacts services we could identify27 addresses in 6 groups.LowLow concern: normal for plugins that do this job. Listed so you know.
AI services (14)
Codex CLI (OpenAI)api.anthropic.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.deepseek.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.githubcopilot.comapi.minimax.ionamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.moonshot.ainamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.openai.comapi.x.ainamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.xiaomimimo.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.auth.openai.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.chatgpt.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.dashscope.aliyuncs.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.generativelanguage.googleapis.comopen.bigmodel.cnnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Scholarly services (7)
api.crossref.orgapi.openalex.orgnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.semanticscholar.orgdoi.orgnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.europepmc.orgnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.export.arxiv.orgwww.ebi.ac.uk
Apps you connect (2)
mineru.netnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.mineru.oss-cn-shanghai.aliyuncs.com
Zotero (1)
Zotero lookup services
Code hosting (1)
github.com
On your computer (2)
127.0.0.1localhostnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Where we found it
api.githubcopilot.comcontent/scripts/llmforzotero.js · line 1208
defaultApiBase: "https://api.githubcopilot.com",
api.openai.comcontent/scripts/llmforzotero.js · line 1085
defaultApiBase: "https://api.openai.com/v1/responses",
generativelanguage.googleapis.comcontent/scripts/llmforzotero.js · line 1097
defaultApiBase: "https://generativelanguage.googleapis.com/v1beta",
Powerful capabilitiesIts AI agent can run commands on your computer without asking you, and 13 moreHighHigh concern: a serious problem. One high finding makes the grade C.
High concern (1)
Its AI agent can run commands on your computer without asking you
Medium concern (7)
Signs in using another app's identityKeeps its own tables in Zotero's databaseDownloads and runs Python and PDF tools the first time you ask about a figure; someone other than its developer can change what runs at any timeA zotero:// link (a web page can open one) can make it install add-ons without asking you (from zotero-plugin-toolkit)A zotero:// link can make it run code if you approve a prompt (from zotero-plugin-toolkit)Launches programs on your computerReuses a sign-in you saved in another program
Low concern (5)
Uses the clipboardStores API keys or passwordsRuns code it assembles while runningWorks with files on your computerOther programs on this computer can change your library through it
Not a concern (1)
Lets programs on this computer connect through Zotero's built-in server
Where we found it
Its AI agent can run commands on your computer without asking youcontent/scripts/llmforzotero.js · line 117926

Commands run as you, so they can read and change any of your files and start other programs.

name: "run_command",
Signs in using another app's identitycontent/scripts/llmforzotero.js · line 8049

Signs in as Codex CLI, GitHub Copilot for VS Code

CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
Keeps its own tables in Zotero's databasecontent/scripts/llmforzotero.js · line 4043

Tables: llm_for_zotero_chat_messages, llm_for_zotero_global_conversations, llm_for_zotero_paper_conversations

await Zotero.DB.queryAsync(
Downloads and runs Python and PDF tools the first time you ask about…content/scripts/llmforzotero.js · line 61745

The file belongs to yilewang, the developer of the original llm-for-zotero, not this plugin's developer: they can replace it at any time, and nothing checks it before it runs, and what they put there runs on your computer. The first time you ask about a figure, it downloads a 265–491 MB bundle of Python and the Poppler PDF tools from the original llm-for-zotero's GitHub release and runs it, without asking; the README doesn't mention it. What's there now is standard software: we checked the macOS (Apple silicon) bundle, and every file is from conda-forge.

const response = await fetcher(url);
A zotero:// link (a web page can open one) can make it install add-o…content/scripts/llmforzotero.js · line 166815

zotero://plugin. zotero-plugin-toolkit removed this link in version 6.0.0; this plugin is built with an older version

Services.io.getProtocolHandler("zotero").wrappedJSObject._extensions["zotero://plugin"] = pluginBridgeExtension;
A zotero:// link can make it run code if you approve a promptcontent/scripts/llmforzotero.js · line 166771

zotero://ztoolkit-debug

Services.io.getProtocolHandler("zotero").wrappedJSObject._extensions["zotero://ztoolkit-debug"] = debugBridgeExtension;
Launches programs on your computercontent/scripts/llmforzotero.js · line 23510

Programs it names include curl

if (!Subprocess?.call) return void 0;
Reuses a sign-in you saved in another programcontent/scripts/llmforzotero.js · line 5527

