{ "slug": "io-github-nizoka-zipnative-mcp", "name": "io.github.Nizoka/zipnative-mcp", "title": "zipnative MCP — ZIP creation, inspection, secure extraction & verification", "description": "ZIP MCP server: create, inspect, verify, extract, canonicalize, merge, modify. 15 tools", "version": "1.1.0", "publishedAt": "2026-10-19T12:18:17.541776Z", "updatedAt": "2026-10-19T12:18:17.541776Z", "repoUrl": "https://github.com/Nizoka/zipnative-mcp", "websiteUrl": "https://github.com/Nizoka/zipnative-mcp#readme", "namespace": { "type": "github", "owner": "Nizoka" }, "kind": "local", "packages": [ { "registryType": "npm", "identifier": "zipnative-mcp", "version": "1.1.0", "transport": "stdio", "runtimeHint": "npx" } ], "remotes": [], "envVars": [ { "name": "ZIPNATIVE_MCP_OUTPUT_DIR", "isSecret": false, "isRequired": false, "description": "Absolute path of the one sandbox directory: zipPath / sourcePath inputs are read from it and outputMode='file' / outputDir outputs are written under it (never overwritten; the real path of every file read and of every parent written must stay inside — a planted symlink or junction is SECURITY_VIOLATION). Unset: every tool works on base64 only (no file I/O beyond the opt-in cache)." }, { "name": "ZIPNATIVE_MCP_CACHE_DIR", "isSecret": false, "isRequired": false, "description": "Opt-in content-addressed response cache directory (absolute path) (SHA-256 keyed, 1h TTL, 256 MiB, oldest-written evicted first, plaintext at rest). Never caches zipPath / sourcePath inputs, file output, defaultDate='now', parallel, describe_engine or draft_governance_issue." }, { "name": "ZIPNATIVE_MCP_PORT", "isSecret": false, "isRequired": false, "description": "Serve Streamable HTTP on this loopback port (POST /mcp) instead of stdio (MCP 2026-07-28, stateless, legacy fallback). Unauthenticated unless ZIPNATIVE_MCP_HTTP_TOKEN is set." }, { "name": "ZIPNATIVE_MCP_HTTP_TOKEN", "isSecret": true, "isRequired": false, "description": "Opt-in bearer token for the HTTP transport (>= 16 chars, no whitespace; a weaker value refuses to start). When set, /mcp requires 'Authorization: Bearer ' or answers 401. Compared constant-time, never logged." }, { "name": "ZIPNATIVE_MCP_MAX_UNCOMPRESSED_BYTES", "isSecret": false, "isRequired": false, "description": "Operator ceiling for limits.maxEntryUncompressedSize, limits.maxTotalUncompressedSize and limits.maxEntryCompressedSize in bytes (default 8589934592 = 8 GiB, the engine default). Integer >= 1024, read once at startup; an invalid value refuses to start. A per-call value above it is refused with LIMIT_CEILING_EXCEEDED." }, { "name": "ZIPNATIVE_MCP_MAX_ENTRIES", "isSecret": false, "isRequired": false, "description": "Operator ceiling for limits.maxEntries and scan_zip_forward maxEntries (default 100000, the engine default; the scanner's default budget of 10000 is clamped to it, only an explicit value above it is refused). Integer >= 1, read once at startup; an invalid value refuses to start." }, { "name": "ZIPNATIVE_MCP_WORKERS", "isSecret": false, "isRequired": false, "description": "Operator ceiling for create_zip parallel.workers (default 8; with no explicit workers the engine default max(1, min(cores - 1, 8)) applies, bounded by this ceiling; 0 disables worker threads and keeps compression on the calling thread). Integer >= 0, read once at startup; an invalid value refuses to start." }, { "name": "ZIPNATIVE_MCP_MAX_FILE_OUTPUT_BYTES", "isSecret": false, "isRequired": false, "description": "Operator ceiling for every file written in outputMode='file' (create_zip, modify_zip, canonicalize_zip, merge_zip, extract_zip, inflate_raw), enforced while streaming (default 4294967296 = 4 GiB, the 1.0.0 behaviour). Integer >= 1048576, read once at startup; an invalid value refuses to start. Raise it to write Zip64 archives above 4 GiB into the sandbox (create_zip stream entries with zip64: true)." } ], "category": "files-docs", "subcategory": "local", "company": "", "categoryAuto": true, "checks": [ { "id": "source-linked", "label": "Source repository linked", "result": "pass", "detail": "https://github.com/Nizoka/zipnative-mcp" }, { "id": "version-pinned", "label": "Version pinned", "result": "pass", "detail": "Every package has an explicit version" }, { "id": "secrets-requested", "label": "Secrets requested", "result": "info", "detail": "Asks for 1 secret: ZIPNATIVE_MCP_HTTP_TOKEN" }, { "id": "known-registry", "label": "Known package registry", "result": "pass", "detail": "All packages come from npm, PyPI, OCI, NuGet or MCPB" }, { "id": "namespace", "label": "Namespace ownership", "result": "info", "detail": "Name verified via GitHub account Nizoka" }, { "id": "meta-text", "label": "Registry text aimed at the AI", "result": "pass", "detail": "Description and settings contain no hidden characters or instructions to the AI" }, { "id": "install-scripts", "label": "Install scripts", "result": "pass", "detail": "zipnative-mcp@1.1.0 runs nothing at install" }, { "id": "code-flags", "label": "Code red flags", "result": "pass", "detail": "Read 90 files in zipnative-mcp@1.1.0: no obfuscation, encoded execution, credential reads or data-collection endpoints found" }, { "id": "ai-text", "label": "Text aimed at the AI", "result": "pass", "detail": "No hidden characters or instructions to the AI in 90 files, including comments and the README" } ], "scannedAt": "2026-10-29", "level": "Scanned", "install": [ { "label": "Claude Desktop (npm)", "kind": "claude_desktop_json", "text": "{\n \"mcpServers\": {\n \"zipnative-mcp\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"zipnative-mcp@1.1.0\"\n ]\n }\n }\n}" } ], "curated": true, "stars": 0, "archived": false, "pushedAt": "2026-10-26T13:21:02Z", "health": { "score": 59, "parts": { "popularity": 0.18198521201942996, "activity": 0.9786854500234844, "issues": null, "security": 1 }, "fail": 0, "warn": 0, "raw": { "stars": 0, "forks": 0, "downloads": 84, "hn": null, "issuesOpen": 0, "issuesClosed": 0, "prsMerged": 1, "commits90": 48, "release": "2026-10-19T12:06:57Z", "pushed": "2026-10-26T13:21:02Z", "growth": null, "growthDays": null, "archived": false }, "at": "2026-10-31T07:42:38.200Z" } }