# zipnative MCP — ZIP creation, inspection, secure extraction & verification (npm · zipnative-mcp)

ZIP MCP server: create, inspect, verify, extract securely, modify without recompression. 13 tools

- Trust score: 88/100 (high trust)
- Change this week: +6
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-21

## Components

- npm · `zipnative-mcp`: 88/100 (this document), [markdown](https://verifymcp.io/servers/nizoka-zipnative-mcp/zipnative-mcp.md), [page](https://verifymcp.io/servers/nizoka-zipnative-mcp/zipnative-mcp)

## Channel facts

- Registry: `npm`
- Package: `zipnative-mcp`
- Version: `1.0.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-21.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 0 of 4 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to Nizoka/zipnative-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 13 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 75/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 9238 tokens (~710/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 47/100
  - Stability observed for 14 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 13 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the zipnative MCP — ZIP creation, inspection, secure… server?

zipnative MCP — ZIP creation, inspection, secure… runs locally as an npm package, launched with npx -y zipnative-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add nizoka-zipnative-mcp -- npx -y zipnative-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "nizoka-zipnative-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "zipnative-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "nizoka-zipnative-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "zipnative-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add nizoka-zipnative-mcp -- npx -y zipnative-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "nizoka-zipnative-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "zipnative-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add nizoka-zipnative-mcp --command npx --arg -y --arg zipnative-mcp
```

### Hermes

```yaml
mcp_servers:
  nizoka-zipnative-mcp:
    command: "npx"
    args: ["-y", "zipnative-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "nizoka-zipnative-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "zipnative-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add nizoka-zipnative-mcp -t stdio -c npx -a -y zipnative-mcp
```

### Other

```json
{
  "mcpServers": {
    "nizoka-zipnative-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "zipnative-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-20 (score 88, +1)

No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-18 (score 87, +1)

No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-16 (score 86, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-15 (score 85, +3)

- [functional improvement] Stability: unverified → 0.27

### 2026-09-07 (score 82)

First indexed and scored.

## MCP tools (13)

### `inspect_zip` (~754 tokens)

Inspect archive (facts, determinism verdict, CI checks)

Read-only archive report in ONE call: size, entry / file / directory counts, Zip64, comment, compressed vs uncompressed totals, per-method counts, encrypted / symlink / data-descriptor / Zip64 / cp437 / duplicate / unsafe-name counts, date range, a `determinism` verdict (epoch timestamps + canonical order + UTF-8 flags ⇒ reproducible; `canonicalLayout` = no data descriptors) and every engine diagnostic (prepended SFX data, name mismatches, …). Opens EAGERLY by default: every entry's real extent is checked up front — overlapping entries, entries reaching into the central directory or past EOF, and Zip64 spoofing — and refused with their ZIP_* code rather than summarised (a method / CRC / size divergence between central and local headers is caught by verify_zip and on read, not here). `check:[…]` / `assert:{…}` turn it into a CI gate → `checks[]` + `checksPassed`. Token-frugal: verbosity:'summary', fields:[…]. Input: zipBase64 or zipPath (sandbox).

Input parameters:

- `assert` (object): Parametrised assertions (each becomes a `checks[]` row).
- `check` (array): CI assertions evaluated over the report: deterministic, epoch-timestamps, canonical-order, utf8-names, no-data-descriptor, canonical-layout, no-zip64, zip64, no-encryption, no-symlinks, safe-names, n…
- `fields` (array): Dot-path projection applied after verbosity (e.g. ['entryCount', 'entries.name']); array segments map over elements; unmatched paths are reported in _meta.unmatchedFields.
- `limits` (object): Override zipnative's named security bounds for this call (CWE-400 / CWE-409 guards). Every key is optional; absent keys keep the engine defaults (maxEntries 100000, maxEntryUncompressedSize 1 GiB, ma…
- `strict` (boolean): Escalate the first engine diagnostic (prepended data, duplicate name, name mismatch, …) to a ZIP_STRICT_DIAGNOSTIC error instead of reporting it.
- `validate` (string): 'eager' (default) cross-checks every local header and the overlap table up front — hostile shapes are refused here; 'lazy' defers to first read (cheaper on huge archives).
- `verbosity` (string): 'summary' returns only the scalar verdict fields (drops arrays and payloads) — the token-frugal form.
- `zipBase64` (string): The archive bytes as base64 (exactly once; a data: URI prefix is tolerated). Exclusive with zipPath. Decoded size ≤ 128 MiB.
- `zipPath` (string): Relative path of an archive inside the ZIPNATIVE_MCP_OUTPUT_DIR sandbox (no absolute paths, no '..'; container extensions only: .zip .jar .docx .epub …). Exclusive with zipBase64. Lets a create/modif…

Output parameters:

