
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
zotero-bridge
Advanced tools
Agent-friendly CLI for Zotero via JS Bridge. Clean JSON, always.
A thin Node.js CLI that talks directly to Zotero's JS Bridge plugin endpoint. Designed for AI agents (Claude, GPT, Gemini, etc.) that need reliable, structured access to Zotero libraries.
Existing Zotero CLI tools produce inconsistent output (NDJSON, mixed formats), have poor error messages, and break in agent workflows. zotero-bridge fixes this:
{"error": "...", "hint": "..."} tells agents what went wrong and how to fix itcommander).xpi from cli-anything-zotero via zotero-cli app install-plugin, or manuallynpm install -g zotero-bridge
zotero-bridge ping Check Zotero connection
zotero-bridge search <query> Search items by title
zotero-bridge search-fulltext <query> Search PDF full text
zotero-bridge item <key> Get full item metadata
zotero-bridge read <key> Extract PDF full text
zotero-bridge tags <key> List tags on an item
zotero-bridge tag-add <key> <tags...> Add tags
zotero-bridge tag-rm <key> <tags...> Remove tags
zotero-bridge annotations <key> Read PDF annotations
zotero-bridge import-doi <doi> Import paper by DOI
zotero-bridge collections Show collection tree
zotero-bridge collection-items <key> List items in collection
zotero-bridge collection-create <name> Create collection
zotero-bridge find-pdf <key> Trigger PDF download
zotero-bridge note <key> <text> Add child note
zotero-bridge vocab Show tag vocabulary
zotero-bridge sync Trigger Zotero sync
zotero-bridge js <code> Execute raw JavaScript
Run zotero-bridge help <command> for detailed usage and examples.
zotero-bridge (Node.js CLI)
↓ HTTP POST text/plain → localhost:23119/cli-bridge/eval
CLI Bridge plugin (.xpi in Zotero)
↓ eval() in Zotero's privileged JS context
Zotero database
The CLI sends JavaScript code to Zotero's JS Bridge endpoint and parses the JSON response. All Zotero API operations happen inside Zotero itself — the CLI is a thin transport layer.
MIT
FAQs
Agent-friendly CLI for Zotero via JS Bridge. Clean JSON, always.
We found that zotero-bridge demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.