Spec Driven Development
作者：formulahendry
MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.
在你的电脑上运行★ 440MIT14个月前更新
安装
zipnative MCP — ZIP creation, inspection, secure extraction & verification
概览
作者提供的说明（英文原文）
ZIP MCP server: create, inspect, verify, extract, canonicalize, merge, modify. 15 tools
PopNx MCP 的三大支柱
这三项永远不会合并成一个分数：意见、测量和人气是不同的东西。
- 用户评价i暂无评价评价功能将在后续阶段与账户功能一起开放
- 我们的基础检查i1 项中通过 1 项依据公开信息检查；尚未扫描代码
- 使用情况i尚未统计★ –
它能帮你做什么
我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。
- 连接方式: 在你的电脑上运行
- 传输方式: stdio
- 分类: 其他
- 你需要填写：ZIPNATIVE_MCP_HTTP_TOKEN
安装
选择你使用的 AI 应用，然后复制设置。
安装之前
- 基础检查：1 项中通过 1 项
- 在你的电脑上运行，拥有你的用户账户的权限（文件、网络、应用）。
- 需要你自己填写：
ZIPNATIVE_MCP_OUTPUT_DIR,ZIPNATIVE_MCP_CACHE_DIR,ZIPNATIVE_MCP_PORT,ZIPNATIVE_MCP_HTTP_TOKEN,ZIPNATIVE_MCP_MAX_UNCOMPRESSED_BYTES,ZIPNATIVE_MCP_MAX_ENTRIES,ZIPNATIVE_MCP_WORKERS,ZIPNATIVE_MCP_MAX_FILE_OUTPUT_BYTES
标为机密的值是你账户的钥匙。千万不要分享给别人，也不要粘贴到聊天里。
你需要
- npm已安装 Node.js（用于 npx 命令）
你用的是哪个应用？
在上方选择你的应用。我们会记住它，下次按钮会显示“安装到 …”。
打开 Claude Desktop → Settings → Developer → Edit Config，把下面的内容粘贴到 claude_desktop_config.json
{
"mcpServers": {
"zipnative": {
"command": "npx",
"args": [
"-y",
"zipnative-mcp"
],
"env": {
"ZIPNATIVE_MCP_OUTPUT_DIR": "your-value",
"ZIPNATIVE_MCP_CACHE_DIR": "your-value",
"ZIPNATIVE_MCP_PORT": "your-value",
"ZIPNATIVE_MCP_HTTP_TOKEN": "your-value",
"ZIPNATIVE_MCP_MAX_UNCOMPRESSED_BYTES": "your-value",
"ZIPNATIVE_MCP_MAX_ENTRIES": "your-value",
"ZIPNATIVE_MCP_WORKERS": "your-value",
"ZIPNATIVE_MCP_MAX_FILE_OUTPUT_BYTES": "your-value"
}
}
}
}在终端中运行这条命令
claude mcp add zipnative --env ZIPNATIVE_MCP_OUTPUT_DIR=your-value --env ZIPNATIVE_MCP_CACHE_DIR=your-value --env ZIPNATIVE_MCP_PORT=your-value --env ZIPNATIVE_MCP_HTTP_TOKEN=your-value --env ZIPNATIVE_MCP_MAX_UNCOMPRESSED_BYTES=your-value --env ZIPNATIVE_MCP_MAX_ENTRIES=your-value --env ZIPNATIVE_MCP_WORKERS=your-value --env ZIPNATIVE_MCP_MAX_FILE_OUTPUT_BYTES=your-value -- npx -y zipnative-mcp运行前请先填写空着的值。
或者自己复制设置
粘贴到项目中的 .cursor/mcp.json，或 ~/.cursor/mcp.json
{
"mcpServers": {
"zipnative": {
"command": "npx",
"args": [
"-y",
"zipnative-mcp"
],
"env": {
"ZIPNATIVE_MCP_OUTPUT_DIR": "your-value",
"ZIPNATIVE_MCP_CACHE_DIR": "your-value",
"ZIPNATIVE_MCP_PORT": "your-value",
"ZIPNATIVE_MCP_HTTP_TOKEN": "your-value",
"ZIPNATIVE_MCP_MAX_UNCOMPRESSED_BYTES": "your-value",
"ZIPNATIVE_MCP_MAX_ENTRIES": "your-value",
"ZIPNATIVE_MCP_WORKERS": "your-value",
"ZIPNATIVE_MCP_MAX_FILE_OUTPUT_BYTES": "your-value"
