Zotero Plugins Atlas
Plugins / AI & summaries

paperpilot

by zjysnow · github.com/zjysnow/paperpilot

PaperPilot for Zotero 8

AI & summaries
View source
There's no release file current Zotero can install. The source stays linked for reference.
StarsPeople who starred the repository on GitHub: a rough measure of interest.
0
DownloadsAll-time downloads of its release files from GitHub. Installs from elsewhere aren't counted.
5
ContributorsPeople who have committed code to the repository.
1
LicenceThe licence the code is published under, as GitHub reports it.
AGPL-3.0
C
Atlas gradeNot recommended
because it runs commands its AI assistant writes, with full access to your computer
Applies to v1.0.4, released 31 Aug 2026Code checked · it didn't load when we installed it in Zotero 10.0.3
Zotero won't install this fileZotero won't install this file: its add-on ID isn't in a form Zotero accepts
What we found in the codeSets the gradeThe worst finding in these three areas sets the grade.
Code transparencyReadable code, uploaded by the project's automated GitHub buildThe release file was uploaded by the project's automated GitHub build. We haven't yet rebuilt it from the source to compare.LowLow concern: normal for plugins that do this job. Listed so you know.
Updates
Updates come from this project's GitHub repositoryZotero will update it to version 1.4.0 from zjysnow/paperpilot on GitHub (rated: Serious concerns found)
Where your data goesOnly contacts services we could identify24 addresses in 6 groups.LowLow concern: normal for plugins that do this job. Listed so you know.
AI services (12)
api.anthropic.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.deepseek.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.githubcopilot.comapi.minimax.ionamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.moonshot.ainamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.openai.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.x.ainamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.xiaomimimo.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.chatgpt.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.dashscope.aliyuncs.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.generativelanguage.googleapis.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.open.bigmodel.cnnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Scholarly services (7)
api.crossref.orgapi.openalex.orgnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.semanticscholar.orgdoi.orgnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.europepmc.orgnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.export.arxiv.orgwww.ebi.ac.uk
Apps you connect (2)
mineru.netnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.mineru.oss-cn-shanghai.aliyuncs.com
Zotero (1)
Zotero lookup services
Code hosting (1)
github.com
On your computer (1)
127.0.0.1
Where we found it
api.githubcopilot.comcontent/scripts/paperpilot.js · line 1538
defaultApiBase: "https://api.githubcopilot.com",
api.crossref.orgcontent/scripts/paperpilot.js · line 97229
`https://api.crossref.org/works/${encodedDoi}`
api.semanticscholar.orgcontent/scripts/paperpilot.js · line 97334
url = `https://api.semanticscholar.org/graph/v1/paper/DOI:${encodeURIComponent(params.doi)}?fields=${fields}`;
Powerful capabilitiesRuns commands its AI assistant writes, with full access to your computer, and 12 moreHighHigh concern: a serious problem. One high finding makes the grade C.
Runs commands its AI assistant writes, with full access to your computerhighHigh concern: a serious problem.Signs in using another app's identitymediumMedium concern: worth reading before you install.Keeps its own tables in Zotero's databasemediumMedium concern: worth reading before you install.Downloads a program and runs itmediumMedium concern: worth reading before you install.A zotero:// link (a web page can open one) can make it install add-ons without asking you (from zotero-plugin-toolkit)mediumMedium concern: worth reading before you install.A zotero:// link can make it run code if you approve a prompt (from zotero-plugin-toolkit)mediumMedium concern: worth reading before you install.Launches programs on your computermediumMedium concern: worth reading before you install.Uses the clipboardlowLow concern.Stores API keys or passwordslowLow concern.Runs code it assembles while runninglowLow concern.Works with files on your computerlowLow concern.Other programs on this computer can change your library through itlowLow concern.Lets programs on this computer connect through Zotero's built-in server
Where we found it
Runs commands its AI assistant writes, with full access to your comp…content/scripts/paperpilot.js · line 102758

It can run without showing you the code first

name: "run_command",
Signs in using another app's identitycontent/scripts/paperpilot.js · line 7294

Signs in as GitHub Copilot for VS Code

COPILOT_GITHUB_CLIENT_ID = "Iv1.b507a08c87ecfe98";
Keeps its own tables in Zotero's databasecontent/scripts/paperpilot.js · line 4682

Tables: llm_for_zotero_chat_messages, llm_for_zotero_global_conversations, llm_for_zotero_paper_conversations

await Zotero.DB.queryAsync(
Downloads a program and runs itcontent/scripts/paperpilot.js · line 60213

