Zotero Plugins Atlas
Plugins / AI & summaries

Zotero Copilot

by kirinhcl · github.com/kirinhcl/zotero-copilot

AI-powered research assistant for Zotero, inspired by VS Code Copilot

AI & summaries
View source
Downloads a .xpi file (0.06 MB). In Zotero, open Tools → Plugins and install it from the file.
StarsPeople who starred the repository on GitHub: a rough measure of interest.
0
DownloadsAll-time downloads of its release files from GitHub. Installs from elsewhere aren't counted.
0
ContributorsPeople who have committed code to the repository.
1
LicenceThe licence the code is published under, as GitHub reports it.
AGPL-3.0
B
Atlas gradeUse with care
because updates are set to come from an address someone else could control, and 3 more findings
Applies to v0.1.0, released 4 Mar 2026Code checked · not yet tested in a live Zotero
Doesn't work with the current Zotero (10)Works with Zotero 7, 8.
What we found in the codeSets the gradeThe worst finding in these three areas sets the grade.
Code transparencyUpdates are set to come from an address someone else could controlThe developer uploaded the release file from the kirinhcl account. We haven't yet checked whether this file matches the public source code.MediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Updates
Updates are set to come from chenghao/zotero-copilot on GitHub, which doesn't exist or isn't public: if the owner of "chenghao" published an update there, Zotero would install itThe update address is broken (nothing is there), so Zotero can't update it
Where your data goesOnly contacts services we could identify8 addresses in 2 groups.LowLow concern: normal for plugins that do this job. Listed so you know.
AI services (7)
api.anthropic.comapi.openai.comauth.openai.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.chatgpt.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.claude.ainamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.console.anthropic.comgenerativelanguage.googleapis.com
On your computer (1)
localhostnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Where we found it
api.anthropic.comcontent/scripts/zoterocopliot.js · line 4259
return authMode === "oauth" ? "https://api.anthropic.com/v1/messages?beta=true" : "https://api.anthropic.com/v1/messages";
api.openai.comcontent/scripts/zoterocopliot.js · line 4235
return authMode === "oauth" ? CODEX_ENDPOINT : "https://api.openai.com/v1/chat/completions";
console.anthropic.comcontent/scripts/zoterocopliot.js · line 3926
var ANTHROPIC_TOKEN_URL = "https://console.anthropic.com/v1/oauth/token";
Powerful capabilitiesSigns in using another app's identity, and 4 moreMediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Signs in using another app's identitymediumMedium concern: worth reading before you install.A zotero:// link (a web page can open one) can make it install add-ons without asking you (from zotero-plugin-toolkit)mediumMedium concern: worth reading before you install.A zotero:// link can make it run code if you approve a prompt (from zotero-plugin-toolkit)mediumMedium concern: worth reading before you install.Stores API keys or passwordslowLow concern.Runs its own server for programs on this computerlowLow concern.
Where we found it
Signs in using another app's identitycontent/scripts/zoterocopliot.js · line 3641

Signs in as Claude Code, Codex CLI

var OPENAI_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
A zotero:// link (a web page can open one) can make it install add-o…content/scripts/zoterocopliot.js · line 129

zotero://plugin

Services.io.getProtocolHandler("zotero").wrappedJSObject._extensions["zotero://plugin"] = pluginBridgeExtension;
A zotero:// link can make it run code if you approve a promptcontent/scripts/zoterocopliot.js · line 85

zotero://ztoolkit-debug

Services.io.getProtocolHandler("zotero").wrappedJSObject._extensions["zotero://ztoolkit-debug"] = debugBridgeExtension;
Before you installShown, not gradedFacts to help you decide. They don't change the grade.
Works withZotero 7, 8 · not 9, 10, 11 betaDoesn't work with the current Zotero (10)MediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Zotero 7 ✓ worksZotero 8 ✓ worksZotero 9 ✗ doesn't workZotero 10 ✗ doesn't workZotero 11 beta ✗ doesn't work
What you'll needAn API keyDetected automatically from its code
No further detail for this area yet.
MaintenanceSlowing down · last release 4 Mar 20261 contributor
No further detail for this area yet.
LanguagesDocumentation in EnglishInterface: English and Chinese
No further detail for this area yet.
We report what we found in the code. Open any area for the evidence.How we gradeReport a problem

What it does

Description coming soon. We haven't written a summary yet. The line above is the developer's own description; the developer's README is linked above.

What you'll need

Detected automatically
  • An API keyNeeds a key you get from the service (OpenAI, Anthropic and Google AI Studio). What needs it: its AI chat and smart actions need an API key or a ChatGPT/Claude subscription sign-in for the chosen provider.
  • Zotero 7, 8Not working with Zotero 10

Where your data goes

We found: only contacts services we could identify. 8 addresses in 2 groups.

AI services (7)
api.anthropic.comapi.openai.comauth.openai.comnamed in its codechatgpt.comnamed in its codeclaude.ainamed in its codeconsole.anthropic.comgenerativelanguage.googleapis.com
On your computer (1)
localhostnamed in its code
Evidence · file and line
api.anthropic.comcontent/scripts/zoterocopliot.js · line 4259
return authMode === "oauth" ? "https://api.anthropic.com/v1/messages?beta=true" : "https://api.anthropic.com/v1/messages";
api.openai.comcontent/scripts/zoterocopliot.js · line 4235
return authMode === "oauth" ? CODEX_ENDPOINT : "https://api.openai.com/v1/chat/completions";
console.anthropic.comcontent/scripts/zoterocopliot.js · line 3926
var ANTHROPIC_TOKEN_URL = "https://console.anthropic.com/v1/oauth/token";

Forks and alternatives

No forks listed.

Plugins for the same job
  • Add Items from TextAI & summaries · Import & metadataA+Recommended, tested in Zotero
  • MkteroReading & PDFs · Citing & writing · AI & summariesA+Recommended, tested in Zotero
  • Zotero 阅读模式沉浸式双语Reading & PDFs · Translation · AI & summariesA+Recommended, tested in Zotero
  • Zotero 标题翻译Reading & PDFs · Translation · Organising & tags · AI & summariesA+Recommended, tested in Zotero

The developer's response

The developer hasn't responded. Developers can reply here, and their reply sits next to our findings.I'm the developer
Install Zotero Copilot
BUse with care
Before you install: Updates are set to come from an address someone else could control, and 3 more findings.Read the finding
Compare with similar plugins