zipnative MCP — ZIP creation, inspection, secure extraction & verification MCP server

by Nizoka·io.github.Nizoka/zipnative-mcp·v1.0.0

No reviews yet

ZIP MCP server: create, inspect, verify, extract securely, modify without recompression. 13 tools

B83/100grade B

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

B83/100

full report

Adoption

Growing

0 stars55 downloads/wk

Reviews

Write one

Nobody has reviewed zipnative MCP — ZIP creation, inspection, secure extraction & verification yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

zipnative MCP — ZIP creation, inspection, secure extraction & verification tools (7, 1 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

draft_issue_workflow
Step-by-step workflow for drafting a GitHub issue with the draft_governance_issue tool and handing it to a human for review and submission.
forensic_scan
When and how to use scan_zip_forward, what its local-headers-only result can and cannot tell you, and how to reconcile it with the authoritative readers.
governance_contract
The non-negotiable AI-governance / Human-In-The-Loop contract for zipnative-mcp: the agent is a draftsman, the human is the only gate, zero runtime dependencies, no autonomous GitHub writes, no network.
incremental_updatewrite action
How modify_zip edits without recompression, what append mode leaves behind (remanence, the 7-Zip stale-payload differential), and when to compact.
reproducible_archive
How to obtain the same bytes from repeated create_zip calls and across runtimes: pinned dates, canonical order, the deterministic encoder pin, and how to prove it.
secure_extraction
Recipe for taking in an archive from an untrusted source: verify, inspect with CI checks, dry-run the plan, extract with every guard on, and when (not) to relax a guard.
verify_before_trust
The minimal read-only sequence (verify_zip → inspect_zip checks → list → dry run) to run on any archive before extracting it.

Public scan report

scanner v0.1.9 · 2026-09-20 · same rubric, same numbers if you re-run it

no findings

Code scan76 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitystatic API keys via environment variables6/15
Maintenancelast push 9 days ago15/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

Install directly

Runs npx -y zipnative-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add zipnative-mcp -- npx -y zipnative-mcp

Add to Cursor

zipnative MCP — ZIP creation, inspection, secure extraction & verification: common questions

Is zipnative MCP — ZIP creation, inspection, secure extraction & verification MCP server safe?: Mostly: it is graded B (83/100). Read the zipnative MCP — ZIP creation, inspection, secure extraction & verification safety report
How do I install zipnative MCP — ZIP creation, inspection, secure extraction & verification?: It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does zipnative MCP — ZIP creation, inspection, secure extraction & verification need an API key?: Yes. The registry entry asks for ZIPNATIVE_MCP_HTTP_TOKEN.
Is zipnative MCP — ZIP creation, inspection, secure extraction & verification maintained?: The last commit was 9 days ago (2026-09-10). The latest release is v1.0.0.
What can I use instead of zipnative MCP — ZIP creation, inspection, secure extraction & verification?: Servers from other publishers that do the same job: Zip Archive Create Extract Bomb Guard MCP server, Pullzip MCP server and Ziplark MCP server. Compare all zipnative MCP — ZIP creation, inspection, secure extraction & verification alternatives.

Alternatives to zipnative MCP — ZIP creation, inspection, secure extraction & verification

Same job from other publishers: the closest match first, then the best rated.

All zipnative MCP — ZIP creation, inspection, secure extraction & verification alternatives →

Zip Archive Create Extract Bomb Guard
Create, inspect and extract zip archives offline, with traversal, symlink and zip-bomb guards.
More from theluckystrike →
not reviewed
Growing
A
Pullzip
Inspect, search and safely extract zip/7z/rar/tar archives; repair garbled CJK file names.
not reviewed
New
B
Ziplark
Archive server: extract & create ZIP, 7z, tar, gz/xz/zst; read RAR/RAR5 & ISO. AES-256, safe.
not reviewed
New
B
WyndPath Web Data
Fetch and extract data from any public web page, even JS-rendered or anti-bot protected
not reviewed
New
B
Velrim
Document extraction against a JSON Schema with a calibrated confidence per field; async job status.
not reviewed
New
C

zipnative MCP — ZIP creation, inspection, secure extraction & verification vs Zip Archive Create Extract Bomb Guard zipnative MCP — ZIP creation, inspection, secure extraction & verification vs Pullzip zipnative MCP — ZIP creation, inspection, secure extraction & verification vs Ziplark

Run it through the gateway

Local package. It runs on your machine, not through the gateway.

Rating: —
Safety grade: B · 83/100
Stars: 0
Downloads/wk: 55
Price: Free
Licence: MIT
Transport: Local · npm
Version: 1.0.0
Category: Scraping and browsing
Last release: 2026-09-10

Credentials it needs

ZIPNATIVE_MCP_OUTPUT_DIRAbsolute path of the one sandbox directory: zipPath / sourcePath inputs are read from it and outputMode='file' / outputDir outputs are written under it (never overwritten; the real path of every file read and of every parent written must stay inside — a planted symlink or junction is SECURITY_VIOLATION). Unset: every tool works on base64 only (no file I/O beyond the opt-in cache).
ZIPNATIVE_MCP_CACHE_DIROpt-in content-addressed response cache directory (SHA-256 keyed, 1h TTL, 256 MiB LRU, plaintext at rest). Never caches zipPath / sourcePath inputs, file output, defaultDate='now', parallel, describe_engine or draft_governance_issue.
ZIPNATIVE_MCP_PORTServe Streamable HTTP on this loopback port (POST /mcp) instead of stdio (MCP 2026-07-28, stateless, legacy fallback). Unauthenticated unless ZIPNATIVE_MCP_HTTP_TOKEN is set.
ZIPNATIVE_MCP_HTTP_TOKENsecretOpt-in bearer token for the HTTP transport (>= 16 chars, no whitespace; a weaker value refuses to start). When set, /mcp requires 'Authorization: Bearer <token>' or answers 401. Compared constant-time, never logged.
ZIPNATIVE_MCP_MAX_UNCOMPRESSED_BYTESOperator ceiling for limits.maxEntryUncompressedSize and limits.maxTotalUncompressedSize in bytes (default 8589934592 = 8 GiB, the engine default). Integer >= 1024, read once at startup; an invalid value refuses to start. A per-call value above it is refused with LIMIT_CEILING_EXCEEDED.
ZIPNATIVE_MCP_MAX_ENTRIESOperator ceiling for limits.maxEntries and scan_zip_forward maxEntries (default 100000, the engine default; the scanner's default budget of 10000 is clamped to it, only an explicit value above it is refused). Integer >= 1, read once at startup; an invalid value refuses to start.
ZIPNATIVE_MCP_WORKERSOperator ceiling for create_zip parallel.workers (default 8; with no explicit workers the engine default max(1, min(cores - 1, 8)) applies, bounded by this ceiling; 0 disables worker threads and keeps compression on the calling thread). Integer >= 0, read once at startup; an invalid value refuses to start.

Own this server?

Claim it to keep the listing current and reply to reviews. Claiming never changes the grade or hides a review.

Claim listing

Badge for your README

Shows the safety grade and links back to this page. It updates itself after every scan and review.

[![mcp.market](https://mcp.market/badge/nizoka-zipnative-mcp.svg)](https://mcp.market/server/nizoka-zipnative-mcp)

How the badge works