zipnative MCP — ZIP creation, inspection, secure extraction & verification

Name: zipnative MCP — ZIP creation, inspection, secure extraction & verification
Author: Nizoka

by Nizokaversion 1.1.0i★ –iRuns on your computer

Registry nameio.github.Nizoka/zipnative-mcp

Install

Overview

Description from the maker (original English)

ZIP MCP server: create, inspect, verify, extract, canonicalize, merge, modify. 15 tools

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Other
You need to fill in: ZIPNATIVE_MCP_HTTP_TOKEN

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
You fill in yourself: ZIPNATIVE_MCP_OUTPUT_DIR, ZIPNATIVE_MCP_CACHE_DIR, ZIPNATIVE_MCP_PORT, ZIPNATIVE_MCP_HTTP_TOKEN, ZIPNATIVE_MCP_MAX_UNCOMPRESSED_BYTES, ZIPNATIVE_MCP_MAX_ENTRIES, ZIPNATIVE_MCP_WORKERS, ZIPNATIVE_MCP_MAX_FILE_OUTPUT_BYTES

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

npmNode.js installed (for the npx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "zipnative": {
      "command": "npx",
      "args": [
        "-y",
        "zipnative-mcp"
      ],
      "env": {
        "ZIPNATIVE_MCP_OUTPUT_DIR": "your-value",
        "ZIPNATIVE_MCP_CACHE_DIR": "your-value",
        "ZIPNATIVE_MCP_PORT": "your-value",
        "ZIPNATIVE_MCP_HTTP_TOKEN": "your-value",
        "ZIPNATIVE_MCP_MAX_UNCOMPRESSED_BYTES": "your-value",
        "ZIPNATIVE_MCP_MAX_ENTRIES": "your-value",
        "ZIPNATIVE_MCP_WORKERS": "your-value",
        "ZIPNATIVE_MCP_MAX_FILE_OUTPUT_BYTES": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add zipnative --env ZIPNATIVE_MCP_OUTPUT_DIR=your-value --env ZIPNATIVE_MCP_CACHE_DIR=your-value --env ZIPNATIVE_MCP_PORT=your-value --env ZIPNATIVE_MCP_HTTP_TOKEN=your-value --env ZIPNATIVE_MCP_MAX_UNCOMPRESSED_BYTES=your-value --env ZIPNATIVE_MCP_MAX_ENTRIES=your-value --env ZIPNATIVE_MCP_WORKERS=your-value --env ZIPNATIVE_MCP_MAX_FILE_OUTPUT_BYTES=your-value -- npx -y zipnative-mcp

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "zipnative": {
      "command": "npx",
      "args": [
        "-y",
        "zipnative-mcp"
      ],
      "env": {
        "ZIPNATIVE_MCP_OUTPUT_DIR": "your-value",
        "ZIPNATIVE_MCP_CACHE_DIR": "your-value",
        "ZIPNATIVE_MCP_PORT": "your-value",
        "ZIPNATIVE_MCP_HTTP_TOKEN": "your-value",
        "ZIPNATIVE_MCP_MAX_UNCOMPRESSED_BYTES": "your-value",
        "ZIPNATIVE_MCP_MAX_ENTRIES": "your-value",
        "ZIPNATIVE_MCP_WORKERS": "your-value",
        "ZIPNATIVE_MCP_MAX_FILE_OUTPUT_BYTES": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "zipnative": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "zipnative-mcp"
      ],
      "env": {
        "ZIPNATIVE_MCP_OUTPUT_DIR": "your-value",
        "ZIPNATIVE_MCP_CACHE_DIR": "your-value",
        "ZIPNATIVE_MCP_PORT": "your-value",
        "ZIPNATIVE_MCP_HTTP_TOKEN": "your-value",
        "ZIPNATIVE_MCP_MAX_UNCOMPRESSED_BYTES": "your-value",
        "ZIPNATIVE_MCP_MAX_ENTRIES": "your-value",
        "ZIPNATIVE_MCP_WORKERS": "your-value",
        "ZIPNATIVE_MCP_MAX_FILE_OUTPUT_BYTES": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

