create_collection

ServerMcp Zotero
CategoryWrite

WHAT IT DOES

What create_collection does on Mcp Zotero

AI agents use create_collection to create or update resources in Mcp Zotero — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Mcp Zotero environment.

THE RISK

Medium Risk

Why create_collection needs a policy

This tool creates new collections (folders) within a Zotero library, which is a write operation that modifies the library structure. It is reversible since collections can be deleted, so it does not qualify as Destructive. It does not read sensitive data (Read), execute arbitrary code (Execute), delete data (Destructive), or involve financial transactions (Financial).

From the tool's definition Tool description states it 'Create a new collection (folder) in your Zotero library' and 'Returns the new collection key and name', indicating reversible creation of organizational metadata.

Documented attack patterns abuse exactly the kind of access create_collection gives an agent:

POLICY

How to control create_collection

PolicyLayer is an MCP gateway — it sits between your AI agents and Mcp Zotero, and nothing reaches the server without passing your rules. This is the rule we recommend for create_collection:

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "create_collection": {
      "limits": [
        {
          "counter": "create_collection_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

create_collection stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

Create a free account and register Mcp Zotero — nothing to install.
Add this policy — paste it, or build it visually.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

LIMIT THIS TOOL →

Free to start. No card required.

EXPLORE

Related tools and policies

More Mcp Zotero tools

Destructive delete_collection Delete a collection (folder) from your Zotero library. Items inside the collection are NOT Destructive delete_items Delete one or more items from your Zotero library permanently (moves to trash). Accepts up Write find_and_attach_pdfs For each Zotero item, check Unpaywall for open access PDFs and attach them. Items must hav Write add_items_by_doi Add items to your Zotero library by resolving DOIs. Works with ANY item type that has a DO Write add_linked_url_attachment Attach a linked URL to an existing Zotero item, or create a standalone linked-URL attachme Write import_pdf_to_zotero Download a PDF from a URL and upload it to Zotero storage as an imported_url attachment. U Write inject_citations Replace <zcite> placeholder tags in a .docx file with native Zotero field codes that Zoter Read get_collection_items Get all items in a specific Zotero collection. Returns item keys, titles, authors, and dat

All 13 Mcp Zotero tools →

Write tools on other servers

M-Team MCP Server download_torrent YouTube MCP Server generate_video_title Android Forensics ADB MCP Server combine_reports 0xarchive web3_signup

Go deeper

The MCP Attack Database → Documented attack patterns against MCP deployments — and the policies that stop them.
Argument validation → Checking tool call arguments against schema and policy before they run.
Scoped token → Per-person credentials that grant a defined subset of servers and tools.
Rate Limiting MCP Tool Calls: A Practical Guide →
MCP Security: Why Prompt Guardrails Aren't Enough →

FAQ

Questions about create_collection

What does the create_collection tool do? +

Create a new collection (folder) in your Zotero library. Optionally nest it under a parent collection. Returns the new collection key and name. Use the key with add_items_by_doi to organize imported papers. It is categorised as a Write tool in the Mcp Zotero MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on create_collection? +

Register the Mcp Zotero MCP server in PolicyLayer and add a rule for create_collection: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Mcp Zotero. Nothing to install.

What risk level is create_collection? +

create_collection is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit create_collection? +

Yes. Add a rate_limit block to the create_collection rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block create_collection completely? +

Set action: deny in the PolicyLayer policy for create_collection. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides create_collection? +

create_collection is provided by the Mcp Zotero MCP server (xevos117/mcp-zotero). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.

Enforce policy on every Mcp Zotero tool call.

Start from Mcp Zotero, add the rest of your stack, and see everything your agents can call. Then put policy on all of it.

CHECK YOUR STACK →

Free to start. No card required.

13 Mcp Zotero tools catalogued and risk-classified — across an index of 43,000+ MCP servers.