zotero-mcp

The server runs as a Zotero plugin, leveraging Zotero's internal APIs and environment, which provides some sandboxing. By default, it listens only on the local loopback interface (127.0.0.1:23120), limiting external network attack surface. No explicit 'eval', 'exec', or hardcoded secrets were found in the provided code. Input from AI clients is parsed as JSON-RPC requests and arguments are dispatched to specific handlers. While this structure generally enhances security, it relies on the robustness of Zotero's underlying APIs to prevent injection or unexpected behavior from crafted input. File system access for PDF and attachment processing relies on Zotero's `attachment.getFilePath()` and `IOUtils.read()` which are expected to operate within defined Zotero data paths, mitigating arbitrary file access risks.