
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
uv add pyzotero or pip install pyzotero or conda install conda-forge::pyzoteroYour userID for use in API callshttps://www.zotero.org/groups/groupname, and hovering over the group settings link. The ID is the integer after /groups/library_type is 'user'library_type is 'group'.Then:
from pyzotero import zotero
zot = zotero.Zotero(library_id, library_type, api_key) # local=True for read access to local Zotero
items = zot.top(limit=5)
# we've retrieved the latest five top-level items in our library
# we can print each item's item type and ID
for item in items:
print(f"Item: {item['data']['itemType']} | Key: {item['data']['key']}")
Full documentation of available Pyzotero methods, code examples, and sample output is available on Read The Docs.
Pyzotero includes an optional command-line interface for searching and querying your local Zotero library. The CLI must be installed separately (see Installation).
The CLI connects to your local Zotero installation and allows you to search your library, list collections, and view item types:
# Search for top-level items
pyzotero search -q "machine learning"
# Search with full-text mode
pyzotero search -q "climate change" --fulltext
# Filter by item type
pyzotero search -q "methodology" --itemtype book --itemtype journalArticle
# Search for top-level items within a collection
pyzotero search --collection ABC123 -q "test"
# Output as JSON for machine processing
pyzotero search -q "climate" --json
# List all collections
pyzotero listcollections
# List available item types
pyzotero itemtypes
By default, pyzotero search searches only top-level item titles and metadata fields.
When the --fulltext flag is used, the search expands to include all full-text indexed content, including PDFs and other attachments. Since most full-text content comes from PDF attachments rather than top-level items, the CLI automatically retrieves the parent bibliographic items for any matching attachments. This ensures you receive useful bibliographic records (journal articles, books, etc.) rather than raw attachment items.
By default, the CLI outputs human-readable text with a subset of metadata including:
Use the --json flag to output structured JSON.
uv add pyzoteropip install pyzoteroconda install conda-forge::pyzoteroPyzotero includes an optional command-line interface for searching and querying your local Zotero library. As it uses the local API server introduced in Zotero 7, it requires "Allow other applications on this computer to communicate with Zotero" to be enabled in Zotero's Settings > Advanced.
To install Pyzotero with the CLI:
If you just want to use the CLI without permanently installing Pyzotero, you can run it directly:
uvx --from "pyzotero[cli]" pyzotero search -q "your query"pipx run --spec "pyzotero[cli]" pyzotero search -q "your query"See the Command-Line Interface section below for usage details.
Example:
git clone git://github.com/urschrei/pyzotero.git
cd pyzotero
git checkout main
# specify --dev if you're planning on running tests
uv sync
Run pytest . from the top-level directory. This requires the dev dependency group to be installed: uv sync --dev / pip install --group dev
The latest commits can be found on the main branch, although new features are currently rare. If you encounter an error, please open an issue.
Pull requests are welcomed. Please read the contribution guidelines. In particular, please base your PR on the main branch.
As of v1.0.0, Pyzotero is versioned according to Semver; version increments are performed as follows:
Pyzotero has a DOI:
You may also cite Pyzotero using CITATION.cff.
A sample citation (APA 6th edition) might look like:
Stephan Hügel, The Pyzotero Authors (2019, May 18). urschrei/pyzotero: Version v1.3.15. http://doi.org/10.5281/zenodo.2917290
Pyzotero is licensed under the Blue Oak Model Licence 1.0.0. See LICENSE.md for details.
† This isn't strictly true: you only need an API key for personal libraries and non-public group libraries.
FAQs
Python wrapper for the Zotero API
We found that pyzotero demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.