}
}
}
}浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。
或者自己复制设置
粘贴到项目中的 .vscode/mcp.json
{
"servers": {
"zipnative": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"zipnative-mcp"
],
"env": {
"ZIPNATIVE_MCP_OUTPUT_DIR": "your-value",
"ZIPNATIVE_MCP_CACHE_DIR": "your-value",
"ZIPNATIVE_MCP_PORT": "your-value",
"ZIPNATIVE_MCP_HTTP_TOKEN": "your-value",
"ZIPNATIVE_MCP_MAX_UNCOMPRESSED_BYTES": "your-value",
"ZIPNATIVE_MCP_MAX_ENTRIES": "your-value",
"ZIPNATIVE_MCP_WORKERS": "your-value",
"ZIPNATIVE_MCP_MAX_FILE_OUTPUT_BYTES": "your-value"
}
}
}
}浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。
这个服务器在你的电脑上运行，而 ChatGPT 只能连接互联网上的服务器。请选择其他应用。
你的选择通过 Cookie 保存在这台设备上，无需账户。
需要你填写的值
ZIPNATIVE_MCP_OUTPUT_DIRenvAbsolute path of the one sandbox directory: zipPath / sourcePath inputs are read from it and outputMode='file' / outputDir outputs are written under it (never overwritten; the real path of every file…ZIPNATIVE_MCP_CACHE_DIRenvOpt-in content-addressed response cache directory (absolute path) (SHA-256 keyed, 1h TTL, 256 MiB, oldest-written evicted first, plaintext at rest). Never caches zipPath / sourcePath inputs, file out…ZIPNATIVE_MCP_PORTenvServe Streamable HTTP on this loopback port (POST /mcp) instead of stdio (MCP 2026-07-28, stateless, legacy fallback). Unauthenticated unless ZIPNATIVE_MCP_HTTP_TOKEN is set.- Opt-in bearer token for the HTTP transport (>= 16 chars, no whitespace; a weaker value refuses to start). When set, /mcp requires 'Authorization: Bearer ' or answers 401. Compared constant-time, neve…
ZIPNATIVE_MCP_MAX_UNCOMPRESSED_BYTESenvOperator ceiling for limits.maxEntryUncompressedSize, limits.maxTotalUncompressedSize and limits.maxEntryCompressedSize in bytes (default 8589934592 = 8 GiB, the engine default). Integer >= 1024, rea…ZIPNATIVE_MCP_MAX_ENTRIESenvOperator ceiling for limits.maxEntries and scan_zip_forward maxEntries (default 100000, the engine default; the scanner's default budget of 10000 is clamped to it, only an explicit value above it is…ZIPNATIVE_MCP_WORKERSenvOperator ceiling for create_zip parallel.workers (default 8; with no explicit workers the engine default max(1, min(cores - 1, 8)) applies, bounded by this ceiling; 0 disables worker threads and keep…ZIPNATIVE_MCP_MAX_FILE_OUTPUT_BYTESenvOperator ceiling for every file written in outputMode='file' (create_zip, modify_zip, canonicalize_zip, merge_zip, extract_zip, inflate_raw), enforced while streaming (default 4294967296 = 4 GiB, the…
