Home · Setup · Windsurf

MCP Zip in Windsurf

Pack, list and unpack zip archives locally, with traversal, symlink and bomb guards read from the header before anything is inflated. It packs files or a directory tree with glob patterns into a new .zip, lists an archive's entries with sizes and ratios while flagging absolute paths, .., symlinks, encrypted entries and duplicate names, unpacks with a dry run and a skip_unsafe option, reads one text entry inline without unpacking anything, and bundles a calendar month of invoices, quotes and exports from the sibling servers into one file.

Nine tools against Cascade's ceiling of 100, and an archive is built or opened a handful of times a session rather than polled continuously, so leaving it enabled costs little alongside every other server in this collection.

What you get in Windsurf

You say	Tool
Zip up this folder, everything except node_modules.	`zip_create`
What's in this zip before I open it?	`zip_list`
Bundle August's invoices and expense exports into one zip.	`zip_bundle_month`

A 100,000-byte entry inflated into a 10-byte bounded buffer returned 10 bytes and threw nothing: a lying header would extract as a silent, plausible-looking truncation. The CRC-32 already stored for the entry is checked before anything reaches disk, and that check is what refuses it instead.

Install it in Windsurf

The file is mcp_config.json, and the key inside it is mcpServers.

Scope	Path
macOS, Windows and Linux	`~/.codeium/windsurf/mcp_config.json`

If you also run Claude Desktop, the shortest path there is one click: zip.mcpb from the bundle catalog opens as an extension, with no JSON and no terminal. Windsurf reads its own config, so here it is:

The config block:

{
  "mcpServers": {
    "zip": {
      "command": "node",
      "args": ["/absolute/path/to/mcp-servers/servers/zip/dist/index.js"]
    }
  }
}

The node command above wants a built file. From a clone, once:

git clone https://github.com/theluckystrike/mcp-servers.git
cd mcp-servers && npm install
npm run build -w packages/mcp-license -w servers/zip

That writes servers/zip/dist/index.js, and its absolute path is the one argument the config needs.

The npm packages are not published yet, so the form below returns a 404 today. It is here because it is what the entry becomes the day the publish lands, with nothing else changed:

{
  "mcpServers": {
    "zip": {
      "command": "npx",
      "args": ["-y", "@theluckystrike/mcp-zip"]
    }
  }
}

Save and reopen the MCP Servers list; Cascade picks it up without restarting the editor.

Nothing is published to npm yet, so the working install paths are the ones above: the .mcpb bundle from the bundle catalog, a clone and build, or the hosted URL.

No install: the hosted endpoint

The same server runs at https://mcp.zovo.one/mcp/zip over MCP streamable HTTP, no install. Mint a free token with curl https://mcp.zovo.one/mcp/token, or use a Pro key. It has no filesystem, so a file comes back as a one-hour download link.

{
  "mcpServers": {
    "zip": {
      "url": "https://mcp.zovo.one/mcp/zip",
      "headers": { "Authorization": "Bearer <token>" }
    }
  }
}

Windsurf notes worth knowing first

Read this first: mcp_config.json applies to the legacy Cascade agent only. The Devin Local agent, the default for new tabs, takes its servers from the Devin CLI config files, so a correct entry here can still be invisible in a fresh tab. The other hard number is a cap: Cascade reaches at most 100 tools at once, and every enabled server spends from it.

Free: 20 archives a calendar month, up to 25 MB and 200 entries each. Reading (zip_list, zip_extract, zip_extract_text) is unlimited on both tiers. Pro is $19 once, verified offline.

Questions

Where does Windsurf keep its MCP config?

~/.codeium/windsurf/mcp_config.json, under mcpServers. Reach it from the MCPs icon at the top right of the Cascade panel, or Devin Settings, Cascade, MCP Servers.

I edited the file and a new tab still cannot see MCP Zip.

That file applies to the legacy Cascade agent only. The Devin Local agent, the default for new tabs, reads its servers from the Devin CLI config files instead. Check which agent the tab runs.

How many servers can I load at once?

Cascade reaches at most 100 tools at any one time, and every enabled server spends from that single budget. MCP Zip contributes 9 tools, so keep the enabled list short rather than counting servers.

MCP Zip in detail · The same server in VS Code and Cline · Every server in Windsurf · Guides · Windsurf docs · Buy Pro

Related guides & tools

Zip and unzip archives safely from Claude or Cursor · Sending a month of paperwork as one archive, safely