Zotero Plugins Atlas
Plugins / AI & summaries

llm-for-zotero

by yilewang · github.com/yilewang/llm-for-zotero

An AI assistant in the reader: chat with a PDF, selection, figures or several papers, with citations that jump to the source passage.

AI & summaries
View source
Downloads a .xpi file (4.4 MB). In Zotero, open Tools → Plugins and install it from the file.
StarsPeople who starred the repository on GitHub: a rough measure of interest.
3,144
DownloadsAll-time downloads of its release files from GitHub. Installs from elsewhere aren't counted.
644,828
ContributorsPeople who have committed code to the repository.
33
LicenceThe licence the code is published under, as GitHub reports it.
AGPL-3.0
C
Atlas gradeNot recommended
because it runs commands its AI assistant writes, with full access to your computer
Applies to v3.9.9, released 20 Sep 2026Code checked · tested installed in Zotero 10.0.3 on 27 Sep 2026
Another plugin uses the same ID9 other plugins share this add-on ID. Zotero can only install one of them.
What we found in the codeSets the gradeThe worst finding in these three areas sets the grade.
Code transparencyReadable code, uploaded by the project's automated GitHub buildThe release file was uploaded by the project's automated GitHub build. We haven't yet rebuilt it from the source to compare.LowLow concern: normal for plugins that do this job. Listed so you know.
Updates
Updates come from this project's GitHub repositoryThe update address offers this version
Where your data goesOnly contacts services we could identify30 addresses in 6 groups.LowLow concern: normal for plugins that do this job. Listed so you know.
AI services (16)
Codex CLI (OpenAI)api.anthropic.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.deepseek.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.githubcopilot.comapi.kimi.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.minimax.ionamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.moonshot.ainamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.openai.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.x.ainamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.xiaomimimo.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.auth.openai.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.chatgpt.comdashscope.aliyuncs.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.generativelanguage.googleapis.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.open.bigmodel.cnnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.opencode.ainamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Scholarly services (7)
api.crossref.orgapi.openalex.orgnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.semanticscholar.orgdoi.orgnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.europepmc.orgnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.export.arxiv.orgwww.ebi.ac.uk
Apps you connect (3)
api.tavily.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.mineru.netnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.mineru.oss-cn-shanghai.aliyuncs.com
Zotero (1)
Zotero lookup services
Code hosting (1)
github.com
On your computer (2)
127.0.0.1localhostnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Where we found it
api.githubcopilot.comcontent/scripts/llmforzotero.js · line 1819
defaultApiBase: "https://api.githubcopilot.com",
chatgpt.comcontent/scripts/llmforzotero.js · line 776
"codex auth usually uses https://chatgpt.com/backend-api/codex/responses": "codex \u8BA4\u8BC1\u901A\u5E38\u4F7F\u7528 https://chatgpt.com/backend-api/codex/responses",
api.crossref.orgcontent/scripts/llmforzotero.js · line 136798
`https://api.crossref.org/works/${encodedDoi}`
Powerful capabilitiesRuns commands its AI assistant writes, with full access to your computer, and 13 moreHighHigh concern: a serious problem. One high finding makes the grade C.
Runs commands its AI assistant writes, with full access to your computerhighHigh concern: a serious problem.Signs in using another app's identitymediumMedium concern: worth reading before you install.Keeps its own tables in Zotero's databasemediumMedium concern: worth reading before you install.Downloads a program and runs itmediumMedium concern: worth reading before you install.A zotero:// link (a web page can open one) can make it install add-ons without asking you (from zotero-plugin-toolkit)mediumMedium concern: worth reading before you install.A zotero:// link can make it run code if you approve a prompt (from zotero-plugin-toolkit)mediumMedium concern: worth reading before you install.Launches programs on your computermediumMedium concern: worth reading before you install.Reuses a sign-in you saved in another programmediumMedium concern: worth reading before you install.Uses the clipboardlowLow concern.Stores API keys or passwordslowLow concern.Runs code it assembles while runninglowLow concern.Works with files on your computerlowLow concern.Other programs on this computer can change your library through itlowLow concern.Lets programs on this computer connect through Zotero's built-in server
Where we found it
Runs commands its AI assistant writes, with full access to your comp…content/scripts/llmforzotero.js · line 125652

It can run without showing you the code first

return new AsyncFunction("Zotero", "env", source);
Signs in using another app's identitycontent/scripts/llmforzotero.js · line 6313

Signs in as Codex CLI, GitHub Copilot for VS Code

CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
Keeps its own tables in Zotero's databasecontent/scripts/llmforzotero.js · line 7714

Tables: llm_for_zotero_agent_coverage, llm_for_zotero_agent_run_events, llm_for_zotero_attachment_refs, llm_for_zotero_claude_conversations, llm_for_zotero_conversation_fork_links and 4 more

await db.queryAsync(
Downloads a program and runs itcontent/scripts/llmforzotero.js · line 64199

The first time you ask about a figure, it downloads a 265–491 MB bundle of Python and the Poppler PDF tools from the developer's GitHub release and runs it, without asking. The README doesn't mention it, and the download isn't checked against a fingerprint. We checked the macOS (Apple silicon) bundle: every file is standard software from conda-forge.