- `archiveBytes` (integer)
- `canonicalLayout` (boolean): summary only: buffered (no data descriptor) layout.
- `checks` (array)
- `checksPassed` (boolean): Present when check / assert was supplied: true when every assertion holds.
- `comment` (string): Archive comment (UTF-8, lossy).
- `commentBytes` (integer)
- `commentHex` (string)
- `compressedBytes` (integer)
- `cp437NameCount` (integer)
- `dataDescriptorCount` (integer)
- `determinism` (object): `deterministic` = reproducible (epoch timestamps + canonical order + UTF-8 flags); `canonicalLayout` = the buffered layout (no data descriptors) — a streamed archive is reproducible but not canonical.
- `deterministic` (boolean): summary only: the determinism verdict.
- `diagnosticCount` (integer): summary only: number of distinct diagnostics.
- `diagnosticCounts` (object): Number of diagnostics received per code (counts every occurrence, including de-duplicated ones).
- `diagnostics` (array): Non-fatal conformance concerns the engine raised while parsing or writing (de-duplicated by code + entry, at most 200). Empty for a clean archive. Codes: ZIP_PREPENDED_DATA, ZIP_MULTIPLE_EOCD, ZIP_NA…
- `diagnosticsTruncated` (boolean): Present (true) when more than 200 distinct diagnostics were dropped from `diagnostics`.
- `directoryCount` (integer)
- `duplicateNameCount` (integer)
- `earliestDate` (string|null)
- `encryptedCount` (integer)
- `entryCount` (integer)
- `fileCount` (integer)
- `isZip64` (boolean): A Zip64 end-of-central-directory record is present.
- `latestDate` (string|null)
- `methods` (array)
- `multipleEocd` (boolean)
- `prependedData` (boolean): SFX-style prefix before the first local header (offsets shifted).
- `ratio` (string)
- `symlinkCount` (integer)
- `uncompressedBytes` (integer)
- `unsafeNameCount` (integer): Names sanitizeEntryPath() refuses (traversal, absolute, drive/UNC, NUL, ADS, device names).
- `utf8NameCount` (integer)
- `zip64EntryCount` (integer)

### `list_zip_entries` (~716 tokens)

List entries (paged inventory)

Read-only central-directory inventory without decompressing anything: every entry (duplicates included) in directory order as a full row — name + encoding, sizes, ratio, CRC-32, method, timestamp, decoded flags, Unix mode, symlink, Zip64, data descriptor, host system, offsets, named extra fields, the sanitized path an extraction would use (null = unsafe name), comment. `filter` selects by exact names / prefix / globs; `offset` + `limit` page (default 200, max 2000, `hasMore`). Prefer inspect_zip for a one-shot summary and read_zip_entry / extract_zip for content. Token-frugal: verbosity:'summary' → names only; fields:[…].

Input parameters:

- `fields` (array): Dot-path projection applied after verbosity (e.g. ['entryCount', 'entries.name']); array segments map over elements; unmatched paths are reported in _meta.unmatchedFields.
- `filter` (object): Select entries by name. `names` (exact, case-sensitive), `prefix` (path prefix) and `glob` (patterns: `*` within a segment, `**` across segments, `?` one character; a pattern without `/` matches at a…
- `includeExtraData` (boolean): Include each extra field payload as base64 (forensics).
- `limit` (integer): Return at most this many entries (default 200, max 2000); `hasMore` tells you to page.
- `limits` (object): Override zipnative's named security bounds for this call (CWE-400 / CWE-409 guards). Every key is optional; absent keys keep the engine defaults (maxEntries 100000, maxEntryUncompressedSize 1 GiB, ma…
- `offset` (integer): Skip this many matching entries (paging).
- `strict` (boolean): Escalate the first engine diagnostic (prepended data, duplicate name, name mismatch, …) to a ZIP_STRICT_DIAGNOSTIC error instead of reporting it.
- `validate` (string): 'lazy' (default) parses the central directory only; 'eager' also cross-checks every local header up front.
- `verbosity` (string): 'summary' returns only the scalar verdict fields (drops arrays and payloads) — the token-frugal form.
- `zipBase64` (string): The archive bytes as base64 (exactly once; a data: URI prefix is tolerated). Exclusive with zipPath. Decoded size ≤ 128 MiB.
- `zipPath` (string): Relative path of an archive inside the ZIPNATIVE_MCP_OUTPUT_DIR sandbox (no absolute paths, no '..'; container extensions only: .zip .jar .docx .epub …). Exclusive with zipBase64. Lets a create/modif…

Output parameters:

- `diagnosticCount` (integer): summary only: number of distinct diagnostics.
- `diagnosticCounts` (object): Number of diagnostics received per code (counts every occurrence, including de-duplicated ones).
- `diagnostics` (array): Non-fatal conformance concerns the engine raised while parsing or writing (de-duplicated by code + entry, at most 200). Empty for a clean archive. Codes: ZIP_PREPENDED_DATA, ZIP_MULTIPLE_EOCD, ZIP_NA…
- `diagnosticsTruncated` (boolean): Present (true) when more than 200 distinct diagnostics were dropped from `diagnostics`.
- `entries` (array)
- `entryCount` (integer): Entries in the central directory (before filtering).
- `hasMore` (boolean)
- `isZip64` (boolean)
- `limit` (integer)
- `matchedCount` (integer): Entries kept by the filter (before paging).
- `names` (array): summary only: the names on this page.
- `offset` (integer)
- `returnedCount` (integer)

### `read_zip_entry` (~739 tokens)

Read one entry (random access)

Read ONE entry without extracting the archive, by `name` (exact; the last duplicate wins) or `index` (central-directory position — disambiguates duplicates). mode 'data' (default): decompressed content as base64 or UTF-8 `text` (encoding:'utf8'; ENTRY_NOT_UTF8 otherwise), CRC-verified; a `range` {offset,length} reads a byte window through the chunked stream (bounded memory, no CRC). mode 'raw': the compressed payload verbatim (feed it to inflate_raw). mode 'verify': CRC / size / local-header agreement only. Inline cap 16 MiB per entry (ENTRY_TOO_LARGE → use a range or extract_zip file mode). Encrypted entries → ZIP_UNSUPPORTED_ENCRYPTION (no decryption in this engine).

