// SCAN REPORT

Zotero MCP

55 tools. 20 can modify or destroy data without limits.

4 destructive tools with no built-in limits. Policy required.

Last updated: 17 Oct 2026

20 can modify or destroy data

35 read-only

55 tools total

Community server · catalogue entry checked 17/10/2026

How to control Zotero MCP ↓

TOOL MAP

What Zotero MCP exposes to your agents

Read (35) Write / Execute (16) Destructive / Financial (4)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Zotero MCP tools

Destructive · High zotero_delete_annotation Deletion operations are irreversible and cannot be undone. Destructive · High zotero_delete_collection The tool name contains 'delete', which performs irreversible removal of a Zotero collection and its associated data. Destructive · High zotero_delete_item The tool name explicitly indicates deletion of a library item. Destructive · Medium zotero_remove_item_relation This tool irreversibly deletes relationship metadata between Zotero items.

20 of Zotero MCP's 55 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Zotero MCP

PolicyLayer is an MCP gateway — it sits between your AI agents and Zotero MCP, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "zotero_delete_annotation": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "zotero_add_item": {
    "limits": [
      {
        "counter": "zotero_add_item_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "fetch": {
    "limits": [
      {
        "counter": "fetch_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Zotero MCP — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON ZOTERO →

Instant setup, no code required.

FULL CATALOGUE

All 55 Zotero MCP tools

DESTRUCTIVE 4 tools

Destructive zotero_delete_annotation zotero_delete_annotation Destructive zotero_delete_collection zotero_delete_collection Destructive zotero_delete_item zotero_delete_item Destructive zotero_remove_item_relation Remove a related item relationship from a Zotero item.

WRITE 16 tools

Write zotero_add_item zotero_add_item Write zotero_add_item_relation Add a related item relationship to a Zotero item. Creates a bidirectional link between two items. Write zotero_attach_file zotero_attach_file Write zotero_batch_update zotero_batch_update Write zotero_create_annotation zotero_create_annotation Write zotero_create_collection zotero_create_collection Write zotero_manage_note zotero_manage_note Write zotero_merge_duplicates zotero_merge_duplicates Write zotero_set_item_collections zotero_set_item_collections Write zotero_set_item_parent zotero_set_item_parent Write zotero_switch_library zotero_switch_library Write zotero_update_annotation zotero_update_annotation Write zotero_update_collection zotero_update_collection Write zotero_update_item zotero_update_item Write zotero_update_search_database zotero_update_search_database Write zotero_write_capabilities zotero_write_capabilities

READ 35 tools

Read fetch fetch Read scite_check_retractions scite_check_retractions Read scite_enrich_item scite_enrich_item Read scite_enrich_search scite_enrich_search Read search search Read zotero_advanced_search zotero_advanced_search Read zotero_authorize_local_writes zotero_authorize_local_writes Read zotero_export_bibliography zotero_export_bibliography Read zotero_find_duplicates zotero_find_duplicates Read zotero_find_related_papers zotero_find_related_papers Read zotero_get_annotations zotero_get_annotations Read zotero_get_attachment_path zotero_get_attachment_path Read zotero_get_collection_items Get all items in a specific Zotero collection. Supports detail= Read zotero_get_collections zotero_get_collections Read zotero_get_feed_items zotero_get_feed_items Read zotero_get_item_children zotero_get_item_children Read zotero_get_item_fulltext zotero_get_item_fulltext Read zotero_get_item_metadata zotero_get_item_metadata Read zotero_get_item_related Get all related items for a specific Zotero item. Returns items that are linked via the relations field. Read zotero_get_notes zotero_get_notes Read zotero_get_page_layout zotero_get_page_layout Read zotero_get_pdf_outline zotero_get_pdf_outline Read zotero_get_recent zotero_get_recent Read zotero_get_search_database_status zotero_get_search_database_status Read zotero_get_tags zotero_get_tags Read zotero_library_coverage zotero_library_coverage Read zotero_list_feeds zotero_list_feeds Read zotero_list_libraries zotero_list_libraries Read zotero_read_pdf_pages Read specific page range(s) from a PDF attachment of a Zotero item. Read zotero_search_by_citation_key zotero_search_by_citation_key Read zotero_search_by_tag zotero_search_by_tag Read zotero_search_collections zotero_search_collections Read zotero_search_items zotero_search_items Read zotero_semantic_search zotero_semantic_search Read zotero_synthesize_annotations zotero_synthesize_annotations

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Zotero MCP

Can an AI agent delete data through the Zotero MCP server? +

Yes. The Zotero MCP server exposes 4 destructive tools including zotero_delete_annotation, zotero_delete_collection, zotero_delete_item. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Zotero MCP? +

The Zotero MCP server has 16 write tools including zotero_add_item, zotero_add_item_relation, zotero_attach_file. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Zotero MCP.

How many tools does the Zotero MCP server expose? +

55 tools across 3 categories: Destructive, Read, Write. 35 are read-only. 20 can modify, create, or delete data.

How do I enforce a policy on Zotero MCP? +

Register the Zotero MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Zotero MCP tool call.

Deterministic rules across all 55 Zotero MCP tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON ZOTERO →

Instant setup, no code required.

55 Zotero MCP tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from Zotero's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →