Pack, list and unpack zip archives locally, with traversal, symlink and bomb guards read from the header before anything is inflated. It packs files or a directory tree with glob patterns into a new .zip, lists an archive's entries with sizes and ratios while flagging absolute paths, .., symlinks, encrypted entries and duplicate names, unpacks with a dry run and a skip_unsafe option, reads one text entry inline without unpacking anything, and bundles a calendar month of invoices, quotes and exports from the sibling servers into one file.
Nine tools against Cascade's ceiling of 100, and an archive is built or opened a handful of times a session rather than polled continuously, so leaving it enabled costs little alongside every other server in this collection.
| You say | Tool |
|---|---|
| Zip up this folder, everything except node_modules. | zip_create |
| What's in this zip before I open it? | zip_list |
| Bundle August's invoices and expense exports into one zip. | zip_bundle_month |
A 100,000-byte entry inflated into a 10-byte bounded buffer returned 10 bytes and threw nothing: a lying header would extract as a silent, plausible-looking truncation. The CRC-32 already stored for the entry is checked before anything reaches disk, and that check is what refuses it instead.
The file is mcp_config.json, and the key inside it is mcpServers.
| Scope | Path |
|---|---|
| macOS, Windows and Linux | ~/.codeium/windsurf/mcp_config.json |
{
"mcpServers": {
"zip": {
"command": "npx",
"args": ["-y", "@theluckystrike/mcp-zip"]
}
}
}Save and reopen the MCP Servers list; Cascade picks it up without restarting the editor.
The npm publish of @theluckystrike/mcp-zip is pending; until then use the .mcpb bundle or a clone and build from the latest release.
There is no hosted endpoint for this one yet. MCP Zip runs locally over stdio with the config above, which is also the only form in which it reads and writes files on your own disk. Three of the servers in this collection are served at https://mcp.zovo.one/mcp/<name> over MCP streamable HTTP: time-tracker, price-tracker and invoice.
Read this first: mcp_config.json applies to the legacy Cascade agent only. The Devin Local agent, the default for new tabs, takes its servers from the Devin CLI config files, so a correct entry here can still be invisible in a fresh tab. The other hard number is a cap: Cascade reaches at most 100 tools at once, and every enabled server spends from it.
Free: 20 archives a calendar month, up to 25 MB and 200 entries each. Reading (zip_list, zip_extract, zip_extract_text) is unlimited on both tiers. Pro is $19 once, verified offline.
~/.codeium/windsurf/mcp_config.json, under mcpServers. Reach it from the MCPs icon at the top right of the Cascade panel, or Devin Settings, Cascade, MCP Servers.
That file applies to the legacy Cascade agent only. The Devin Local agent, the default for new tabs, reads its servers from the Devin CLI config files instead. Check which agent the tab runs.
Cascade reaches at most 100 tools at any one time, and every enabled server spends from that single budget. MCP Zip contributes 9 tools, so keep the enabled list short rather than counting servers.
MCP Zip in detail · The same server in VS Code and Cline · Every server in Windsurf · Guides · Windsurf docs