Input parameters:

- `encoding` (string): Content encoding for mode 'data': base64 (default) or UTF-8 text (invalid UTF-8 → ENTRY_NOT_UTF8).
- `fields` (array): Dot-path projection applied after verbosity (e.g. ['entryCount', 'entries.name']); array segments map over elements; unmatched paths are reported in _meta.unmatchedFields.
- `index` (integer): Central-directory position (from list_zip_entries) — disambiguates duplicate names. Exclusive with name.
- `limits` (object): Override zipnative's named security bounds for this call (CWE-400 / CWE-409 guards). Every key is optional; absent keys keep the engine defaults (maxEntries 100000, maxEntryUncompressedSize 1 GiB, ma…
- `mode` (string): 'data' (default): decompressed content; 'raw': the compressed payload bytes verbatim (zero-copy, no decompression); 'verify': CRC / size / local-header check only, no payload.
- `name` (string): Entry name (exact, case-sensitive; the LAST duplicate wins). Exclusive with index.
- `range` (object): Read only a byte window of the decompressed content through the chunked stream (bounded memory; CRC is not verified for a window). length ≤ 16777216.
- `strict` (boolean): Escalate the first engine diagnostic (prepended data, duplicate name, name mismatch, …) to a ZIP_STRICT_DIAGNOSTIC error instead of reporting it.
- `verbosity` (string): 'summary' returns only the scalar verdict fields (drops arrays and payloads) — the token-frugal form.
- `verifyCrc` (boolean): Verify the decompressed CRC-32 against the central directory (mode data, no range).
- `zipBase64` (string): The archive bytes as base64 (exactly once; a data: URI prefix is tolerated). Exclusive with zipPath. Decoded size ≤ 128 MiB.
- `zipPath` (string): Relative path of an archive inside the ZIPNATIVE_MCP_OUTPUT_DIR sandbox (no absolute paths, no '..'; container extensions only: .zip .jar .docx .epub …). Exclusive with zipBase64. Lets a create/modif…

Output parameters:

- `crcVerified` (boolean)
- `dataBase64` (string)
- `diagnosticCount` (integer): summary only: number of distinct diagnostics.
- `diagnosticCounts` (object): Number of diagnostics received per code (counts every occurrence, including de-duplicated ones).
- `diagnostics` (array): Non-fatal conformance concerns the engine raised while parsing or writing (de-duplicated by code + entry, at most 200). Empty for a clean archive. Codes: ZIP_PREPENDED_DATA, ZIP_MULTIPLE_EOCD, ZIP_NA…
- `diagnosticsTruncated` (boolean): Present (true) when more than 200 distinct diagnostics were dropped from `diagnostics`.
- `encoding` (string)
- `entry` (object)
- `index` (integer): summary only: the entry index.
- `mode` (string)
- `name` (string): summary only: the entry name.
- `range` (object)
- `sizeBytes` (integer): Bytes returned (data / raw) or the declared uncompressed size (verify).
- `text` (string)
- `textLength` (integer)
- `verification` (object)

### `verify_zip` (~606 tokens)

Verify archive integrity (one call, never throws for archive problems)

Deep verification in one call — zipnative's verifyZip report verbatim: eager structural validation, then every entry's CRC-32 / size / local-header agreement. `ok` is true when the structure is valid AND every verifiable entry passed. This tool NEVER fails for a problem with the archive: a structural refusal lands in `error` {code: ZIP_*, message}; an unverifiable entry is `skipped` ('encrypted' | 'stream-only-codec') and does not fail the archive, while an entry whose method has no codec here (anything but 0 store / 8 deflate) is reported FAILED, not skipped — the engine's verdict verbatim. Only caller mistakes (bad limits, bad input) are isError. `entries:'failed'` keeps the rows you act on; `verbosity:'summary'` keeps the verdict + counts. Verify before you trust: run it on any archive from an untrusted source before extract_zip.

Input parameters:

- `entries` (string): Which per-entry rows to return: 'all' (default), only 'failed' (ok:false, not skipped), only 'skipped', or 'none' (verdict + counts only).
- `fields` (array): Dot-path projection applied after verbosity (e.g. ['entryCount', 'entries.name']); array segments map over elements; unmatched paths are reported in _meta.unmatchedFields.
- `limits` (object): Override zipnative's named security bounds for this call (CWE-400 / CWE-409 guards). Every key is optional; absent keys keep the engine defaults (maxEntries 100000, maxEntryUncompressedSize 1 GiB, ma…
- `maxEntries` (integer): Cap on returned rows (the counts always cover every entry); `entriesTruncated` flags a cut.
- `verbosity` (string): 'summary' returns only the scalar verdict fields (drops arrays and payloads) — the token-frugal form.
- `zipBase64` (string): The archive bytes as base64 (exactly once; a data: URI prefix is tolerated). Exclusive with zipPath. Decoded size ≤ 128 MiB.
- `zipPath` (string): Relative path of an archive inside the ZIPNATIVE_MCP_OUTPUT_DIR sandbox (no absolute paths, no '..'; container extensions only: .zip .jar .docx .epub …). Exclusive with zipBase64. Lets a create/modif…

Output parameters:

- `diagnosticCount` (integer): summary only: number of diagnostics.
- `diagnostics` (array): Non-fatal conformance concerns the engine raised while parsing or writing (de-duplicated by code + entry, at most 200). Empty for a clean archive. Codes: ZIP_PREPENDED_DATA, ZIP_MULTIPLE_EOCD, ZIP_NA…
- `entries` (array)
- `entriesTruncated` (boolean)
- `entryCount` (integer)
- `error` (object|null): The structural refusal when the archive could not even be opened (frozen ZIP_* code + engine message), else null.
- `failedCount` (integer): Entries with a CRC / size / local-header mismatch.
- `ok` (boolean)
- `skippedCount` (integer): Entries that could not be verified (encrypted, stream-only codec).
- `verifiedCount` (integer): Entries that passed every check.

