Downloads a .xpi file (0.04 MB). In Zotero, open Tools → Plugins and install it from the file.
StarsPeople who starred the repository on GitHub: a rough measure of interest.
0
DownloadsAll-time downloads of its release files from GitHub. Installs from elsewhere aren't counted.
0
ContributorsPeople who have committed code to the repository.
1
LicenceThe licence the code is published under, as GitHub reports it.
MIT
B
Atlas gradeUse with care
A+ABBC
because updates are set to come from an address someone else could control
Next rung: A, once every finding in the code comes out low.
Applies to v0.1.0, released 5 Apr 2026Code checked · not yet tested in a live Zotero
Doesn't work with the current Zotero (10)Works with Zotero 7.
What we found in the codeSets the gradeThe worst finding in these three areas sets the grade.
Code transparencyUpdates are set to come from an address someone else could controlThe developer uploaded the release file from the charliegarfield account. We haven't yet checked whether this file matches the public source code.MediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Updates
Updates are set to come from "zotero-community" on GitHub, an account that doesn't exist: anyone who registers that name could publish an update Zotero would installThe update address is broken (nothing is there), so Zotero can't update it
Where your data goesIts code only names services we could identify6 addresses in 4 groups.LowLow concern: normal for plugins that do this job. Listed so you know.
AI services (2)
api.anthropic.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.openai.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Scholarly services (2)
api.crossref.orgnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.openalex.orgnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Apps you connect (1)
www.googleapis.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
On your computer (1)
localhostnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Powerful capabilitiesStores API keys or passwords, and 1 moreLowLow concern: normal for plugins that do this job. Listed so you know.
Stores API keys or passwordslowLow concern.Works with files on your computerlowLow concern.
Before you installShown, not gradedFacts to help you decide. They don't change the grade.
Works withZotero 7 · not 9, 10, 11 betaDoesn't work with the current Zotero (10)MediumMedium concern: worth reading before you install. One medium finding makes the grade B.