// SCAN REPORT

Zotero

27 tools. 9 can modify or destroy data without limits.

1 destructive tool with no built-in limits. Policy required.

Last updated:

9 can modify or destroy data
18 read-only
27 tools total

Community server · catalogue entry checked 12/06/2026

How to control Zotero ↓

TOOL MAP

What Zotero exposes to your agents

Read (18) Write / Execute (8) Destructive / Financial (1)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS
Critical Risk

The most dangerous Zotero tools

Destructive · High delete_collection This tool irreversibly deletes collections and optionally trashes associated items, which cannot be undone. Write · Medium remove_items_from_collection The tool removes items from a collection but explicitly states they are not deleted from the library. Write · Medium add_items_to_collection The tool modifies a collection by adding items to it, which is a reversible write operation. Write · Low create_collection This tool creates a new collection in Zotero's library system.

9 of Zotero's 27 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Zotero

PolicyLayer is an MCP gateway — it sits between your AI agents and Zotero, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations
{
  "delete_collection": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations
{
  "add_items_to_collection": {
    "limits": [
      {
        "counter": "add_items_to_collection_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations
{
  "find_similar": {
    "limits": [
      {
        "counter": "find_similar_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

  1. Create a free account and register Zotero — nothing to install.
  2. Add these rules — paste them, or build them visually. Tune the limits to your setup.
  3. Point your MCP client (Claude, Cursor, anything) at your gateway URL.
ENFORCE POLICY ON ZOTERO →

Instant setup, no code required.

FULL CATALOGUE

All 27 Zotero tools

DESTRUCTIVE 1 tools
Destructive delete_collection Delete a collection. WARNING: This is a destructive operation. By default, items in the collection are NOT del
WRITE 8 tools
Write add_items_to_collection Add one or more items to a collection by their item keys. Write create_collection Create a new collection in the library. Optionally nest it under a parent collection. Write remove_items_from_collection Remove one or more items from a collection. Items are NOT deleted from the library, only removed from this col Write update_collection Rename or move an existing collection. Provide name to rename, parentCollection to move (empty string moves to Write write_item Create a new Zotero item, re-parent existing attachments, or import a local file as an attachment. Common work Write write_metadata Update metadata fields on Zotero items (title, abstract, date, URL, DOI, creators, etc.). Only works on regula Write write_note Create or modify Zotero notes. Supports child notes (attached to items), standalone notes, updating, or append Write write_tag Add, remove, or replace tags on Zotero items. Works on any item type. Response includes before/after tag lists
READ 18 tools
Read find_similar Find items semantically similar to a given item using AI embeddings. Useful for expanding research from a know Read fulltext_database Access the cached full-text content database (read-only). Faster than re-extracting from Zotero. Actions: list Read get_annotations Get annotations and notes for specific items with color/tag filtering. REQUIRED: provide one of itemKey, annot Read get_collection_details Get detailed information about a specific collection Read get_collection_items Get items in a specific collection Read get_collections Get collections in the library. By default returns a flat, paginated list of top-level collections. Use recurs Read get_content Get full-text content from PDFs, attachments, notes, and abstracts. May contain OCR artifacts. When user asks Read get_item_abstract Get the abstract/summary of a specific item. Typically the author\ Read get_item_details Get detailed bibliographic metadata for a specific item (title, authors, dates, identifiers, attachments, note Read get_libraries List all Zotero libraries available in the current client. Returns minimal library metadata for each library a Read get_subcollections Get subcollections (child collections) of a specific collection. Use recursive=true to retrieve the full neste Read search_annotations Search and filter annotations (highlights, notes, comments) by query, colors, or tags. Returns user\ Read search_collections Search collections by name Read search_fulltext Search within full-text content of all documents. Returns matching passages with context. Use get_content with Read search_libraries Search libraries by name Read search_library Search the Zotero library with advanced parameters, boolean operators, relevance scoring, and pagination. Resu Read semantic_search AI-powered semantic search using embeddings. Finds conceptually related content even without exact keyword mat Read semantic_status Get the status of the semantic search service including index statistics.
EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

UnClick 1658 tools
admin
Nodebench 824 tools
admin
Yaver 812 tools
admin
Binance MCP Server 734 tools
admin
Pfsense 680 tools
admin
AdButler 622 tools
admin
Crow 587 tools
admin
Fortimanager 584 tools
admin
FAQ

Questions about Zotero

Can an AI agent delete data through the Zotero MCP server? +

Yes. The Zotero server exposes 1 destructive tools including delete_collection. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Zotero? +

The Zotero server has 8 write tools including add_items_to_collection, create_collection, remove_items_from_collection. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Zotero.

How many tools does the Zotero MCP server expose? +

27 tools across 3 categories: Destructive, Read, Write. 18 are read-only. 9 can modify, create, or delete data.

How do I enforce a policy on Zotero? +

Register the Zotero MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Zotero tool call.

Deterministic rules across all 27 Zotero tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON ZOTERO →

Instant setup, no code required.

27 Zotero tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from Zotero's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.