Downloads a .xpi file (3.3 MB). In Zotero, open Tools → Plugins and install it from the file.
StarsPeople who starred the repository on GitHub: a rough measure of interest.
5
DownloadsAll-time downloads of its release files from GitHub. Installs from elsewhere aren't counted.
149
ContributorsPeople who have committed code to the repository.
2
LicenceThe licence the code is published under, as GitHub reports it.
AGPL-3.0
B
Atlas gradeUse with care
A+ABBC
because it downloads a program and runs it, and 1 more finding
Next rung: A, once every finding in the code comes out low.
Applies to v0.8.0, released 30 Jul 2026Code checked · tested installed in Zotero 9.0.6 on 27 Sep 2026
Doesn't work with the current Zotero (10)Works with Zotero 9.
What we found in the codeSets the gradeThe worst finding in these three areas sets the grade.
Code transparencyReadable code, uploaded by the project's automated GitHub buildThe release file was uploaded by the project's automated GitHub build. We haven't yet rebuilt it from the source to compare.LowLow concern: normal for plugins that do this job. Listed so you know.
Updates
Updates come from this project's GitHub repositoryThe update address offers this version
Where your data goesOnly contacts services we could identify12 addresses in 3 groups.LowLow concern: normal for plugins that do this job. Listed so you know.
AI services (10)
Codex CLI (OpenAI)api.deepseek.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.minimaxi.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.moonshot.cnnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.openai.comapi.xiaomimimo.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.api.z.ainamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.auth.openai.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.dashscope.aliyuncs.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.openrouter.ainamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Code hosting (1)
github.com
On your computer (1)
127.0.0.1
Where we found it
api.openai.comcontent/scripts/byok-runtime.cjs · line 78802
Powerful capabilitiesDownloads a program and runs it, and 6 moreMediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Downloads a program and runs itmediumMedium concern: worth reading before you install.Launches programs on your computermediumMedium concern: worth reading before you install.Uses the clipboardlowLow concern.Stores API keys or passwordslowLow concern.Works with files on your computerlowLow concern.Keeps its own database filelowLow concern.Lets programs on this computer connect through Zotero's built-in server
Where we found it
Downloads a program and runs itcontent/scripts/zopilot.js · line 810
When you press Install under Dependencies in its settings, it downloads a 97–128 MB PDF helper program from the developer's GitHub release and runs it. The file is checked only against a checksum from the same place, and we can't read the program itself.
Before you installShown, not gradedFacts to help you decide. They don't change the grade.
Works withZotero 9 · not 10, 11 betaDoesn't work with the current Zotero (10)MediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Description coming soon. We haven't written a summary yet. The line above is the developer's own description; the developer's README is linked above.
What you'll need
Detected automatically
Zotero 9Not working with Zotero 10
Where your data goes
We found: only contacts services we could identify. 12 addresses in 3 groups.
AI services (10)
Codex CLI (OpenAI)api.deepseek.comnamed in its codeapi.minimaxi.comnamed in its codeapi.moonshot.cnnamed in its codeapi.openai.comapi.xiaomimimo.comnamed in its codeapi.z.ainamed in its codeauth.openai.comnamed in its codedashscope.aliyuncs.comnamed in its codeopenrouter.ainamed in its code
Code hosting (1)
github.com
On your computer (1)
127.0.0.1
Evidence · file and line
api.openai.comcontent/scripts/byok-runtime.cjs · line 78802