ZIPNATIVE_MCP_OUTPUT_DIR env
Absolute path of the one sandbox directory: zipPath / sourcePath inputs are read from it and outputMode='file' / outputDir outputs are written under it (never overwritten; the real path of every file…
ZIPNATIVE_MCP_CACHE_DIR env
Opt-in content-addressed response cache directory (absolute path) (SHA-256 keyed, 1h TTL, 256 MiB, oldest-written evicted first, plaintext at rest). Never caches zipPath / sourcePath inputs, file out…
ZIPNATIVE_MCP_PORT env
Serve Streamable HTTP on this loopback port (POST /mcp) instead of stdio (MCP 2026-07-28, stateless, legacy fallback). Unauthenticated unless ZIPNATIVE_MCP_HTTP_TOKEN is set.
ZIPNATIVE_MCP_HTTP_TOKEN secret env
Opt-in bearer token for the HTTP transport (>= 16 chars, no whitespace; a weaker value refuses to start). When set, /mcp requires 'Authorization: Bearer ' or answers 401. Compared constant-time, neve…
ZIPNATIVE_MCP_MAX_UNCOMPRESSED_BYTES env
Operator ceiling for limits.maxEntryUncompressedSize, limits.maxTotalUncompressedSize and limits.maxEntryCompressedSize in bytes (default 8589934592 = 8 GiB, the engine default). Integer >= 1024, rea…
ZIPNATIVE_MCP_MAX_ENTRIES env
Operator ceiling for limits.maxEntries and scan_zip_forward maxEntries (default 100000, the engine default; the scanner's default budget of 10000 is clamped to it, only an explicit value above it is…
ZIPNATIVE_MCP_WORKERS env
Operator ceiling for create_zip parallel.workers (default 8; with no explicit workers the engine default max(1, min(cores - 1, 8)) applies, bounded by this ceiling; 0 disables worker threads and keep…
ZIPNATIVE_MCP_MAX_FILE_OUTPUT_BYTES env
Operator ceiling for every file written in outputMode='file' (create_zip, modify_zip, canonicalize_zip, merge_zip, extract_zip, inflate_raw), enforced while streaming (default 4294967296 = 4 GiB, the…

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account Nizoka, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Otheri

More stars than 0% of the other 32725 servers in this category
Published to the registry more recently than 67% of the other 32725 servers in this category
Basic checks equal to or better than 100% of the other 32725 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is zipnative MCP — ZIP creation, inspection, secure extraction & verification safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: ZIPNATIVE_MCP_HTTP_TOKEN

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (1.1.0) reached the registry 19 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, Signoff

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

by formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Runs on your computer★ 440MITUpdated 14 months ago

Install

Remote Desktop Commander

by desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Runs in the cloud★ 211Updated 2 days ago

Install

Signoff

by ayuanxx-max

Five gates that make an agent's 'done' provable: run them, read the verdict, audit the record.

Runs on your computerUpdated today

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

zipnative-mcp

MCP server for ZIP archives — deterministic creation, inspection and listing without extracting, random-access entry reads (in memory or by byte ranges for sandbox archives larger than memory), secure-by-default extraction, one-call verification, forward scanning of truncated streams, incremental modification, canonicalisation and merging without recompression, CRC-32 and raw-DEFLATE inflation — 15 tools and 7 prompts on the zipnative engine (zero-dependency, ISO/IEC 21320-1 conformance validated in CI), for Claude Desktop, Cursor, ChatGPT and any MCP client. No network, ever.

✨ Features

zipnative-mcp 1.1.0 (on zipnative 1.1.0) exposes 15 tools to any MCP host, listed here in tools/list order. The consumer contract — catalogue, decision tree, token economy, recipes and the complete error table — is docs/AGENT_CONTRACT.md.

