Cite Caddy — Claude Code MCP server: read/write access to Zotero

What Cite Caddy does

Cite Caddy talks to Zotero through its Web API and exposes 39 tools. An assistant can search for items, add new ones, edit fields, apply tags, build and rename collections, pull down attachments and read their extracted text, handle notes, the trash and saved searches, and query Zotero's own item-type and field schema.

The server ships as a Docker container and expects a reverse proxy that terminates TLS in front of it. Clients only point at a URL, so there is nothing to run locally. In stdio mode the target library comes from ZOTERO_LIBRARY_ID, ZOTERO_LIBRARY_TYPE and ZOTERO_API_KEY; the key needs write permission, not read alone. In HTTP mode each caller supplies their own library ID, type and key through the /login form, and those keys are encrypted at rest with MCP_TOKEN_STORE_KEY.

Deleting and moving items deserves care. A Word document that cites an item through the Zotero plugin stores that item's key inside a live field code, and a library-to-library move is carried out as a removal followed by a fresh creation. Either operation breaks those citations without any warning: the document stays quiet and later shows stale field text. Calls that keep the key intact are fine. Six destructive tools, among them delete_item_permanently and move_item_to_different_library, take an optional idempotency_key, so a retry after an ambiguous response replays the earlier outcome rather than hitting Zotero again.