Introduction¶

When writing literature reviews or doing literature-based Q&A in dsh, common practices are manually copying bibliographic entries or dropping PDFs into the conversation. Zotero already has collections, attachments, and full text, yet they are disconnected from the conversation draft; if you want the model to search the library, you have to configure MCP separately and worry about tool-name conflicts and permission boundaries. The following introduces the community plugin dsh-plugin-zotero (maintainer peijiping), which is built on cordis. It uses two channels — “a human-side read-only panel + a model-side self-held MCP bridge” — to connect the local Zotero to dsh, with separated responsibilities and no mutual dependency.

What This Is¶

dsh-plugin-zotero is a client-type plugin for dsh: it provides a “Zotero Library” panel in the right sidebar and reads the Zotero local API through the /dsh-zotero/api/* endpoints self-registered by the host web server; meanwhile, the plugin itself connects to the local Zotero integrated MCP, registers the tools with the model as mcp__zotero__*, and supports toggling tools individually on the plugin page. The panel remains usable even when MCP is not running; the model-side tools are naturally unavailable when Zotero is not running. The current npm package version is 0.1.2, licensed under MIT, with about 6 stars on GitHub. For categorization and index, see the SkillHub catalog page; for source code and documentation, see the GitHub repository.

Core Features¶

Human Side: Right Sidebar Read-Only Panel¶

The panel consists of three parts (the repository README includes screenshots):

• Top status bar: shows whether Zotero is connected and whether model tools are available, and provides a refresh action.
• Left category tree: browse Zotero categories level by level, with search by title / abstract.
• Right details: displays entry metadata, attachments, and full text.

There are three ways to insert content into the current conversation draft; none of them auto-send or steal focus, and the inserted text carries itemKey / collectionKey so the model can continue working with it:

1. Single-entry citation (“Add entry citation”).
2. Full-text selection excerpt.
3. Whole-collection citation.

The panel is strictly read-only: it provides no write-operation buttons such as creating, renaming, or deleting collections.

Model Side: Integrated MCP and Tool Toggles¶

The plugin connects directly to the local Zotero integrated MCP via mcp-bridge (default http://127.0.0.1:23120/mcp), and registers tools after filtering according to disabledMcpTools in the configuration. The README notes: the tested integrated MCP version zotero-integrated-mcp v1.1.0 exposes about 20 tools, of which 5 change the library structure (such as create_collection, delete_collection, etc.). If you want the model side to be as read-only as possible, you can toggle off the corresponding tools in the “MCP Tools” section on the plugin page and save; the panel functionality is unaffected.

The host side has a trust fence for /dsh-zotero/api/*: it only accepts GET, rejects cross-site sec-fetch-site, and requires Host to be a loopback address, in order to reduce DNS rebinding risk.

Installation and Enablement¶

Requirements¶

• dsh version satisfies >=0.2.0-rc.2 <0.3.0-0 (engines.dsh in package.json).
• Zotero desktop is running with the local API enabled (see “Zotero Local API” below).
• (Optional) A local Zotero integrated MCP listening on 23120, for use by model-side tools.

When installed from npm, the package contains prebuilt artifacts (lib/ + client/client.js); no build scripts are executed, so no allowBuilds authorization is needed.

Installation Commands¶

# 从 npm（推荐）
dsh plugin --profile <profile> add dsh-plugin-zotero

You can also install it via a marketplace index source on the dsh plugin page (README example index: https://awesome-dsh-plugin.com/index.json).

After installation, start dsh with the corresponding profile and open the web address printed in the terminal in a browser (the profile default is usually http://127.0.0.1:3080, subject to actual configuration).

Enabling the Zotero Local API¶

1. Open Zotero → Settings → Advanced.
2. Check “Allow other applications on this computer to communicate with Zotero” (default port 23119, loopback-only listening).

Verify:

curl http://127.0.0.1:23119/api/

Expected output: Zotero is running. When the option is unchecked, read endpoints may return 403, and the panel will show “Zotero not connected” and prompt the enabling steps.

Plugin Page Configuration¶

In the “Plugins” panel at the top of dsh, expand dsh-plugin-zotero and click “Configure dsh-plugin-zotero”. The main fields are as follows (saved to ~/.dsh/profiles/<profile>/cordis.patch.yml, effective without restarting):

API Settings

MCP Settings

The “MCP Tools” section allows per-tool toggling; after turning one off and saving, the model side no longer registers that tool.

Typical Usage¶

1. Browse and cite: open “Zotero Library” in the right sidebar → select an entry in the category tree or search → use “Add entry citation” or a text-selection excerpt in the details area → content enters the current conversation draft, which you then edit or send yourself.
2. Whole-collection citation: perform a whole-collection citation on a category, writing collection-structure-related information into the draft, making it easier for the model to continue searching or summarizing by collectionKey.
3. Model search and close reading: confirm the integrated MCP is running and the needed mcp__zotero__* tools are enabled → in the conversation, have the model call tools to search, read full text, or (if write tools are not disabled) maintain collections; write tools are all enabled by default, so tighten as needed.

Even when there is no active session, you can open the “Zotero Library” panel via the right sidebar guide entry. For more complete entry descriptions, interactions, and a toast / error comparison table, see the plugin usage documentation in the repository.

Use Cases and Cautions¶

Who it’s for: users who manage literature in Zotero daily and also write long articles or do literature-based Q&A in dsh; for scenarios where you want panel browsing and model tools to share the same local library, and to be able to individually turn off dangerous write tools.

Permissions and security: the plugin runs with the permissions of the current dsh process and accesses the Zotero API and MCP on local 127.0.0.1. Before installing, it is recommended to read the source code and the MIT license to confirm it meets your security policy. The community catalog SkillHub has no official affiliation with DeepSeek / High-Flyer; the plugin comes from a community maintainer.

Boundaries related to “read-only”: the UI panel is read-only; whether the model side is read-only depends on which MCP tools you have enabled. The panel’s read-only browsing is unaffected when MCP is not running.

Conclusion¶

dsh-plugin-zotero splits the Zotero local library into two lines — “human-side draft citations” and “model-side toggleable tools” — reducing the manual carrying of bibliographic entries, and centrally manages API and MCP parameters on the plugin page. For the index and introduction, you can open the SkillHub plugin page; for installation, configuration, and architecture details, the GitHub README and the documents under docs/ are authoritative.