Downloads a .xpi file (0.02 MB). In Zotero, open Tools → Plugins and install it from the file.
StarsPeople who starred the repository on GitHub: a rough measure of interest.
0
DownloadsAll-time downloads of its release files from GitHub. Installs from elsewhere aren't counted.
4
ContributorsPeople who have committed code to the repository.
2
LicenceThe licence the code is published under, as GitHub reports it.
AGPL-3.0
C
Atlas gradeNot recommended
A+ABCC
because any website you visit can make it act through its local server: it doesn't check where requests come from
Next rung: B, once nothing in the code is a serious concern.
Applies to v0.3.3, released 21 Mar 2026Code checked · tested installed in Zotero 10.0.3 on 27 Sep 2026
What we found in the codeSets the gradeThe worst finding in these three areas sets the grade.
Code transparencyReadable code, uploaded by the project's automated GitHub buildThe release file was uploaded by the project's automated GitHub build. We haven't yet rebuilt it from the source to compare.LowLow concern: normal for plugins that do this job. Listed so you know.
Updates
Updates come from this project's GitHub repositoryThe update address offers version 0.3.3, which isn't newer than this one, so Zotero won't update it for now
Where your data goesOnly contacts services we could identify3 addresses in 3 groups.LowLow concern: normal for plugins that do this job. Listed so you know.
Scholarly services (1)
doi.orgnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Zotero (1)
Zotero lookup services
On your computer (1)
127.0.0.1named in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Powerful capabilitiesAny website you visit can make it act through its local server: it doesn't check where requests come from, and 1 moreHighHigh concern: a serious problem. One high finding makes the grade C.
Any website you visit can make it act through its local server: it doesn't check where requests come fromhighHigh concern: a serious problem.Works with files on your computerlowLow concern.
Where we found it
Any website you visit can make it act through its local server: it d…chrome/content/scripts/zoterolibrarybridge.js · line 55