
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@docsagent/mcp-zotero
Advanced tools
DocsAgent MCP shell for Zotero — spec-driven MCP server over a resident C++ search core (stdio + Streamable HTTP)
@docsagent/mcp-zotero is a spec-driven MCP (Model Context Protocol) server that lets any
AI agent — Claude Desktop, Cursor, Cline, Qwen Code, or any MCP client — search, read, and write
your Zotero library through a resident C++ search engine. Local-first RAG infrastructure
for your papers: BM25 full-text search + query-ranked passage retrieval over 1,000+ PDFs with
~15 ms average retrieval latency.
zotero.sqlite and storage/ directly on your
machine. Your PDFs never leave it./health probe).MCP Client (Claude Desktop / Cursor / Cline / Qwen Code / any MCP host)
│ stdio (local) or Streamable HTTP /mcp (remote)
▼
MCP shell ← this package (@docsagent/mcp-zotero / docsagent-mcp-zotero)
· tool schemas (spec-driven), argument validation, token budget, dedup
· write orchestration via the Zotero local API, write safety gate, RBAC
· group-library sync via the Zotero Web API
│ JSON-RPC 2.0 over HTTP ({coreHost}:{httpPort}/rpc, cpp-httplib)
▼
DocsAgent Core (resident C++ engine, papersgpt-agent)
· reads ~/Zotero/zotero.sqlite + storage/ directly on your machine
· builds & serves the full-text index (BM25 + passage ranking)
The shell never spawns the core during tool calls and never touches your Zotero files. The core runs as a background service and stays available across MCP client restarts. Full design: DESIGN.md. Tool schemas and error codes: spec/.
npx @docsagent/mcp-zotero start # spawn the bundled core for your platform
npx @docsagent/mcp-zotero status # pid / endpoint / version
Python shell (same verbs, under the core subcommand):
pip install ./python # build the wheel locally (PyPI upload pending)
docsagent-mcp-zotero core start
(core stop / core restart also available. The core reads your Zotero data directory,
builds the full-text index, and serves JSON-RPC on http://0.0.0.0:23120/rpc.)
Claude Desktop / Cursor / Cline / Qwen Code (mcpServers):
{
"mcpServers": {
"docsagent-zotero": {
"command": "npx",
"args": ["-y", "@docsagent/mcp-zotero"]
}
}
}
Python distribution channel (same tools, same contract, installed from this repo):
pip install ./python # wheel ships all-platform core binaries
docsagent-mcp-zotero core start # same lifecycle CLI as the JS shell
docsagent-mcp-zotero # stdio MCP server
On startup the shell connects to the core, loads sources, and checks index status. If the core is not running it fails fast with startup instructions — it never spawns anything.
8 tools, 5 read + 3 write. Schemas are the single-sourced contract in
spec/tools/*.json (mirrored into both packages); arguments are validated
before handlers run and failures map to typed docsagent error codes.
list_sourcesEvery searchable source with capabilities, supported targets/includes/browse modes, filters, and document counts. Call this first.
searchCross-entry search over the whole library.
| Parameter | Type | Notes |
|---|---|---|
query | string, required | plain keywords or phrases |
target | "items" | "annotations" | "notes" or array | default items |
depth | ids | snippets | full | snippets by default (BM25-ranked passages) |
filters | object | tags, yearFrom/yearTo, itemType, authors, colors, containerId, titleContains |
k, snippetsPerResult, max_tokens | numbers | ranking depth and token budget |
Returns results[] with global ids (zotero:KEY), titles, relevance, snippets; multi-target
searches group by target. Results are deduped (id, then normalized title + year) and packed
under a token budget.
get_contentRead one entry. mode=passages (query-ranked passages, k) or mode=fulltext
(offset pagination with nextOffset). Notes return their body with tags and metadata.
get_metadatainclude: metadata, abstract, annotations, notes, citation (bibtex / csljson /
formatted via citationFormat/citationStyle). Notes are packed under the token budget.
list_libraryBrowse modes: collections (drill-down via parentId), items (by containerId),
tags, saved_searches, standalone_notes.
| Tool | What it does | Key arguments |
|---|---|---|
import_item | Import local PDFs or resolve DOI / ISBN / arXiv IDs (via the Zotero translation server); optional autoClassify suggests collections | paths | identifiers, containerId, autoClassify, confirmed |
add_note | Add a Markdown child note to an item (converted to Zotero note HTML), with orphan verification and rollback | id, content, tags, confirmed |
batch_modify | Bulk add_to_collection / remove_from_collection / add_tags / remove_tags on up to 200 items in batches of 50 | action, ids, containerId, tags, confirmed |
Write safety gate (spec/algorithms/write-gate.md): layer 1 write tools are not
registered unless enableWrites=true; layer 2 confirmed=false returns a preview and
consumes no rate-limit quota; layer 3 confirmed writes consume a per-hour rate limit
(default 30/h). Anything above 20 items in batch_modify additionally reports
requiresConfirmation in the preview.
The C++ engine powers PapersGPT — the same index and retrieval stack ships in this MCP server. Benchmark on a real Zotero installation (full write-up):
| Metric | Mac (Intel i9) | Windows VM (4C8G) |
|---|---|---|
| Library size | 1,506 PDFs (4.5 GB on disk) | 500+ PDFs |
| Index build time | 141 s | a few seconds |
| Memory (agent process) | 227 MB | 160 MB |
| Average retrieval latency | ~15 ms | ~15 ms |
Config lives at ~/.docsagent/config.json (or $DOCSAGENT_CONFIG) — one file shared by
the JS shell, the Python wrapper, and the C++ core. Validated against
spec/config.json.
| Key | Default | Description |
|---|---|---|
coreHost | 0.0.0.0 | Address the core binds and the shell dials |
httpPort | 23120 | Core HTTP port (POST /rpc) |
coreBinary | "" | Optional explicit path to the core binary |
zoteroDataDir | ~/Zotero | Zotero data directory |
zoteroApiUrl | http://localhost:23119/api | Zotero local API (write orchestration) |
zoteroGroups | [] | Group libraries to sync from zotero.org |
enableWrites | false | Register the three write tools |
writeRateLimitPerHour | 30 | Confirmed-write rate limit |
maxTokensPerTool | 4000 | Token budget per tool result |
defaultSource | zotero | Source used when an id omits the prefix |
transport | stdio | stdio or streamable-http |
httpListenAddr | 0.0.0.0:8080 | Listen address for streamable-http (/mcp) |
authMode / authConfig | none | api-key or oauth2 (RFC 7662) + allowedOrigins |
rbacRoles | {} | role → allowed tool names (per-request RBAC on HTTP) |
logLevel | info | debug / info / warn / error |
| Channel | Package | Bundled core | Size |
|---|---|---|---|
| npm (JS/TS shell) | @docsagent/mcp-zotero | all platforms in bin/ | ~70 MB tarball |
| PyPI (Python shell) | docsagent-mcp-zotero (pip install ./python) | same binaries in the wheel | ~65 MB wheel |
Both shells read the same config and talk to the same core — pick either (or both) as
your MCP distribution channel. Core lifecycle (start / stop / restart / status)
is available from both CLIs.
Apache-2.0
FAQs
DocsAgent MCP shell for Zotero — spec-driven MCP server over a resident C++ search core (stdio + Streamable HTTP)
The npm package @docsagent/mcp-zotero receives a total of 300 weekly downloads. As such, @docsagent/mcp-zotero popularity was classified as not popular.
We found that @docsagent/mcp-zotero demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.