Skip to content

io.github.theluckystrike/zip-archive-create-extract-bomb-guard

by theluckystrike · remote · local (mcpb) · no sign-in to list tools · v0.22.6 · published by GitHub user theluckystrike

Create, inspect and extract zip archives offline, with traversal, symlink and zip-bomb guards.

Deletes · 1Final · 1Changes · 8
CompareRegistry entry

12 tools: 1 can delete or cancel things, 1 do something that can't be undone, 8 change things and 2 only read.

Scanned Oct 21, 2026

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http zip-archive-create-extract-bomb-guard https://mcp.zovo.one/mcp/zip --header 'Authorization: <your-authorization>'

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • Warnzip_list

    The server marks "zip_list" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "zip_list" says "list": a word for reading.

    What this check looks for
  • Warnzip_history

    The server marks "zip_history" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The description's first verb is "list": a word for reading.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

12 tools

Deletes or cancels 1Claude Code: deny
  • zip_delete_uploadDelete one uploaded file stored for your token.No findings

    Why it is in this group

    • The name "zip_delete_upload" says "delete": a word for removing or ending something.
    Description, as the server wrote it
    Delete one uploaded file stored for your token. The register rows zip_history lists are kept.
Can't be undone 1Claude Code: ask
  • zip_uploadSend a file to this hosted endpoint.No findings

    Why it is in this group

    • The name "zip_upload" says "upload": a word for a change.
    • The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
    Description, as the server wrote it
    Send a file to this hosted endpoint. There is no filesystem here, so instead of a path you upload the file once with zip_upload and then pass its name wherever a path is asked for: an archive to zip_list, zip_extract, zip_extract_text or zip_add, a plain file to zip_create. Give exactly one of content_base64 (the file's bytes, the only paste form an archive can take), content (text, for a text file to pack) or url. url: fetch a public file instead of pasting base64 (recommended above about 10 KB): the url is fetched here with a 10 second timeout, at most 3 redirects, public http(s) hosts only, and a 1 MB cap, and a name ending .zip is checked for the PK magic before anything is stored. Uploads are kept for your token between calls; zip_files lists them and zip_delete_upload removes one. The request body cap is 256 KB, so the practical ceiling on a paste is about 190 KB of file once it is base64 inside a JSON-RPC envelope.
Changes things 8Claude Code: ask
  • license_activateTurn Pro on for this connection with key, an MCPL1.<payload>.<signature> issued at checkout for this server or the bundle.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Turn Pro on for this connection with key, an MCPL1.<payload>.<signature> issued at checkout for this server or the bundle. Data under your token stays; a wrong or expired key changes nothing. license_status confirms it.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • zip_addCall this tool to add files to an existing archive under their own names, or under prefix.No findings

    Why it is in this group

    • The name "zip_add" says "add": a word for a change.
    Description, as the server wrote it
    Call this tool to add files to an existing archive under their own names, or under prefix. A name clash is refused unless replace. An archive holding unsafe entries is refused rather than rewritten.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • zip_bundle_monthLocal (stdio) install only.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Local (stdio) install only. On this hosted endpoint /mcp/invoice, /mcp/quotes, /mcp/expense-tracker, /mcp/docx and /mcp/resume return their documents as one-hour download links and keep no output folder to read, so there is nothing for this tool to bundle. Pack the files with zip_upload plus zip_create instead.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • zip_createCall this tool to pack files uploaded with zip_upload into a new .zip and get a download link valid for one hour.No findings

    Why it is in this group

    • The name "zip_create" says "create": a word for a change.
    Description, as the server wrote it
    Call this tool to pack files uploaded with zip_upload into a new .zip and get a download link valid for one hour. Entry names are always relative, so the archive cannot write outside where it is unpacked.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • zip_extractCall this tool to unpack an archive; every entry comes back as its own download link valid for one hour.No findings

    Why it is in this group

    • The description's first verb is "call": a word for a change.
    Description, as the server wrote it
    Call this tool to unpack an archive; every entry comes back as its own download link valid for one hour. Traversal, absolute-path and symlink entries are refused, a size and ratio cap stops a zip bomb, and dry_run reports exactly what would be written.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • zip_extract_textCall this tool to read one text entry out of an archive without unpacking anything: give the entry name and the text comes back inline.No findings

    Why it is in this group

    • The description's first verb is "call": a word for a change.
    Description, as the server wrote it
    Call this tool to read one text entry out of an archive without unpacking anything: give the entry name and the text comes back inline. Binary entries are refused by name rather than printed as noise.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • zip_historyList the archives created for your token, newest first, with entry counts, sizes and names, plus how much of the free 20 a month is used.1 finding

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "zip_history" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The description's first verb is "list": a word for reading.

      What this check looks for
    Description, as the server wrote it
    List the archives created for your token, newest first, with entry counts, sizes and names, plus how much of the free 20 a month is used. Each download link expires after an hour; the row keeps the name.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • zip_listCall this tool to list an archive's entries with sizes and ratios and flag what is dangerous: absolute paths, .., symlinks, encrypted entries, duplicate names and bombs.1 finding

    Why it is in this group

    • The name "zip_list" says "list": a word for reading.
    • The description's first verb is "call": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "zip_list" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "zip_list" says "list": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Call this tool to list an archive's entries with sizes and ratios and flag what is dangerous: absolute paths, .., symlinks, encrypted entries, duplicate names and bombs. Read-only. Run it before zip_extract.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 2Claude Code: allow
  • license_statusReport this endpoint's licence state for your token as JSON: the product, the tier free or pro, why it is not Pro, and the checkout URL.No findings

    Why it is in this group

    • The name "license_status" says "status": a word for reading.
    Description, as the server wrote it
    Report this endpoint's licence state for your token as JSON: the product, the tier free or pro, why it is not Pro, and the checkout URL. Call it to explain a free-tier refusal. No arguments, nothing changes.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • zip_filesList the files stored for your token on this endpoint, with their sizes.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List the files stored for your token on this endpoint, with their sizes. These are the names every path argument here resolves against.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.22.6. Values in angle brackets are yours to fill in.

claude mcp add --transport http zip-archive-create-extract-bomb-guard https://mcp.zovo.one/mcp/zip --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__zip-archive-create-extract-bomb-guard__license_status",
      "mcp__zip-archive-create-extract-bomb-guard__zip_files"
    ],
    "ask": [
      "mcp__zip-archive-create-extract-bomb-guard__license_activate",
      "mcp__zip-archive-create-extract-bomb-guard__zip_upload",
      "mcp__zip-archive-create-extract-bomb-guard__zip_create",
      "mcp__zip-archive-create-extract-bomb-guard__zip_list",
      "mcp__zip-archive-create-extract-bomb-guard__zip_extract",
      "mcp__zip-archive-create-extract-bomb-guard__zip_add",
      "mcp__zip-archive-create-extract-bomb-guard__zip_extract_text",
      "mcp__zip-archive-create-extract-bomb-guard__zip_bundle_month",
      "mcp__zip-archive-create-extract-bomb-guard__zip_history"
    ],
    "deny": [
      "mcp__zip-archive-create-extract-bomb-guard__zip_delete_upload"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as zip-archive-create-extract-bomb-guard. Review it before you use it.