const response = await fetcher(url);
A zotero:// link (a web page can open one) can make it install add-o…content/scripts/llmforzotero.js · line 261758

zotero://plugin

Services.io.getProtocolHandler("zotero").wrappedJSObject._extensions["zotero://plugin"] = pluginBridgeExtension;
A zotero:// link can make it run code if you approve a promptcontent/scripts/llmforzotero.js · line 261714

zotero://ztoolkit-debug

Services.io.getProtocolHandler("zotero").wrappedJSObject._extensions["zotero://ztoolkit-debug"] = debugBridgeExtension;
Launches programs on your computercontent/scripts/llmforzotero.js · line 33842

Programs it names include curl; a setting lets Claude Code and Codex CLI run without asking

if (!Subprocess?.call) return void 0;
Reuses a sign-in you saved in another programcontent/scripts/llmforzotero.js · line 6103

Reuses the sign-in you saved in Codex CLI

return joinLocalPath(resolveHomeDir(), ".codex", "auth.json");
Before you installShown, not gradedFacts to help you decide. They don't change the grade.
Works withZotero 7, 8, 9, 10, 11 betaUpdates automatically
Zotero 7 ✓ worksZotero 8 ✓ worksZotero 9 ✓ worksZotero 10 ✓ worksZotero 11 beta ✓ works
What you'll needAn API key for some featuresDetected automatically from its code
No further detail for this area yet.
MaintenanceActive · last release 20 Sep 202633 contributors
No further detail for this area yet.
LanguagesDocumentation in EnglishInterface: English and Chinese
No further detail for this area yet.
We report what we found in the code. Open any area for the evidence.How we gradeReport a problem

What it does

Written by AI from the README

An AI assistant in the reader: chat with a PDF, selection, figures or several papers, with citations that jump to the source passage. Saves answers to notes or Markdown; agent mode can search, tag and organize the library. Works with API keys, local models, ChatGPT, Codex or Claude Code.

Asking an LLM about a paper usually means uploading it to a chat site and losing the link to the source. This keeps answers grounded in your library and saves them there.

What you'll need

Detected automatically
  • An API key for some featuresWorks without one: local OpenAI-compatible models, WebChat (ChatGPT web sync) and Codex App Server, which use no provider API key. Needs a key (OpenAI, Anthropic and DeepSeek): standard API providers need your own API key.
  • Or: a model on your own computerIt can use a local model such as Ollama

Where your data goes

We found: only contacts services we could identify. 30 addresses in 6 groups.

AI services (16)
Codex CLI (OpenAI)api.anthropic.comnamed in its codeapi.deepseek.comnamed in its codeapi.githubcopilot.comapi.kimi.comnamed in its codeapi.minimax.ionamed in its codeapi.moonshot.ainamed in its codeapi.openai.comnamed in its codeapi.x.ainamed in its codeapi.xiaomimimo.comnamed in its codeauth.openai.comnamed in its codechatgpt.comdashscope.aliyuncs.comnamed in its codegenerativelanguage.googleapis.comnamed in its codeopen.bigmodel.cnnamed in its codeopencode.ainamed in its code
Scholarly services (7)
api.crossref.orgapi.openalex.orgnamed in its codeapi.semanticscholar.orgdoi.orgnamed in its codeeuropepmc.orgnamed in its codeexport.arxiv.orgwww.ebi.ac.uk
Apps you connect (3)
api.tavily.comnamed in its codemineru.netnamed in its codemineru.oss-cn-shanghai.aliyuncs.com
Zotero (1)
Zotero lookup services
Code hosting (1)
github.com
On your computer (2)
127.0.0.1localhostnamed in its code
Evidence · file and line
api.githubcopilot.comcontent/scripts/llmforzotero.js · line 1819
defaultApiBase: "https://api.githubcopilot.com",
chatgpt.comcontent/scripts/llmforzotero.js · line 776
"codex auth usually uses https://chatgpt.com/backend-api/codex/responses": "codex \u8BA4\u8BC1\u901A\u5E38\u4F7F\u7528 https://chatgpt.com/backend-api/codex/responses",
api.crossref.orgcontent/scripts/llmforzotero.js · line 136798
`https://api.crossref.org/works/${encodedDoi}`

Forks and alternatives

9 other plugins use the same ID as this one. Every Zotero plugin carries an ID, a name tag Zotero uses to tell plugins apart. These 10 plugins carry the same one, because people copied llm-for-zotero to make their own versions and kept its ID.Show what this means
  • You can only have one. Zotero sees them as the same plugin.
  • Installing another replaces it. If you install one of the others, it takes this one's place.
  • Check what you install. Several share this plugin's name, so make sure the file comes from the one you meant.
llm-for-zotero · this pluginyilewang/llm-for-zoteroCNot recommended644,82820 Sep 2026
llm-for-zoteroCopy · ivorpad/llm-for-zoteroCNot recommended116 Sep 2026
See all 10 and how they differ →

10 listed forks.

Plugins for the same job
  • Add Items from TextAI & summaries · Import & metadataA+Recommended, tested in Zotero
  • MkteroReading & PDFs · Citing & writing · AI & summariesA+Recommended, tested in Zotero
  • Zotero 阅读模式沉浸式双语Reading & PDFs · Translation · AI & summariesA+Recommended, tested in Zotero
  • Zotero 标题翻译Reading & PDFs · Translation · Organising & tags · AI & summariesA+Recommended, tested in Zotero

The developer's response

The developer hasn't responded. Developers can reply here, and their reply sits next to our findings.I'm the developer
Install llm-for-zotero
CNot recommended
We don't recommend itIt runs commands its AI assistant writes, with full access to your computer.
Better-graded plugins for the same jobA+Add Items from TextA+MkteroA+Zotero 阅读模式沉浸式双语
Read what we found