Home · Setup · Claude Desktop
Pack, list and unpack zip archives locally, with traversal, symlink and bomb guards read from the header before anything is inflated. It packs files or a directory tree with glob patterns into a new .zip, lists an archive's entries with sizes and ratios while flagging absolute paths, .., symlinks, encrypted entries and duplicate names, unpacks with a dry run and a skip_unsafe option, reads one text entry inline without unpacking anything, and bundles a calendar month of invoices, quotes and exports from the sibling servers into one file.
This is the client where a zip somebody emailed you already sits in Downloads, so "what's in this zip, is it safe to open" is a question asked from the same window the file arrived in, and zip_list answers it without ever running the system Archive Utility on an archive you have not looked inside yet.
| You say | Tool |
|---|---|
| Zip up this folder, everything except node_modules. | zip_create |
| What's in this zip before I open it? | zip_list |
| Bundle August's invoices and expense exports into one zip. | zip_bundle_month |
A 100,000-byte entry inflated into a 10-byte bounded buffer returned 10 bytes and threw nothing: a lying header would extract as a silent, plausible-looking truncation. The CRC-32 already stored for the entry is checked before anything reaches disk, and that check is what refuses it instead.
The file is claude_desktop_config.json, and the key inside it is mcpServers.
| Scope | Path |
|---|---|
| macOS | ~/Library/Application Support/Claude/claude_desktop_config.json |
| Windows | %APPDATA%\Claude\claude_desktop_config.json |
{
"mcpServers": {
"zip": {
"command": "npx",
"args": ["-y", "@theluckystrike/mcp-zip"]
}
}
}If node came from nvm, asdf or homebrew, replace "npx" with the absolute path that which npx prints:
"command": "/Users/you/.nvm/versions/node/v22.14.0/bin/npx"Save, then completely quit Claude Desktop and start it again. A window reload is not enough.
The npm publish of @theluckystrike/mcp-zip is pending; until then use the .mcpb bundle or a clone and build from the latest release.
There is no hosted endpoint for this one yet. MCP Zip runs locally over stdio with the config above, which is also the only form in which it reads and writes files on your own disk. Three of the servers in this collection are served at https://mcp.zovo.one/mcp/<name> over MCP streamable HTTP: time-tracker, price-tracker and invoice.
Two documented facts decide whether the entry works: every path in claude_desktop_config.json must be absolute, and a stdio server started here inherits only a limited, platform-dependent subset of environment variables. If node came from nvm or homebrew, paste what `which npx` prints instead of the bare word. The .mcpb route avoids both: Claude Desktop ships a built-in Node.js environment.
Free: 20 archives a calendar month, up to 25 MB and 200 entries each. Reading (zip_list, zip_extract, zip_extract_text) is unlimited on both tiers. Pro is $19 once, verified offline.
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json. Windows: %APPDATA%\Claude\claude_desktop_config.json. There is no published Linux path. Settings, Developer, Edit Config opens the right copy and creates it if it does not exist.
In order: did you fully quit and restart, not just close the window? Is every path absolute? And is the command resolvable, given the limited environment a stdio server inherits here? If node came from nvm, paste what which npx prints.
Yes. An .mcpb bundle, the format renamed from .dxt, opens with Claude and shows an installation dialog. One you built yourself goes in through Settings, Extensions, Advanced settings, Install Extension.
MCP Zip in detail · The same server in Claude.ai and Claude Desktop connectors and Claude Code · Every server in Claude Desktop · Guides · Claude Desktop docs