The first time it extracts a figure, it would download a Python and Poppler bundle from the developer's GitHub release and run it, without asking and without a check; the README doesn't mention it. That file doesn't exist today (the address returns 404), so nothing is downloaded yet.

const response = await fetcher(url);
A zotero:// link (a web page can open one) can make it install add-o…content/scripts/paperpilot.js · line 146105

zotero://plugin

Services.io.getProtocolHandler("zotero").wrappedJSObject._extensions["zotero://plugin"] = pluginBridgeExtension;
A zotero:// link can make it run code if you approve a promptcontent/scripts/paperpilot.js · line 146061

zotero://ztoolkit-debug

Services.io.getProtocolHandler("zotero").wrappedJSObject._extensions["zotero://ztoolkit-debug"] = debugBridgeExtension;
Launches programs on your computercontent/scripts/paperpilot.js · line 61032

Programs it names include code, code.cmd, curl, obsidian, open

"resource://gre/modules/Subprocess.sys.mjs"
Before you installShown, not gradedFacts to help you decide. They don't change the grade.
Works withZotero won't install this fileDoesn't work with the current Zotero (10)MediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Zotero 9 ✗ doesn't workZotero 10 ✗ doesn't workZotero 11 beta ✗ doesn't work
What you'll needAn API key for some featuresDetected automatically from its code
No further detail for this area yet.
MaintenanceActive · last release 31 Aug 20261 contributor
No further detail for this area yet.
LanguagesDocumentation in EnglishInterface: English and Chinese
No further detail for this area yet.
We report what we found in the code. Open any area for the evidence.How we gradeReport a problem

What it does

Description coming soon. We haven't written a summary yet. The line above is the developer's own description; the developer's README is linked above.

What you'll need

Detected automatically
  • An API key for some featuresWorks without one: Local OpenAI-Compatible provider (Ollama) needs no key. Needs a key (OpenAI, Anthropic, Google Gemini, MinerU and Semantic Scholar): Cloud model providers (OpenAI, Anthropic, Gemini and others); MinerU and Semantic Scholar keys for extra features.
  • Or: a model on your own computerIt can use a local model such as Ollama
  • An older ZoteroNot working with Zotero 10

Where your data goes

We found: only contacts services we could identify. 24 addresses in 6 groups.

AI services (12)
api.anthropic.comnamed in its codeapi.deepseek.comnamed in its codeapi.githubcopilot.comapi.minimax.ionamed in its codeapi.moonshot.ainamed in its codeapi.openai.comnamed in its codeapi.x.ainamed in its codeapi.xiaomimimo.comnamed in its codechatgpt.comnamed in its codedashscope.aliyuncs.comnamed in its codegenerativelanguage.googleapis.comnamed in its codeopen.bigmodel.cnnamed in its code
Scholarly services (7)
api.crossref.orgapi.openalex.orgnamed in its codeapi.semanticscholar.orgdoi.orgnamed in its codeeuropepmc.orgnamed in its codeexport.arxiv.orgwww.ebi.ac.uk
Apps you connect (2)
mineru.netnamed in its codemineru.oss-cn-shanghai.aliyuncs.com
Zotero (1)
Zotero lookup services
Code hosting (1)
github.com
On your computer (1)
127.0.0.1
Evidence · file and line
api.githubcopilot.comcontent/scripts/paperpilot.js · line 1538
defaultApiBase: "https://api.githubcopilot.com",
api.crossref.orgcontent/scripts/paperpilot.js · line 97229
`https://api.crossref.org/works/${encodedDoi}`
api.semanticscholar.orgcontent/scripts/paperpilot.js · line 97334
url = `https://api.semanticscholar.org/graph/v1/paper/DOI:${encodeURIComponent(params.doi)}?fields=${fields}`;

Forks and alternatives

No forks listed.

Plugins for the same job
  • Add Items from TextAI & summaries · Import & metadataA+Recommended, tested in Zotero
  • MkteroReading & PDFs · Citing & writing · AI & summariesA+Recommended, tested in Zotero
  • Zotero 阅读模式沉浸式双语Reading & PDFs · Translation · AI & summariesA+Recommended, tested in Zotero
  • Zotero 标题翻译Reading & PDFs · Translation · Organising & tags · AI & summariesA+Recommended, tested in Zotero

The developer's response

The developer hasn't responded. Developers can reply here, and their reply sits next to our findings.I'm the developer