这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同，请以 README 为准。
它能做什么
它在你的电脑上运行；安装后，工具列表会显示在你的 AI 应用中。
基础检查i
我们检查的是任何人都能看到的信息；我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月7日
- ✓ 通过
作者与仓库一致
注册名称已通过 GitHub 账户 Nizoka 验证，该账户拥有此仓库
- … 尚未检查
仍在维护
我们还没有从 GitHub 读取这个仓库
- … 尚未检查
有许可证
我们还没有从 GitHub 读取这个仓库
- – 不适用
端点有响应
它在你的电脑上运行，没有互联网端点
- – 不适用
使用 OAuth 登录
在你的电脑上运行，改用本地设置
- … 尚未检查
工具描述中没有隐藏指令
它在你的电脑上运行；我们只能读取互联网端点的工具列表
与“其他”中的其他服务器比较i
- 星标数多于此分类中其他 32742 个服务器的 0%
- 发布到注册中心的时间比此分类中其他 32742 个服务器的 67% 更新
- 基础检查结果等于或优于此分类中其他 32742 个服务器的 100%
与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时，星标数才计入。
常见问题
zipnative MCP — ZIP creation, inspection, secure extraction & verification 安全吗？
它在 1 项适用的基础检查中通过了 1 项。我们没有阅读代码。在添加密钥或令牌之前，请先看看这个服务器要求哪些权限，并使用只具备所需权限的密钥。
它需要哪些密钥或代码？
你需要填写：ZIPNATIVE_MCP_HTTP_TOKEN
它在我的电脑上运行还是在云端？
它在你的电脑上运行。你的 AI 应用会在需要时启动它，数据不会经过作者的服务器（除非它自己调用在线服务）。
它还在维护吗？
GitHub 仓库最后更新于–，最新版本（1.1.0）于19天前进入注册中心。
哪些应用可以使用它？
支持 MCP 的应用，例如 Claude Desktop、Claude Code、Cursor 和 VS Code。你的电脑上还需要有 Node.js。
有什么可以替代它？
同一分类中有：Spec Driven Development, Remote Desktop Commander, Asset Notation
替代选择
同一分类中其他作者的服务器，按星标数排序。
如何看卡片：★ GitHub 星标i三大支柱：评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i
Remote Desktop Commander
作者：desktop-commander
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
在云端运行★ 211前天更新
安装
Asset Notation
作者：assetnotation
Read and maintain an Asset Notation file on disk: net worth, holdings, valuations, CSV import.
在你的电脑上运行今天更新
安装
作者的 README
打开 README
按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。
zipnative-mcp
MCP server for ZIP archives — deterministic creation, inspection and listing without extracting, random-access entry reads (in memory or by byte ranges for sandbox archives larger than memory), secure-by-default extraction, one-call verification, forward scanning of truncated streams, incremental modification, canonicalisation and merging without recompression, CRC-32 and raw-DEFLATE inflation — 15 tools and 7 prompts on the zipnative engine (zero-dependency, ISO/IEC 21320-1 conformance validated in CI), for Claude Desktop, Cursor, ChatGPT and any MCP client. No network, ever.
✨ Features
zipnative-mcp 1.1.0 (on zipnative 1.1.0) exposes 15 tools to any MCP host, listed here in tools/list order. The consumer contract — catalogue, decision tree, token economy, recipes and the complete error table — is docs/AGENT_CONTRACT.md.