### `extract_zip` (~1037 tokens)

Extract (secure by default)

Extract with every engine guard ON unless you name the relaxation: zip-slip / absolute / drive / UNC / NUL / ADS / Windows-device names → ZIP_PATH_TRAVERSAL (rejectTraversal:false SKIPS them, listed in `skipped`; an unsafe path is never emitted); symlinks → ZIP_SYMLINK_REJECTED (rejectSymlinks:false extracts the target text as data, never a link); duplicate sanitized paths → ZIP_EXTRACT_DUPLICATE_PATH (onDuplicate 'first' | 'last'); declared sizes / ratios beyond `limits` → ZIP_LIMIT_EXCEEDED; overlapping entries and central/local divergence are always refused. `filter` keeps a subset. outputMode 'base64' (default) returns files inline (≤ 16 MiB each, ≤ 32 MiB total; includeData:false = dry run of the plan); 'file' streams into a relative `outputDir` inside ZIPNATIVE_MCP_OUTPUT_DIR (never overwrites) and returns resource links. Directories are implied by paths (emptyDirectories:true creates the explicit ones). The dry run opens eagerly: an overlapping, offset-into-CD or Zip64-spoofed archive is refused before any plan is returned. Prefer read_zip_entry for a single file.

Input parameters:

- `emptyDirectories` (boolean): file mode: also create explicit directory entries (with a safe name) that hold no file.
- `fields` (array): Dot-path projection applied after verbosity (e.g. ['entryCount', 'entries.name']); array segments map over elements; unmatched paths are reported in _meta.unmatchedFields.
- `filter` (object): Select entries by name. `names` (exact, case-sensitive), `prefix` (path prefix) and `glob` (patterns: `*` within a segment, `**` across segments, `?` one character; a pattern without `/` matches at a…
- `includeData` (boolean): base64 mode: false = dry run — list what WOULD be extracted (paths, sizes) without decompressing or returning bytes.
- `limits` (object): Override zipnative's named security bounds for this call (CWE-400 / CWE-409 guards). Every key is optional; absent keys keep the engine defaults (maxEntries 100000, maxEntryUncompressedSize 1 GiB, ma…
- `onDuplicate` (string): Two entries mapping to the same sanitized path: 'error' (default, ZIP_EXTRACT_DUPLICATE_PATH), keep the 'first', or keep the 'last'.
- `outputDir` (string): Relative directory inside the sandbox to extract into (file mode; created if absent; no absolute paths, no '..').
- `outputMode` (string): 'base64' (default): files inline (≤ 16777216 bytes each, ≤ 33554432 bytes total). 'file': stream every file under outputDir inside ZIPNATIVE_MCP_OUTPUT_DIR (never overwrites) and return resource link…
- `rejectSymlinks` (boolean): true (default): a symlink entry fails the call with ZIP_SYMLINK_REJECTED. false: its target text is extracted as ordinary data (never materialised as a link).
- `rejectTraversal` (boolean): true (default): an entry whose name escapes the root (zip-slip, absolute, drive/UNC, NUL, ADS, Windows device name) fails the call with ZIP_PATH_TRAVERSAL. false: such entries are SKIPPED and listed…
- `strict` (boolean): Escalate the first engine diagnostic (prepended data, duplicate name, name mismatch, …) to a ZIP_STRICT_DIAGNOSTIC error instead of reporting it.
- `verbosity` (string): 'summary' returns only the scalar verdict fields (drops arrays and payloads) — the token-frugal form.
- `zipBase64` (string): The archive bytes as base64 (exactly once; a data: URI prefix is tolerated). Exclusive with zipPath. Decoded size ≤ 128 MiB.
- `zipPath` (string): Relative path of an archive inside the ZIPNATIVE_MCP_OUTPUT_DIR sandbox (no absolute paths, no '..'; container extensions only: .zip .jar .docx .epub …). Exclusive with zipBase64. Lets a create/modif…

Output parameters:

- `diagnosticCount` (integer): summary only: number of distinct diagnostics.
- `diagnosticCounts` (object): Number of diagnostics received per code (counts every occurrence, including de-duplicated ones).
- `diagnostics` (array): Non-fatal conformance concerns the engine raised while parsing or writing (de-duplicated by code + entry, at most 200). Empty for a clean archive. Codes: ZIP_PREPENDED_DATA, ZIP_MULTIPLE_EOCD, ZIP_NA…
- `diagnosticsTruncated` (boolean): Present (true) when more than 200 distinct diagnostics were dropped from `diagnostics`.
- `directoriesCreated` (integer)
- `dryRun` (boolean): true when includeData was false: nothing was decompressed.
- `entries` (array): One row per extracted file, in central-directory order. base64 mode carries dataBase64 (unless dryRun); file mode carries filePath.
- `fileCount` (integer)
- `mode` (string)
- `outputDir` (string): Absolute sandbox directory (file mode).
- `paths` (array): summary only: the extracted paths.
- `skipped` (array): Entries skipped because their name is unsafe (only with rejectTraversal:false).
- `skippedCount` (integer): summary only: number of skipped (unsafe-path) entries.
- `totalBytes` (integer): Sum of the extracted (or planned) uncompressed sizes.

### `scan_zip_forward` (~816 tokens)

Scan forward (truncated / unseekable streams — NOT authoritative)

Walk LOCAL headers in stream order with bounded memory (zipnative's central-directory-less reader). The only tool that works on a truncated archive or a stream cut mid-way (it cannot skip an SFX prefix: the stream must start at a local header) — and the only one whose result is NOT authoritative: forward iteration trusts local headers ALONE, so a hostile archive can present different content here than inspect_zip / list_zip_entries report (the upload-scanner differential). Prefer those tools whenever the whole archive is available; use this one for forensics (`tolerateTruncation:true` returns the partial inventory + `error`). data 'none' skips payloads, 'verify' decompresses to check CRCs, 'include' returns them (inline caps). `stoppedAt` tells you whether a central directory was reached. Names are NOT sanitized — `sanitizedPath` shows what the extraction gate would use.