Tool	What it does	Read-only
`inspect_zip`	ONE-call archive report: sizes, entry / file / directory counts, Zip64, comment, compressed vs uncompressed totals, per-method counts, encrypted / symlink / data-descriptor / Zip64 / cp437 / duplicate / unsafe-name counts, date range, a determinism verdict (taken from the engine's `analyzeDeterminism()`; the default verdict is the 1.0.0 formula: epoch timestamps + canonical order + UTF-8 flags) and every engine diagnostic. Opens eagerly: overlapping entries, entries reaching into the central directory or past EOF and Zip64 spoofing are refused with their `ZIP_` code. `check: […]` + `assert: {…}` turn it into a CI gate*; `determinismReport: true` adds the engine's stricter canonical-form verdict with every offending entry.	✓
`list_zip_entries`	Paged central-directory inventory, nothing decompressed — every entry as a full row (sizes, CRC-32, method, timestamp, flags, Unix mode, symlink, Zip64, offsets, extra fields, the sanitized path an extraction would use, raw name bytes; opt-in extended timestamps and Unix owner ids). `filter` by names / prefix / glob, `offset` + `limit` (200 default, 2000 max).	✓
`read_zip_entry`	ONE entry by `name` or `index` without extracting: decompressed content as base64 or UTF-8 text (CRC-verified), a byte `range` through the chunked stream, the raw compressed payload (`mode: 'raw'`), or a non-throwing integrity check (`mode: 'verify'`, with the engine's `skipped` reason).	✓
`verify_zip`	Deep verification in one call — the engine's `verifyZip` report verbatim: structure, every entry's CRC-32 / size / local-header agreement, each unverifiable entry with its `skipped` reason (`'encrypted'`, `'stream-only-codec'`, `'unsupported-method'`). Never `isError` for an archive problem: branch on `ok` and `error.code`.	✓
`extract_zip`	Secure by default: zip-slip / device names, symlinks, duplicate paths, declared-size and ratio bombs, overlapping entries and central/local divergence refused with frozen `ZIP_*` codes; relaxations are explicit named inputs that skip, never emit. Inline files (`includeData: false` = dry run — it opens eagerly and refuses an overlapping, offset-into-CD or Zip64-spoofed archive before returning any plan) or streamed into the sandbox with resource links.
`scan_zip_forward`	Walk local headers in stream order with bounded memory — the only tool that works on a truncated download or a cut / unseekable stream that starts at a local header, and the only one whose result is NOT authoritative (`trust: 'local-headers-only'`). `tolerateTruncation: true` returns the partial inventory plus the error. It cannot skip an SFX / prepended prefix and refuses one (`ZIP_SIGNATURE_MISMATCH`): `inspect_zip` reports it (`prependedData`, `ZIP_PREPENDED_DATA`) and `modify_zip mode: 'compact'` drops it.	✓
`sanitize_entry_paths`	The engine's single traversal gate over a list of names: the safe `/`-relative form each maps to, or `null` with the rule that fired (traversal, absolute, drive, UNC, NUL, ADS, device name). No archive needed.	✓
`create_zip`	Write a ZIP from inline text / base64 / sandbox files (up to 100 000 entries — Zip64 auto-promotes past 65 535). Reproducible by default (canonical order, DOS-epoch timestamps written in UTC, UTF-8 names); `compression.deterministic: true` for identical bytes on every runtime — `summary.deterministic` is `true` ONLY then; store / deflate at archive or entry level; `order: 'insertion'` for EPUB / JAR; comments, Unix modes, extra fields; streamed sources (`zip64: true` lets a streamed entry cross 4 GiB); the worker pool (`parallel`, byte-identical); `includeSha256` proofs in base64 and file mode.
`modify_zip`	add / replace / remove / rename / setComment without recompressing anything. `mode: 'append'` keeps the original bytes verbatim (removed content stays recoverable — data remanence, said loudly); `mode: 'compact'` rewrites so it is truly gone, and `canonical: {…}` makes that rewrite the canonical deterministic form. The input is opened eagerly in both modes.
`canonicalize_zip`	Make ANY archive reproducible: the engine's `canonicalizeZip()` rewrites a Gradle, Maven, `zip`, Explorer or 7-Zip archive into the canonical deterministic form (sorted by raw name bytes, one timestamp, UTF-8 flags, Zip64-only extras, the constant version-made-by, no data descriptor) without recompressing a payload. Idempotent; `summary.canonicalForm` is the engine's own `analyzeDeterminism()` verdict on the output.
`merge_zip`	1 to 32 source archives into one without recompressing anything (`ZipWriter.addFromReader`): with `verify: true` (the default) every entry is decompressed once and CRC- and size-checked before it is copied, and an entry it cannot check (a method other than store / deflate) is refused (`ZIP_UNSUPPORTED_METHOD`); per-source `filter`, name collisions `onConflict: 'error'` (default, `ZIP_DUPLICATE_ENTRY_NAME`) \	`'first'` \	`'last'` with the drops reported. Encrypted entries are refused.
`compute_crc32`	The ZIP checksum (IEEE 802.3 CRC-32, the engine's slice-by-8) of text, base64 or a sandbox file streamed in 1 MiB chunks; `seed` chains chunks, `expect` compares.	✓
`inflate_raw`	Raw DEFLATE (RFC 1951) through the engine's resumable inflater with a mandatory `maxOutput` bound: exact `bytesConsumed`, trailing bytes as `leftover`. Feed it `read_zip_entry mode: 'raw'`.
`describe_engine`	Offline preflight: versions, deflate tiers, runtime codecs (with `incremental`) and workers, the engine's default limits, the four operator ceilings, every server cap, sandbox / cache state, the 39 error codes and 12 diagnostic codes, the deliberately unexposed engine exports. `network` is always `'none'`.	✓
`draft_governance_issue`	Draft a governance-compliant GitHub issue locally for a human to review and submit — never submits, no network, no GitHub write path.

