zotero-mcp

The server component runs as an integrated Zotero plugin, enhancing its security posture by operating within Zotero's sandbox. By default, it is configured to listen only on 127.0.0.1 (localhost), preventing external access unless explicitly allowed by the user. No direct `eval()` calls or hardcoded secrets are evident in the provided source code. API keys for external embedding services are stored securely within Zotero's preferences rather than being hardcoded or exposed as environment variables on the server side. Potential risks include vulnerabilities in Zotero's internal APIs (outside this project's scope) or in the client-side `mcp-remote` dependency (which is a client-side tool, not the server itself).