Input parameters:

- `data` (string): 'none' (default): skip payloads (a data-descriptor entry still costs a full decompress-and-discard); 'verify': decompress every kept entry so CRC and sizes are checked; 'include': also return the con…
- `fields` (array): Dot-path projection applied after verbosity (e.g. ['entryCount', 'entries.name']); array segments map over elements; unmatched paths are reported in _meta.unmatchedFields.
- `filter` (object): Select entries by name. `names` (exact, case-sensitive), `prefix` (path prefix) and `glob` (patterns: `*` within a segment, `**` across segments, `?` one character; a pattern without `/` matches at a…
- `limits` (object): Override zipnative's named security bounds for this call (CWE-400 / CWE-409 guards). Every key is optional; absent keys keep the engine defaults (maxEntries 100000, maxEntryUncompressedSize 1 GiB, ma…
- `maxEntries` (integer): Stop after this many local headers (bounded work on an unbounded stream). Default 10000, clamped to the operator ceiling ZIPNATIVE_MCP_MAX_ENTRIES; an explicit value above the ceiling is refused (LIM…
- `strict` (boolean): Escalate the first engine diagnostic (prepended data, duplicate name, name mismatch, …) to a ZIP_STRICT_DIAGNOSTIC error instead of reporting it.
- `tolerateTruncation` (boolean): true: a truncated / corrupt stream ends the scan with `stoppedAt:"error"` and the partial inventory (forensics) instead of failing the call.
- `verbosity` (string): 'summary' returns only the scalar verdict fields (drops arrays and payloads) — the token-frugal form.
- `zipBase64` (string): The archive bytes as base64 (exactly once; a data: URI prefix is tolerated). Exclusive with zipPath. Decoded size ≤ 128 MiB.
- `zipPath` (string): Relative path of an archive inside the ZIPNATIVE_MCP_OUTPUT_DIR sandbox (no absolute paths, no '..'; container extensions only: .zip .jar .docx .epub …). Exclusive with zipBase64. Lets a create/modif…

Output parameters:

- `bytesDelivered` (integer): Bytes handed to the forward reader.
- `diagnosticCount` (integer): summary only: number of distinct diagnostics.
- `diagnosticCounts` (object): Number of diagnostics received per code (counts every occurrence, including de-duplicated ones).
- `diagnostics` (array): Non-fatal conformance concerns the engine raised while parsing or writing (de-duplicated by code + entry, at most 200). Empty for a clean archive. Codes: ZIP_PREPENDED_DATA, ZIP_MULTIPLE_EOCD, ZIP_NA…
- `diagnosticsTruncated` (boolean): Present (true) when more than 200 distinct diagnostics were dropped from `diagnostics`.
- `entries` (array)
- `entryCount` (integer): Local headers seen (before the filter).
- `error` (object)
- `inputBytes` (integer|null)
- `keptCount` (integer)
- `maxEntries` (integer): The header budget in force (after clamping to the operator ceiling).
- `names` (array): summary only: the kept entry names.
- `stoppedAt` (string): 'central-directory' is the normal end of a complete archive; 'eof' means the stream ended before any central directory (truncated or CD-less); 'max-entries' means more local headers remained.
- `truncated` (boolean): true when the stream ended without reaching a central directory.
- `trust` (string): Constant reminder: nothing here was cross-checked against a central directory.

### `sanitize_entry_paths` (~200 tokens)

Sanitize entry paths (the traversal gate)

Apply zipnative's single traversal gate `sanitizeEntryPath()` to a list of names: the safe '/'-separated relative form each maps to (join it under your extraction root — never the raw name), or null with the rule that fired (empty, NUL byte, absolute, drive letter, UNC, '..' traversal, NTFS alternate data stream ':', Windows reserved device name CON/NUL/COM1…). Use it when you extract with another tool or plan an external filesystem sink. No archive needed.

Input parameters:

- `fields` (array): Dot-path projection applied after verbosity (e.g. ['entryCount', 'entries.name']); array segments map over elements; unmatched paths are reported in _meta.unmatchedFields.
- `names` (array, required): Entry names to check (as stored in an archive).
- `verbosity` (string): 'summary' returns only the scalar verdict fields (drops arrays and payloads) — the token-frugal form.

Output parameters:

- `count` (integer)
- `rejectedCount` (integer)
- `rejectedNames` (array): summary only: the rejected names.
- `results` (array)

### `create_zip` (~960 tokens)

Create archive (reproducible; deterministic:true for cross-runtime identical bytes)

Write a ZIP from inline entries (`dataBase64` | `text` | `sourcePath` in the sandbox, or `directory:true`). Reproducible by default: canonical order (raw UTF-8 name bytes), DOS-epoch timestamps, UTF-8 names, constant attributes — `defaultDate:'now'` or per-entry `date` opts out (ZIP_TIMESTAMP_NOT_PINNED diagnostic). `compression` {method store|deflate, level 0–9, deterministic:true = pinned pure-TS encoder ⇒ identical bytes on every runtime} at archive or entry level; `order:'insertion'` for EPUB / JAR (mimetype first, stored); `comment`, per-entry comment / unixMode / externalAttributes / raw extraFields. `stream:true` on a sourcePath feeds the file through addStream (data-descriptor layout, bounded memory). `parallel` compresses with the worker pool — byte-identical output. Zip64 is emitted exactly when a field overflows. Output base64 (≤ 50 MiB) or a sandbox file (streamed, never overwritten); `summary.deterministic` is true ONLY with compression.deterministic:true (cross-runtime identity); a default call is reproducible on the same runtime (`deflateTier` 'node-zlib') and reports false; `sha256` (includeSha256, base64 and file modes) is the proof. Every archive it writes is ISO/IEC 21320-1 conformant (CI-validated).