Reuses the sign-in you saved in Codex CLI

return joinLocalPath(resolveHomeDir(), ".codex", "auth.json");
Before you installShown, not gradedFacts to help you decide. They don't change the grade.
Works withZotero 7, 8, 9, 10, 11 betaUpdates automatically
Zotero 7 ✓ worksZotero 8 ✓ worksZotero 9 ✓ worksZotero 10 ✓ worksZotero 11 beta ✓ works
What you'll needNothing extra detectedDetected automatically from its code
No further detail for this area yet.
MaintenanceActive · last release 28 Sep 202627 contributors
No further detail for this area yet.
LanguagesDocumentation in EnglishInterface: English and Chinese
No further detail for this area yet.
We report what we found in the code. Open any area for the evidence.How we gradeReport a problem

What it does

Written by AI from the README

An interface-focused edition of llm-for-zotero with a quieter, denser chat panel in the reader sidebar. You can add or explain selected text directly and quote replies into the next prompt. It uses the original add-on ID.

For users of llm-for-zotero who want a cleaner chat layout. It replaces an installed upstream copy; features and setup follow the upstream project.

What you'll need

Detected automatically

We haven't detected any setup requirements. That isn't the same as none: check the developer's README.

Where your data goes

We found: only contacts services we could identify. 27 addresses in 6 groups.

AI services (14)
Codex CLI (OpenAI)api.anthropic.comnamed in its codeapi.deepseek.comnamed in its codeapi.githubcopilot.comapi.minimax.ionamed in its codeapi.moonshot.ainamed in its codeapi.openai.comapi.x.ainamed in its codeapi.xiaomimimo.comnamed in its codeauth.openai.comnamed in its codechatgpt.comnamed in its codedashscope.aliyuncs.comnamed in its codegenerativelanguage.googleapis.comopen.bigmodel.cnnamed in its code
Scholarly services (7)
api.crossref.orgapi.openalex.orgnamed in its codeapi.semanticscholar.orgdoi.orgnamed in its codeeuropepmc.orgnamed in its codeexport.arxiv.orgwww.ebi.ac.uk
Apps you connect (2)
mineru.netnamed in its codemineru.oss-cn-shanghai.aliyuncs.com
Zotero (1)
Zotero lookup services
Code hosting (1)
github.com
On your computer (2)
127.0.0.1localhostnamed in its code
Evidence · file and line
api.githubcopilot.comcontent/scripts/llmforzotero.js · line 1208
defaultApiBase: "https://api.githubcopilot.com",
api.openai.comcontent/scripts/llmforzotero.js · line 1085
defaultApiBase: "https://api.openai.com/v1/responses",
generativelanguage.googleapis.comcontent/scripts/llmforzotero.js · line 1097
defaultApiBase: "https://generativelanguage.googleapis.com/v1beta",

Forks and copies

16 other plugins use the same ID as this one. Every Zotero plugin carries an ID, a name tag Zotero uses to tell plugins apart. These 17 plugins carry the same one, because people copied llm-for-zotero to make their own versions and kept its ID.Show what this means
  • You can only have one. Zotero sees them as the same plugin.
  • Installing another replaces it. If you install one of the others, it takes this one's place.
  • Check what you install. Several share this plugin's name, so make sure the file comes from the one you meant.
LLM-for-Zotero — UI Edition · this pluginTCXM/llm-for-zotero-uiCNot recommended2628 Sep 2026
llm-for-zoteroThe most used · yilewang/llm-for-zoteroCNot recommended863,9582 Nov 2026
See all 17 and how they differ →

No forks listed.

The developer's response

The developer hasn't responded. Developers can reply here, and their reply sits next to our findings.I'm the developer

Ratings and reviews

What people who use it say. This is separate from the grade, which is what the code does, and never changes it.

No ratings yet.

Write a review
Your rating of LLM-for-Zotero — UI Edition v3.8.33

Your review is public, under the name you give, and published with the directory's data under CC BY 4.0. Links are removed. We never store your IP address: a scrambled code made from it is kept for 30 days to catch fake reviews. Every review is checked before it's published; how fake ones are spotted isn't published, so it can't be gamed.

Install LLM-for-Zotero — UI Edition
CNot recommended
We don't recommend itIts AI agent can run commands on your computer without asking you.
Better-graded plugins for the same jobA+Bionic for ZoteroA+Zotero Focused ModeA+Add Items from Text
Read what we found