A plugin for Zotero 7 and later

The plugin directory, inside Zotero.

Zotero Atlas finds and installs plugins from zoteroplugins.org without leaving Zotero, installs exactly the file the directory checked, and keeps watching the plugins you have. Free, open source, and graded by the same rules as every other plugin.

Download the latest release Its card on zoteroplugins.org

Zotero 7 to 11MIT licenceReproducible buildNothing sent unless you say so

Download the .xpi file, then in Zotero open Tools → Plugins, click the gear and choose Install Plugin From File. Afterwards it lives under Tools → Zotero Atlas.

What it does

Find

Lists every plugin in the directory, about 1,500 of them, filtered to your Zotero version by default, with each plugin's grade and the one line that explains it. Search, or pick a job: reading, citing, AI, translation, organising, metadata, interface, files.

Install the file that was checked

Install hands the release file to Zotero's own installer together with the SHA-256 of the file the directory analysed. Zotero refuses the file if it doesn't match, so what you get is exactly what the card describes. A file nobody has analysed can't be installed from here.

Watch what you have

Once a day it compares your installed plugins with the directory and tells you when one drops a grade, when the update Zotero would apply is graded worse than what you have, when Zotero's blocklist blocks it, or when it has stopped working with your Zotero. Where a cleaner version is listed, it offers it.

Why we built it

Zotero has no plugin store. People find plugins through a wiki page, forum threads and GitHub, and install files they have no way to check. Most plugins are fine. Some ask for far more than they need, some quietly send data to servers nobody mentioned, and a plugin that was fine when you installed it can change hands or change behaviour in an update you never read.

zoteroplugins.org already reads every plugin's latest release and gives it one grade, with the findings in plain language. But a grade on a website helps only at the moment you look. Atlas puts the same grades where the decisions happen: when you choose a plugin, when you install it, and every day after, when an update arrives that you didn't ask to see.

We would rather people got their plugins from somewhere that checks them than from a link in a forum thread. That is the whole idea.

What we hold to

Nothing about you

It never sends your library, notes, files, Zotero account, email or anything that identifies you. There is no account, no sign-in, and no identifier that could be tied back to a person.

Opt in, off by default

The only thing it can ever send is your list of installed plugins, and only if you choose "Send my plugin list". The default answer is "Don't send". Change your mind later and it asks the server to delete the record.

Install what was checked, not what's there today

Every install carries the hash of the file the directory analysed. If the file at the address has changed since, Zotero refuses it. That closes the gap between "we read this" and "you installed that".

The same rules as everyone

Atlas is listed and graded on zoteroplugins.org by the same pipeline as the other plugins. Nothing on its card is edited by hand, and the card says who makes it. See its grade below.

Nothing hidden

The plugin is a few plain JavaScript files zipped as they are, with nothing compiled or bundled. Anyone can rebuild it byte for byte from the tagged source, and each release carries GitHub's build attestation. The server's code is public too.

Public totals

Whatever people choose to send is published as counts: how many installs reported, and how many have each plugin. Everyone can see which plugins people actually use, and nobody can see who.

Its own grade: B

Set by the directory's pipeline, not by us

Use with care

Read why before installing

A+ABC

On zoteroplugins.org, Zotero Atlas is graded B. Two findings put it there, and both are the point of the plugin:

mediumSends usage data to zoteroatlas.com. Under the directory's rules, a plugin that can send usage data to its developer's server rates "medium", whether the sending is opt-in or not. Atlas can, so it does.

mediumInstalls other add-ons. Installing software is a powerful capability, and the rules rate it medium however carefully it is done: here from a hash-checked catalogue, after asking you.

lowEverything else came out low: readable code uploaded by the project's own GitHub build, updates from the project's repository, no credentials stored, and it works with the current Zotero.

An A would need both findings gone, which means a plugin that neither installs anything nor can report anything. We would rather say plainly what it does and take the B. It is the grade we would give anyone else with the same code.

We did not bend the rules for ourselves. The grade is computed by the same pipeline, from the same release file, with the same thresholds as the other plugins, and the card carries a note that the directory's own team makes it. If a rule ever changes, the change applies to every plugin and shows up in the public grade log. The card also notes that Atlas hasn't yet been through the directory's live test in a running Zotero; that test is what separates A+ from A, and doesn't change a B.

What it sends, and what it never sends

Full privacy page →

It never sends your library, notes, files, Zotero account, email or anything that identifies you.

The one thing it can send, if you say so

Your list of installed plugins, with versions and whether each is enabled, under a random ID made on your computer, plus your Zotero version, operating system and the plugin's version. It goes to zoteroatlas.com when you turn it on, when the list changes, and once a week. This is the whole message:

{
  "id": "4c9d3b2e-…",          random, made on your computer
  "atlas": "0.1.0",
  "zotero": "7.0.32",
  "os": "mac",
  "event": "weekly",
  "plugins": [
    { "id": "zoterostyle@polygon.org", "version": "5.0.0", "enabled": true },
    …
  ]
}

Whatever you choose

It fetches the directory's catalogue once a day from GitHub, the directory's public repository. No account, no identifier.
When you click Install, Zotero downloads the plugin file from GitHub, as it would for any plugin.
Nothing else is contacted. The server keeps no IP address and no user agent, and deletes an install not heard from in 180 days.
"Show what would be sent" in Zotero's settings shows your exact message. Uninstalling removes everything the plugin stored.

Check what you install

Unzip and compare

The .xpi is a zip of the files in the repository's src/ folder, unchanged. Rename it to .zip if your computer won't open it and compare with the tagged source.

Rebuild it

python3 build.py on the tagged commit makes a byte-identical file on any system. Compare its SHA-256 with the download's.

Check where it was built

Each release is built by the public release workflow from the tagged commit and carries GitHub's attestation: gh attestation verify <file> --repo iliasbeshimov/zotero-atlas.