Input parameters:

- `chunkSize` (integer): file mode: output chunk size for the streaming assembler (default 64 KiB). Never changes the bytes.
- `comment` (string): Archive comment (UTF-8, ≤ 65535 bytes).
- `compression` (object): Compression settings. `method` 'deflate' (default) or 'store'; `level` 0–9 (default 6); `deterministic: true` pins the pure-TS encoder so the bytes are identical on every runtime (slower).
- `defaultDate` (string): Timestamp for entries that set no `date`: an ISO-8601 instant (1980-01-01 … 2107-12-31, 2-second DOS granularity) or 'now' (wall clock — emits the ZIP_TIMESTAMP_NOT_PINNED diagnostic and makes the by…
- `entries` (array, required): The entries to write (0–100000; an empty array writes a valid empty archive). Each takes exactly one of dataBase64 / text / sourcePath, or directory: true.
- `includeSha256` (boolean): Add `summary.sha256` of the produced bytes (determinism proofs).
- `limits` (object): Override zipnative's named security bounds for this call (CWE-400 / CWE-409 guards). Every key is optional; absent keys keep the engine defaults (maxEntries 100000, maxEntryUncompressedSize 1 GiB, ma…
- `order` (string): 'canonical' (default): entries sorted by raw UTF-8 name bytes (reproducible). 'insertion': call order preserved (EPUB / JAR mimetype-first layouts).
- `outputMode` (string): 'base64' (default) returns the bytes inline as an embedded resource (≤ 50 MiB). 'file' writes them inside ZIPNATIVE_MCP_OUTPUT_DIR (never overwrites; ≤ 4 GiB, streamed) and returns a resource_link.
- `outputPath` (string): Relative path inside the sandbox (only when outputMode='file'); must end in a container extension (.zip recommended).
- `parallel` (object): Compress with the worker pool (zipnative/worker). Byte-identical to the sequential writer; only worth it for many large entries. `workers` 0 keeps everything on the calling thread.
- `strict` (boolean): Escalate the first engine diagnostic (prepended data, duplicate name, name mismatch, …) to a ZIP_STRICT_DIAGNOSTIC error instead of reporting it.

Output parameters:

- `diagnosticCounts` (object): Number of diagnostics received per code (counts every occurrence, including de-duplicated ones).
- `diagnostics` (array): Non-fatal conformance concerns the engine raised while parsing or writing (de-duplicated by code + entry, at most 200). Empty for a clean archive. Codes: ZIP_PREPENDED_DATA, ZIP_MULTIPLE_EOCD, ZIP_NA…
- `diagnosticsTruncated` (boolean): Present (true) when more than 200 distinct diagnostics were dropped from `diagnostics`.
- `filePath` (string): Sandboxed absolute path (file mode).
- `mode` (string)
- `sizeBytes` (integer)
- `summary` (object): create_zip summary.

### `modify_zip` (~864 tokens)

Modify archive (incremental, no recompression)

Edit an existing archive without recompressing anything: operations add / replace / remove / rename / setComment applied in order. mode 'append' (default) = save(): the original bytes stay verbatim and edits are appended — fast and byte-preserving, BUT removed or replaced payloads REMAIN in the file (data remanence: recoverable by anyone; a ZIP_DEAD_BYTES_RATIO diagnostic fires past 50 % dead bytes, and 7-Zip is known to read the stale payload). mode 'compact' = saveCompact(): canonical rewrite, still no recompression, removed data truly gone, SFX prefix dropped. No edits and an unchanged comment return the same bytes (`summary.noOp`). Archives with duplicate entry names are refused — prefer create_zip for a full rebuild or when the source has duplicate names. Output base64 or a sandbox file.

Input parameters:

- `compression` (object): Compression settings. `method` 'deflate' (default) or 'store'; `level` 0–9 (default 6); `deterministic: true` pins the pure-TS encoder so the bytes are identical on every runtime (slower).
- `defaultDate` (string): Timestamp for entries that set no `date`: an ISO-8601 instant (1980-01-01 … 2107-12-31, 2-second DOS granularity) or 'now' (wall clock — emits the ZIP_TIMESTAMP_NOT_PINNED diagnostic and makes the by…
- `includeSha256` (boolean): Add `summary.sha256` of the produced bytes.
- `limits` (object): Override zipnative's named security bounds for this call (CWE-400 / CWE-409 guards). Every key is optional; absent keys keep the engine defaults (maxEntries 100000, maxEntryUncompressedSize 1 GiB, ma…
- `mode` (string): 'append' (default): save() — original bytes verbatim + appended entries + new central directory; removed/replaced payloads REMAIN in the file (data remanence). 'compact': saveCompact() — canonical re…
- `operations` (array, required): Edits applied in order. add: new entry (ZIP_ENTRY_EXISTS if present); replace: existing entry (ZIP_ENTRY_NOT_FOUND otherwise); remove; rename (never overwrites: remove the target first); setComment.
- `outputMode` (string): 'base64' (default) returns the bytes inline as an embedded resource (≤ 50 MiB). 'file' writes them inside ZIPNATIVE_MCP_OUTPUT_DIR (never overwrites; ≤ 4 GiB, streamed) and returns a resource_link.
- `outputPath` (string): Relative path inside the sandbox (only when outputMode='file'); must end in a container extension (.zip recommended).
- `strict` (boolean): Escalate the first engine diagnostic (prepended data, duplicate name, name mismatch, …) to a ZIP_STRICT_DIAGNOSTIC error instead of reporting it.
- `zipBase64` (string): The archive bytes as base64 (exactly once; a data: URI prefix is tolerated). Exclusive with zipPath. Decoded size ≤ 128 MiB.
- `zipPath` (string): Relative path of an archive inside the ZIPNATIVE_MCP_OUTPUT_DIR sandbox (no absolute paths, no '..'; container extensions only: .zip .jar .docx .epub …). Exclusive with zipBase64. Lets a create/modif…

