Cite Caddy

What this server collects

Cite Caddy is self-service: signing in at /login is how you connect your own Zotero library, and it's the only place this server asks you for anything. That form collects:

• Your Zotero Library ID and Library Type (user or group)
• Your Zotero API key (needs write permission to use this server's tools)

Nothing else is asked for — no name, no email, no account creation step separate from this. The MCP client you connect with (e.g. Claude) also registers itself as an OAuth client (client ID and redirect URI), which is standard OAuth 2.1 plumbing, not personal data about you.

How it's stored

Your API key is encrypted at rest (Fernet, symmetric authenticated encryption) before being written to the server's token store; it is never kept in plaintext on disk. Your Library ID/Type are stored alongside it, unencrypted, since they aren't secret on their own. OAuth access and refresh tokens issued to your MCP client are stored the same way, and are short-lived.

How it's used

Your stored credentials are used for exactly one thing: routing your authenticated tool calls to your own Zotero library via Zotero's Web API, on your behalf. This server is a pass-through — it does not read, analyze, or retain copies of your library's contents beyond what's needed to serve each individual request, and it does not sell or share your data with anyone.

Calls this server makes to Zotero on your behalf are subject to Zotero's own privacy policy — the same as if you'd used the Zotero app or website directly.

Aggregate metrics

The public /status endpoint reports server uptime, the total number of onboarded tenants, and per-tool call/error counts. These are counts only — no library identity, no tool arguments, and no library contents are included or ever exposed there.

This website

This landing page (herbertkokholm.dk/cite-caddy/) is static, hosted on GitHub Pages, and runs no analytics, tracking scripts, or cookies of its own. See GitHub's own privacy statement for what GitHub Pages itself may log (e.g. standard web server request logs).

Deleting your data

Revoking your Zotero API key from Zotero's own settings immediately stops this server from being able to act on your library, at any time. To have your stored tenant record (encrypted key, Library ID/Type) deleted from the server entirely, contact the maintainer — see GitHub's private reporting form or the email on the maintainer's GitHub profile.

Changes to this policy

This is a small, solo-maintained project. If this policy changes, the "last updated" date above will change with it — check the file history on GitHub for the exact diff.