Downloads a .xpi file (0.6 MB). In Zotero, open Tools → Plugins and install it from the file.
StarsPeople who starred the repository on GitHub: a rough measure of interest.
0
DownloadsAll-time downloads of its release files from GitHub. Installs from elsewhere aren't counted.
11
ContributorsPeople who have committed code to the repository.
1
LicenceThe licence the code is published under, as GitHub reports it.
MIT
C
Atlas gradeNot recommended
A+ABCC
because any website you visit can make it act through its local server: it doesn't check where requests come from, and 1 more finding
Next rung: B, once nothing in the code is a serious concern.
Applies to v0.2.4, released 15 Apr 2026Code checked · tested installed in Zotero 10.0.3 on 27 Sep 2026
What we found in the codeSets the gradeThe worst finding in these three areas sets the grade.
Code transparencyReadable code, uploaded by the project's automated GitHub buildThe release file was uploaded by the project's automated GitHub build. We haven't yet rebuilt it from the source to compare.LowLow concern: normal for plugins that do this job. Listed so you know.
Updates
Updates come from this project's GitHub repositoryThe update address offers this version
Where your data goesOnly contacts services we could identify8 addresses in 5 groups.LowLow concern: normal for plugins that do this job. Listed so you know.
AI services (1)
api.x.ai
Scholarly services (2)
api.crossref.orgnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.doi.orgnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Apps you connect (3)
api.exa.aiapi.firecrawl.devapi.tavily.com
Zotero (1)
Zotero lookup services
On your computer (1)
127.0.0.1named in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Where we found it
api.x.aicontent/scripts/zotero-resource-search.js · line 7062
Powerful capabilitiesAny website you visit can make it act through its local server: it doesn't check where requests come from, and 9 moreHighHigh concern: a serious problem. One high finding makes the grade C.
Any website you visit can make it act through its local server: it doesn't check where requests come fromhighHigh concern: a serious problem.Downloads and runs codehighHigh concern: a serious problem.A zotero:// link (a web page can open one) can make it install add-ons without asking you (from zotero-plugin-toolkit)mediumMedium concern: worth reading before you install.A zotero:// link can make it run code if you approve a prompt (from zotero-plugin-toolkit)mediumMedium concern: worth reading before you install.Changes settings in other programs or on your computerlowLow concern.Uses the clipboardlowLow concern.Stores API keys or passwordslowLow concern.Runs code it assembles while runninglowLow concern.Works with files on your computerlowLow concern.Uses Zotero's password managerlowLow concern.
Where we found it
Any website you visit can make it act through its local server: it d…content/scripts/zotero-resource-search.js · line 5024
A website can make it change your library
item.addToCollection(col.id);
Downloads and runs codecontent/scripts/zotero-resource-search.js · line 9669
const r = await fetch(entry.downloadUrl, { cache: "no-store" });
A zotero:// link (a web page can open one) can make it install add-o…content/scripts/zotero-resource-search.js · line 129