Output parameters:

- `diagnosticCounts` (object): Number of diagnostics received per code (counts every occurrence, including de-duplicated ones).
- `diagnostics` (array): Non-fatal conformance concerns the engine raised while parsing or writing (de-duplicated by code + entry, at most 200). Empty for a clean archive. Codes: ZIP_PREPENDED_DATA, ZIP_MULTIPLE_EOCD, ZIP_NA…
- `diagnosticsTruncated` (boolean): Present (true) when more than 200 distinct diagnostics were dropped from `diagnostics`.
- `filePath` (string): Sandboxed absolute path (file mode).
- `mode` (string)
- `sizeBytes` (integer)
- `summary` (object): modify_zip summary.

### `compute_crc32` (~222 tokens)

Compute CRC-32

The ZIP checksum (IEEE 802.3 CRC-32, the engine's slice-by-8 implementation) of inline bytes / text or a sandbox file (streamed in 1 MiB chunks). `seed` continues a running CRC across consecutive chunks; `expect` compares against a known value (`matches`). Use it to cross-check an entry's crc32 from list_zip_entries against a file on disk.

Input parameters:

- `dataBase64` (string): Bytes as base64. Exclusive with text / sourcePath.
- `expect` (string): Optional expected CRC (1–8 hex digits, optional 0x prefix, e.g. '4e08bfb4'); the result carries `matches`.
- `seed` (integer): Running CRC to continue from (chain calls over consecutive chunks).
- `sourcePath` (string): Relative path of a file inside the sandbox (streamed, ≤ 1 GiB). Exclusive with dataBase64 / text.
- `text` (string): UTF-8 text. Exclusive with dataBase64 / sourcePath.

Output parameters:

- `byteLength` (integer)
- `crc32` (integer): Unsigned 32-bit CRC.
- `hex` (string): 8 lowercase hex digits.
- `matches` (boolean): Present when `expect` was given.
- `seed` (integer)

### `inflate_raw` (~434 tokens)

Inflate raw DEFLATE (bounded)

Decompress a raw DEFLATE (RFC 1951) stream — e.g. the payload from read_zip_entry mode:'raw' — with a MANDATORY `maxOutput` bound through zipnative's resumable inflater (constant memory, exact `bytesConsumed`, trailing bytes reported as `leftover`; ZIP_INFLATE_OUTPUT_OVERFLOW past the bound). method 'store' is a bounded pass-through; a numeric method id selects a registered codec (none beyond 0 / 8 in this server → ZIP_UNSUPPORTED_METHOD). Output base64 (≤ 50 MiB) or a sandbox file. Use it only for a raw payload or a bare deflate stream; to read an entry's content prefer read_zip_entry mode:'data'.

Input parameters:

- `allowTrailing` (boolean): Accept bytes after the end of the deflate stream silently (they are always reported as `leftover`).
- `dataBase64` (string): The compressed stream as base64 (e.g. the payload from read_zip_entry mode:"raw"). Exclusive with sourcePath.
- `maxOutput` (integer, required): Mandatory output bound in bytes: decompression stops with ZIP_INFLATE_OUTPUT_OVERFLOW beyond it (zip-bomb guard). Inline results are further capped at 52428800 bytes, file results at 4294967296.
- `method` (string): 'deflate' (default, method 8), 'store' (method 0, bounded pass-through) or a numeric method id for a registered codec.
- `outputMode` (string): 'base64' (default) returns the bytes inline as an embedded resource (≤ 50 MiB). 'file' writes them inside ZIPNATIVE_MCP_OUTPUT_DIR (never overwrites; ≤ 4 GiB, streamed) and returns a resource_link.
- `outputPath` (string): Relative path inside the sandbox (only when outputMode='file'); must end in a container extension (.zip recommended).
- `sourcePath` (string): Relative path of a file inside the sandbox holding the compressed stream (streamed). Exclusive with dataBase64.

Output parameters:

- `diagnosticCounts` (object): Number of diagnostics received per code (counts every occurrence, including de-duplicated ones).
- `diagnostics` (array): Non-fatal conformance concerns the engine raised while parsing or writing (de-duplicated by code + entry, at most 200). Empty for a clean archive. Codes: ZIP_PREPENDED_DATA, ZIP_MULTIPLE_EOCD, ZIP_NA…
- `diagnosticsTruncated` (boolean): Present (true) when more than 200 distinct diagnostics were dropped from `diagnostics`.
- `filePath` (string): Sandboxed absolute path (file mode).
- `mode` (string)
- `sizeBytes` (integer)
- `summary` (object): inflate_raw summary (the produced bytes are application/octet-stream, not an archive).

### `describe_engine` (~234 tokens)

Describe engine & server capabilities

Offline preflight (no archive needed): server / engine / tool-API versions, the deflate tier in use and the pinned deterministic tier, runtime codecs (node:zlib, CompressionStream, DecompressionStream) and worker threads, the codec registry, the engine's default `limits`, the operator ceilings (ZIPNATIVE_MCP_MAX_UNCOMPRESSED_BYTES, ZIPNATIVE_MCP_MAX_ENTRIES, ZIPNATIVE_MCP_WORKERS), every server cap, whether the sandbox and the cache are enabled, the 39 frozen ZIP_* error codes and 11 diagnostic codes, and the engine exports this server deliberately does not expose (with why). `network` is always 'none'. Call it first in a session, or whenever a cap / ceiling refusal needs interpreting.

