Eight built-in skills make Zotero the working surface
llm-for-zotero keeps paper work inside the reference manager. Its 8 built-in skills cover paper questions, evidence retrieval, figure analysis, comparisons, library analysis, literature reviews, note writing, and cited-reference import. Answers can point back to source passages, while selected text, screenshots, and as many as 10 uploaded files can join a conversation.
Agent Mode broadens the scope from reading to library maintenance. It can search items, use CrossRef or Semantic Scholar, edit notes, apply tags, update metadata, manage collections, import identifiers, and trash items. Recent write actions have session recovery records, with the last 10 entries retained for undo. That range saves switching between tools, but it also means permission choices matter. A researcher should try read-only questions before allowing changes on the library used for daily work.
What happened when we ran it
Our sandbox installed commit 26729c4 in 32 seconds. npm added 432 packages and occupied 350 MB, then the build succeeded in 26 seconds. The checkout itself held 1,403 files, about 566,851 lines of source, and used 96.5 MB. Five CI workflow files and a tests directory were present, while no Dockerfile was found. Those figures describe the development checkout, not the much simpler act of installing the published .xpi in Zotero.
The test command failed after 65 seconds with exit code 1. Mocha reported 5,357 passing tests, 1 failing test out of 5,358, and 1 pending test. The failed check was named does not introduce cycles outside the current allowlist; it exceeded a 2,000 ms timeout in test/importCycles.test.ts. The log does not say whether the test is slow, flaky, or exposing a code problem, so none of those explanations should be assumed.
Our npm audit also found 19 known vulnerabilities: 10 high, 7 moderate, 2 low, and 0 critical. That result is too material to hide behind the mostly passing suite. Before using this code in a managed environment, inspect the affected dependency paths and decide whether the deployed .xpi includes them. The lab result establishes the installed development tree's audit state; it does not prove that any specific finding is remotely exploitable through Zotero.
Zotero 7 through 9 get several different model routes
The README targets Zotero 7, 8, and 9 and offers several ways to obtain model output. Standard mode takes an API base URL, secret, and model name. A local OpenAI-compatible server can keep model calls on the machine. ChatGPT Plus users can connect through the Codex App Server, while WebChat relays through a Chromium extension and an open browser tab. Claude Code uses a separate bridge listening on port 19787.
These routes do not have identical capabilities. Tavily search belongs to compatible in-plugin Agent conversations, not WebChat, Codex App Server, or Claude Code. The two coding-agent modes are mutually exclusive in settings. Open issue 444 reports that v3.9.6 with an API-key-authenticated Codex App Server passed its connection test but failed a normal paper question when an auxiliary step sought legacy OAuth credentials. Issue 427 reports a different provider boundary: Anthropic rejected a top-level tool schema in v3.9.5.
MinerU improves difficult PDFs at the cost of another service
MinerU is optional parsing for tables, equations, figures, and complex layouts. Cloud mode sends PDFs to MinerU, while local mode calls a mineru-api server, normally on port 8000. The default bulk filter skips PDFs over 100 pages, which avoids parsing every large attachment blindly.
Local processing still needs model downloads and compute. The documented pipeline backend is CPU-friendly; the VLM and hybrid choices require local compute, with VLM explicitly requiring a GPU. A health response only proves the server process answers, not that models are warm. Pause also stops the plugin queue without cancelling work already running on the MinerU server, because its API exposes no cancel endpoint. Anyone adopting local parsing should plan process supervision separately from Zotero.
Version 3.9.6 gives external MCP clients meaningful write power
The MCP endpoint can expose Zotero to assistants outside the plugin. Version 3.9.6 allows external writes when the owner enables them, including metadata changes, imports, deletion, and Zotero scripts. The README is unusually direct about the trust boundary: any client holding the connection credential receives that authority, and Zotero does not add a second Original Agent permission prompt. Returned action IDs matter for recovery, especially after a timeout whose outcome is uncertain.
Read access has rough edges too. Issue 423 reports that v3.9.5 on Windows exposed 17 MCP tools but failed library-scoped calls when libraryID was omitted, even with the personal library selected. Passing libraryID: 1 fixed the reporter's calls. That issue does not establish behavior on every platform or v3.9.6, but it gives MCP users a precise compatibility check: list tools, call a library read with an explicit ID, then verify write behavior on disposable records.
A September 9 push and 163 issues and PRs show active change
GitHub recorded 2,946 stars, a September 9, 2026 push, and 163 open issues and pull requests. Release v3.9.6 arrived the same day. The latest release added permission modes, a beta planning workflow, an immersive reading window, navigation for long conversations, and external MCP write access. It also tells Claude bridge users to update the companion adapter.
The pace is encouraging for people who like testing new research workflows, yet it raises the cost of pinning a dependable lab setup. Our 5,357 passing tests supply real confidence, while the single timeout, 19 audit findings, and same-day provider report keep the maturity score at 3. Adopt it first as a reading assistant, back up the Zotero library, pin the plugin and bridge versions together, and expand permissions only after the exact model path completes representative paper and write tasks.