What every tool guarantees:

🔐 Secure by default — every engine guard is on; a relaxation is an explicit, named input (rejectTraversal, rejectSymlinks, onDuplicate, limits) that skips, never emits an unsafe path or materialises a link. Overlaps, central/local divergence and Zip64 spoofing have no opt-out at all.
🌐 No network, ever — the server has no network code path: no telemetry, no GitHub, no URL from any argument, no remote byte-range source, no operator-configurable endpoint. The only filesystem boundary is ZIPNATIVE_MCP_OUTPUT_DIR.
🔁 Reproducible by default, deterministic on request — create_zip emits canonical order, DOS-epoch timestamps and UTF-8 names unless you opt out, and every DOS date is written and read in UTC (dosTimeMode: 'utc'), so a pinned date gives the same bytes in Paris and on a UTC runner; compression.deterministic: true pins the pure-TypeScript encoder for the same SHA-256 on every runtime and is the only setting under which summary.deterministic is true; canonicalize_zip brings any foreign archive into the canonical form; parallel is byte-identical.
🧭 **Frozen ZIP_* error codes, verbatim** — the engine's 39-code vocabulary reaches you unchanged in _meta.error.code (with the entry name, the limit that fired, both CRCs, …), plus the 17 wrapper codes, each with a remedy. Branch on the code, never on the message.
🪙 Token-frugal projections — the read tools accept verbosity: 'summary' and fields: […]; a produced archive arrives as an embedded resource block, never in structuredContent (the block carries the bytes in blob and repeats them in its data: URI, so outputMode: 'file' — a resource_link — is the token-frugal choice for anything sizeable).
⏹ Cancellable, with progress — the request's cancellation signal and, when the client sends a progressToken, a progress sink reach every tool whose work scales with its input except verify_zip (zipnative's verifyZip is synchronous and takes no signal: a verify runs to completion and returns its report). A cancelled call is never cached and a partial output file is removed; over MCP the SDK sends no response to a cancelled request (CANCELLED is the in-process code).
📏 ISO/IEC 21320-1 conformance gate — every archive the tools write is validated clause by clause by an engine-independent validator (veraZIP) on Linux and Windows in CI and again before publish.

All archive-producing tools (create_zip, modify_zip, canonicalize_zip, merge_zip; inflate_raw for raw bytes) support two output modes:

`base64` *(default)* — the archive is returned as an embedded resource content block: the bytes are in resource.blob, and resource.uri repeats them as a data:application/zip;base64,… URI (unchanged since 1.0.0, so a client that decodes the URI keeps working) — the archive therefore travels twice in the block; structuredContent carries { mode, sizeBytes, summary, diagnostics, diagnosticCounts }, never the bytes.
`file` — the archive is streamed into a sandboxed directory configured via ZIPNATIVE_MCP_OUTPUT_DIR (≤ 4 GiB by default, ZIPNATIVE_MCP_MAX_FILE_OUTPUT_BYTES moves the ceiling; never overwritten) and the result carries a resource_link (the cheapest response; structuredContent.filePath and the text line give the file's absolute host path, as in 1.0.0). File I/O is disabled unless this variable is set; absolute paths, traversal, non-container extensions and NUL bytes are all rejected, and the **rea

Only the beginning is shown; read the rest in the repo

zipnative MCP — ZIP creation, inspection, secure extraction & verification

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

Signoff

README from the maker

zipnative-mcp

✨ Features