Input parameters:

- `fields` (array): Dot-path projection applied after verbosity (e.g. ['entryCount', 'entries.name']); array segments map over elements; unmatched paths are reported in _meta.unmatchedFields.
- `verbosity` (string): 'summary' returns only the scalar verdict fields (drops arrays and payloads) — the token-frugal form.

Output parameters:

- `capabilities` (object)
- `caps` (object)
- `ceilings` (object)
- `codecs` (array)
- `defaultLimits` (object)
- `diagnosticCodes` (array)
- `engine` (object)
- `errorCodes` (array)
- `network` (string)
- `sandbox` (object)
- `server` (object)
- `unexposed` (array)

### `draft_governance_issue` (~497 tokens)

Draft a governance-compliant GitHub issue (HITL)

Produce a LOCAL GitHub issue draft + compliance report for zipnative / zipnative-mcp and NEVER submit it — the agent drafts, a human reviews and files it under their own identity (Human-In-The-Loop contract, .github/AGENT_RULES.md). No GitHub write path and no network path exist in this server. The draft is checked against the zero-dependency + reproduction policy; a violation (new runtime dependency, missing reproduction, duplicateSearchPerformed:false) throws GOVERNANCE_VIOLATION. targetRepo 'zipnative' for engine behaviour (parsing, writing, limits, codecs), 'zipnative-mcp' for wrapper behaviour (schemas, sandbox, transport). Returns markdown inline (outputMode:'file' also writes a .md inside the sandbox). Use it only after reproducing a defect — for questions read describe_engine / AGENTS.md instead. Present the draft AND the report to the user, then STOP.

Input parameters:

- `actualBehavior` (string): What actually happened (defaults to the reproduction result when omitted).
- `affectedPackages` (array): Packages impacted by this issue (e.g. ["zipnative-mcp"], ["zipnative"]).
- `duplicateSearchPerformed` (boolean, required): MUST be true: confirms you searched open AND closed issues/PRs for duplicates before drafting.
- `expectedBehavior` (string, required): What you expected to happen instead.
- `issueType` (string, required): Issue category: 'bug' | 'feature' | 'security' | 'docs' | 'performance'.
- `outputMode` (string): 'inline' (default) returns the draft markdown in the response. 'file' additionally writes it to the sandbox (requires ZIPNATIVE_MCP_OUTPUT_DIR); outputPath must be a relative .md path.
- `outputPath` (string): Relative .md path inside the sandbox (only when outputMode='file').
- `reproduction` (object, required): The minimal, locally-executed reproduction that justifies this issue.
- `summary` (string, required): One or two paragraphs describing the problem or proposal.
- `targetRepo` (string): Destination repository label for the draft (documentation only — the server never contacts it). 'zipnative-mcp' (wrapper: schemas, sandbox, transport) or 'zipnative' (engine: parser, writer, limits,…
- `title` (string, required): Concise issue title (imperative, no trailing period).

Output parameters:

- `compliance` (object)
- `draftMarkdown` (string): The full draft, ready for a human to review and submit.
- `filePath` (string): Sandboxed absolute path (when outputMode='file').
- `issueType` (string)
- `outputMode` (string)
- `sizeBytes` (integer)
- `targetRepo` (string)
- `title` (string)
- `warnings` (array)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/nizoka-zipnative-mcp/zipnative-mcp#diagnostics

## Score history

- 2026-09-21: 88
- 2026-09-20: 88
- 2026-09-19: 87
- 2026-09-18: 87
- 2026-09-17: 86
- 2026-09-16: 86
- 2026-09-15: 85
- 2026-09-14: 82
- 2026-09-13: 82
- 2026-09-12: 82
- 2026-09-11: 82
- 2026-09-10: 82
- 2026-09-09: 82
- 2026-09-08: 82
- 2026-09-07: 82

## Common questions

### What is the zipnative MCP — ZIP creation, inspection, secure… server?

zipnative MCP — ZIP creation, inspection, secure… is listed in the public MCP registry as io.github.Nizoka/zipnative-mcp. ZIP MCP server: create, inspect, verify, extract securely, modify without recompression. 13 tools. This page covers its npm package (zipnative-mcp).

### Is the zipnative MCP — ZIP creation, inspection, secure… server safe to use?

zipnative MCP — ZIP creation, inspection, secure… scores 88 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the zipnative MCP — ZIP creation, inspection, secure… server expose?

zipnative MCP — ZIP creation, inspection, secure… exposes 13 tools: inspect_zip, list_zip_entries, read_zip_entry, verify_zip, extract_zip, and 8 more. Their descriptions and schemas cost roughly 8,079 tokens of context every time the server is loaded.

### Is the zipnative MCP — ZIP creation, inspection, secure… server still maintained?

zipnative MCP — ZIP creation, inspection, secure… is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the zipnative MCP — ZIP creation, inspection, secure… server under?

zipnative MCP — ZIP creation, inspection, secure… declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/zipnative-mcp
- Socket report: https://socket.dev/npm/package/zipnative-mcp
- Repository: https://github.com/Nizoka/zipnative-mcp
- Changelog RSS feed: https://verifymcp.io/servers/nizoka-zipnative-mcp/zipnative-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/nizoka-zipnative-mcp/zipnative-mcp.json
- HTML version of this page: https://verifymcp.io/servers/nizoka-zipnative-mcp/zipnative-mcp