The tempting implementation is to write straight to the Zotero database, and that is exactly what this does not do: writes go through Zotero's internal APIs while the plugin runs inside Zotero, so the app's own invariants hold. Everything else follows — loopback only, no cloud writes, and nothing permanently erased, since delete-like flows use the trash or a controlled merge. Start in `readonly` or `askforapprove` and only consider `yolo` after watching a few dry runs.
A Zotero plugin that hosts an MCP endpoint inside Zotero. Writes go through Zotero's internal APIs rather than the database file, and every write is planned as a dry run first. Starting Zotero starts the endpoint; closing Zotero stops it.
- Items and collections read, searched, created and edited; DOI records checked in batch; membership in top-level collections or subcollections managed in bulk
- Attachments added, moved, renamed and inspected, with PDF and EPUB imported through Zotero's own metadata recognition and attachment rename logic
- PDF annotations read, created and updated, and citations and bibliographies formatted by Zotero
- BibTeX, RIS and CSL JSON imported and exported
- Basic search, advanced search, and saved searches read and updated — a read-only query such as `zotero_collection_get_tree` needs no approval
- Duplicates found and merged under a controlled flow
- A safety workflow around every write: dry-run plan, warnings, affected targets, approval, audit, file-level backup and undo
Zotero 9.x desktop and the plugin XPI from the project's releases, dragged into Tools → Plugins. Run mode is chosen in Settings → Zotero Local MCP Bridge: `readonly` blocks all writes, `askforapprove` requires your approval after the dry run, and `yolo` lets ordinary writes execute while high-risk operations still ask. Clients that speak Streamable HTTP connect straight to `http://127.0.0.1:23119/zotero-local-mcp-bridge/mcp`; stdio-only clients install the adapter with `npm install -g zotero-local-mcp-bridge-stdio-adapter`, and `zotero-local-mcp-bridge-stdio doctor` prints ready-to-copy configurations. Local user libraries only — no Zotero Web API, no group libraries, and no `ZOTERO_API_KEY` is requested or stored.
One command — npm install -g zotero-local-mcp-bridge-stdio-adapter
