// SCAN REPORT

Zotero Agent

29 tools. 11 can modify or destroy data without limits.

1 destructive tool with no built-in limits. Policy required.

Last updated:

11 can modify or destroy data
18 read-only
29 tools total

Community server · catalogue entry checked 07/07/2026

How to control Zotero Agent ↓

TOOL MAP

What Zotero Agent exposes to your agents

Read (18) Write / Execute (10) Destructive / Financial (1)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS
Critical Risk

The most dangerous Zotero Agent tools

Destructive · High delete_collection This tool permanently removes collections and optionally irreversibly deletes items by sending them to trash. Execute · Critical install_plugin_from_url This tool downloads and installs arbitrary XPI plugin code into Zotero, which constitutes arbitrary code execution on the host machine. Execute · High reload_plugin This tool executes a plugin reload operation via the AddonManager, which triggers external runtime operations including restarting the MCP plugin itself and dropping the connection. Write · Medium remove_items_from_collection The tool modifies collection membership by removing items, but explicitly states items are not deleted from the library.

11 of Zotero Agent's 29 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Zotero Agent

PolicyLayer is an MCP gateway — it sits between your AI agents and Zotero Agent, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations
{
  "delete_collection": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations
{
  "add_items_to_collection": {
    "limits": [
      {
        "counter": "add_items_to_collection_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations
{
  "find_similar": {
    "limits": [
      {
        "counter": "find_similar_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

  1. Create a free account and register Zotero Agent — nothing to install.
  2. Add these rules — paste them, or build them visually. Tune the limits to your setup.
  3. Point your MCP client (Claude, Cursor, anything) at your gateway URL.
ENFORCE POLICY ON ZOTERO AGENT →

Instant setup, no code required.

FULL CATALOGUE

All 29 Zotero Agent tools

DESTRUCTIVE 1 tools
Destructive delete_collection Delete a collection. WARNING: This is a destructive operation. By default, items in the collection are NOT del
EXECUTE 2 tools
Execute install_plugin_from_url Download and install/upgrade a plugin XPI from an http(s):// or file:// URL reachable FROM the Zotero machine Execute reload_plugin Reload an installed Zotero plugin via AddonManager (dev loop). Omit addon_id to reload THIS MCP plugin itself
WRITE 8 tools
Write add_items_to_collection Add one or more items to a collection by their item keys. Write create_collection Create a new collection in the library. Optionally nest it under a parent collection. Write remove_items_from_collection Remove one or more items from a collection. Items are NOT deleted from the library, only removed from this col Write update_collection Rename or move an existing collection. Provide name to rename, parentCollection to move (empty string moves to Write write_item Create a new Zotero item, re-parent existing attachments, or import a local file as an attachment. Common work Write write_metadata Update metadata fields on Zotero items (title, abstract, date, URL, DOI, creators, etc.). Only works on regula Write write_note Create or modify Zotero notes. Supports child notes (attached to items), standalone notes, updating, or append Write write_tag Add, remove, or replace tags on Zotero items. Works on any item type. Response includes before/after tag lists
READ 18 tools
Read find_similar Find items semantically similar to a given item using AI embeddings. Useful for expanding research from a know Read fulltext_database Access the cached full-text content database (read-only). Faster than re-extracting from Zotero. Actions: list Read get_annotations Get annotations and notes for specific items with color/tag filtering. REQUIRED: provide one of itemKey, annot Read get_collection_details Get detailed information about a specific collection Read get_collection_items Get items in a specific collection Read get_collections Get collections in the library. By default returns a flat, paginated list of top-level collections. Use recurs Read get_content Get full-text content from PDFs, attachments, notes, and abstracts. May contain OCR artifacts. When user asks Read get_item_abstract Get the abstract/summary of a specific item. Typically the author\ Read get_item_details Get detailed bibliographic metadata for a specific item (title, authors, dates, identifiers, attachments, note Read get_libraries List all Zotero libraries available in the current client. Returns minimal library metadata for each library a Read get_subcollections Get subcollections (child collections) of a specific collection. Use recursive=true to retrieve the full neste Read search_annotations Search and filter annotations (highlights, notes, comments) by query, colors, or tags. Returns user\ Read search_collections Search collections by name Read search_fulltext Search within full-text content of all documents. Returns matching passages with context. Use get_content with Read search_libraries Search libraries by name Read search_library Search the Zotero library with advanced parameters, boolean operators, relevance scoring, and pagination. Resu Read semantic_search AI-powered semantic search using embeddings. Finds conceptually related content even without exact keyword mat Read semantic_status Get the status of the semantic search service including index statistics.
EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

UnClick 1658 tools
admin
Nodebench 824 tools
admin
Yaver 776 tools
admin
Binance MCP Server 734 tools
admin
Pfsense 680 tools
admin
AdButler 622 tools
admin
Fortimanager 584 tools
admin
Crow 577 tools
admin
FAQ

Questions about Zotero Agent

Can an AI agent delete data through the Zotero Agent MCP server? +

Yes. The Zotero Agent server exposes 1 destructive tools including delete_collection. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Zotero Agent? +

The Zotero Agent server has 8 write tools including add_items_to_collection, create_collection, remove_items_from_collection. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Zotero Agent.

How many tools does the Zotero Agent MCP server expose? +

29 tools across 3 categories: Destructive, Read, Write. 18 are read-only. 11 can modify, create, or delete data.

How do I enforce a policy on Zotero Agent? +

Register the Zotero Agent MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Zotero Agent tool call.

Deterministic rules across all 29 Zotero Agent tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON ZOTERO AGENT →

Instant setup, no code required.

29 Zotero Agent tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from Zotero Agent's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.