| Tool | What it does | Read-only | ||
|---|---|---|---|---|
inspect_zip | ONE-call archive report: sizes, entry / file / directory counts, Zip64, comment, compressed vs uncompressed totals, per-method counts, encrypted / symlink / data-descriptor / Zip64 / cp437 / duplicate / unsafe-name counts, date range, a determinism verdict (taken from the engine's analyzeDeterminism(); the default verdict is the 1.0.0 formula: epoch timestamps + canonical order + UTF-8 flags) and every engine diagnostic. Opens eagerly: overlapping entries, entries reaching into the central directory or past EOF and Zip64 spoofing are refused with their ZIP_* code. check: […] + assert: {…} turn it into a CI gate; determinismReport: true adds the engine's stricter canonical-form verdict with every offending entry. | ✓ | ||
list_zip_entries | Paged central-directory inventory, nothing decompressed — every entry as a full row (sizes, CRC-32, method, timestamp, flags, Unix mode, symlink, Zip64, offsets, extra fields, the sanitized path an extraction would use, raw name bytes; opt-in extended timestamps and Unix owner ids). filter by names / prefix / glob, offset + limit (200 default, 2000 max). | ✓ | ||
read_zip_entry | ONE entry by name or index without extracting: decompressed content as base64 or UTF-8 text (CRC-verified), a byte range through the chunked stream, the raw compressed payload (mode: 'raw'), or a non-throwing integrity check (mode: 'verify', with the engine's skipped reason). | ✓ | ||
verify_zip | Deep verification in one call — the engine's verifyZip report verbatim: structure, every entry's CRC-32 / size / local-header agreement, each unverifiable entry with its skipped reason ('encrypted', 'stream-only-codec', 'unsupported-method'). Never `isError` for an archive problem: branch on ok and error.code. | ✓ | ||
extract_zip | Secure by default: zip-slip / device names, symlinks, duplicate paths, declared-size and ratio bombs, overlapping entries and central/local divergence refused with frozen ZIP_* codes; relaxations are explicit named inputs that skip, never emit. Inline files (includeData: false = dry run — it opens eagerly and refuses an overlapping, offset-into-CD or Zip64-spoofed archive before returning any plan) or streamed into the sandbox with resource links. | |||
scan_zip_forward | Walk local headers in stream order with bounded memory — the only tool that works on a truncated download or a cut / unseekable stream that starts at a local header, and the only one whose result is NOT authoritative (trust: 'local-headers-only'). tolerateTruncation: true returns the partial inventory plus the error. It cannot skip an SFX / prepended prefix and refuses one (ZIP_SIGNATURE_MISMATCH): inspect_zip reports it (prependedData, ZIP_PREPENDED_DATA) and modify_zip mode: 'compact' drops it. | ✓ | ||
sanitize_entry_paths | The engine's single traversal gate over a list of names: the safe /-relative form each maps to, or null with the rule that fired (traversal, absolute, drive, UNC, NUL, ADS, device name). No archive needed. | ✓ | ||
create_zip | Write a ZIP from inline text / base64 / sandbox files (up to 100 000 entries — Zip64 auto-promotes past 65 535). Reproducible by default (canonical order, DOS-epoch timestamps written in UTC, UTF-8 names); compression.deterministic: true for identical bytes on every runtime — summary.deterministic is true ONLY then; store / deflate at archive or entry level; order: 'insertion' for EPUB / JAR; comments, Unix modes, extra fields; streamed sources (zip64: true lets a streamed entry cross 4 GiB); the worker pool (parallel, byte-identical); includeSha256 proofs in base64 and file mode. | |||
modify_zip | add / replace / remove / rename / setComment without recompressing anything. mode: 'append' keeps the original bytes verbatim (removed content stays recoverable — data remanence, said loudly); mode: 'compact' rewrites so it is truly gone, and canonical: {…} makes that rewrite the canonical deterministic form. The input is opened eagerly in both modes. | |||
canonicalize_zip | Make ANY archive reproducible: the engine's canonicalizeZip() rewrites a Gradle, Maven, zip, Explorer or 7-Zip archive into the canonical deterministic form (sorted by raw name bytes, one timestamp, UTF-8 flags, Zip64-only extras, the constant version-made-by, no data descriptor) without recompressing a payload. Idempotent; summary.canonicalForm is the engine's own analyzeDeterminism() verdict on the output. | |||
merge_zip | 1 to 32 source archives into one without recompressing anything (ZipWriter.addFromReader): with verify: true (the default) every entry is decompressed once and CRC- and size-checked before it is copied, and an entry it cannot check (a method other than store / deflate) is refused (ZIP_UNSUPPORTED_METHOD); per-source filter, name collisions onConflict: 'error' (default, ZIP_DUPLICATE_ENTRY_NAME) \ | 'first' \ | 'last' with the drops reported. Encrypted entries are refused. | |
compute_crc32 | The ZIP checksum (IEEE 802.3 CRC-32, the engine's slice-by-8) of text, base64 or a sandbox file streamed in 1 MiB chunks; seed chains chunks, expect compares. | ✓ | ||
inflate_raw | Raw DEFLATE (RFC 1951) through the engine's resumable inflater with a mandatory `maxOutput` bound: exact bytesConsumed, trailing bytes as leftover. Feed it read_zip_entry mode: 'raw'. | |||
describe_engine | Offline preflight: versions, deflate tiers, runtime codecs (with incremental) and workers, the engine's default limits, the four operator ceilings, every server cap, sandbox / cache state, the 39 error codes and 12 diagnostic codes, the deliberately unexposed engine exports. network is always 'none'. | ✓ | ||
draft_governance_issue | Draft a governance-compliant GitHub issue locally for a human to review and submit — never submits, no network, no GitHub write path. |
What every tool guarantees:
- 🔐 Secure by default — every engine guard is on; a relaxation is an explicit, named input (
rejectTraversal,rejectSymlinks,onDuplicate,limits) that skips, never emits an unsafe path or materialises a link. Overlaps, central/local divergence and Zip64 spoofing have no opt-out at all. - 🌐 No network, ever — the server has no network code path: no telemetry, no GitHub, no URL from any argument, no remote byte-range source, no operator-configurable endpoint. The only filesystem boundary is
ZIPNATIVE_MCP_OUTPUT_DIR. - 🔁 Reproducible by default, deterministic on request —
create_zipemits canonical order, DOS-epoch timestamps and UTF-8 names unless you opt out, and every DOS date is written and read in UTC (dosTimeMode: 'utc'), so a pinned date gives the same bytes in Paris and on a UTC runner;compression.deterministic: truepins the pure-TypeScript encoder for the same SHA-256 on every runtime and is the only setting under whichsummary.deterministicistrue;canonicalize_zipbrings any foreign archive into the canonical form;parallelis byte-identical. - 🧭 **Frozen
ZIP_*error codes, verbatim** — the engine's 39-code vocabulary reaches you unchanged in_meta.error.code(with the entry name, the limit that fired, both CRCs, …), plus the 17 wrapper codes, each with a remedy. Branch on the code, never on the message. - 🪙 Token-frugal projections — the read tools accept
verbosity: 'summary'andfields: […]; a produced archive arrives as an embeddedresourceblock, never instructuredContent(the block carries the bytes inbloband repeats them in itsdata:URI, sooutputMode: 'file'— aresource_link— is the token-frugal choice for anything sizeable). - ⏹ Cancellable, with progress — the request's cancellation signal and, when the client sends a
progressToken, a progress sink reach every tool whose work scales with its input exceptverify_zip(zipnative'sverifyZipis synchronous and takes no signal: a verify runs to completion and returns its report). A cancelled call is never cached and a partial output file is removed; over MCP the SDK sends no response to a cancelled request (CANCELLEDis the in-process code). - 📏 ISO/IEC 21320-1 conformance gate — every archive the tools write is validated clause by clause by an engine-independent validator (veraZIP) on Linux and Windows in CI and again before publish.
All archive-producing tools (create_zip, modify_zip, canonicalize_zip, merge_zip; inflate_raw for raw bytes) support two output modes:
- `base64` *(default)* — the archive is returned as an embedded
resourcecontent block: the bytes are inresource.blob, andresource.urirepeats them as adata:application/zip;base64,…URI (unchanged since 1.0.0, so a client that decodes the URI keeps working) — the archive therefore travels twice in the block;structuredContentcarries{ mode, sizeBytes, summary, diagnostics, diagnosticCounts }, never the bytes. - `file` — the archive is streamed into a sandboxed directory configured via
ZIPNATIVE_MCP_OUTPUT_DIR(≤ 4 GiB by default,ZIPNATIVE_MCP_MAX_FILE_OUTPUT_BYTESmoves the ceiling; never overwritten) and the result carries aresource_link(the cheapest response;structuredContent.filePathand the text line give the file's absolute host path, as in 1.0.0). File I/O is disabled unless this variable is set; absolute paths, traversal, non-container extensions and NUL bytes are all rejected, and the **rea
只显示了开头部分；其余内容请在仓库中阅读