Zip Archive Create Extract Bomb Guard is a remote MCP server that gives an AI agent 12 tools, among them license_activate, license_status, zip_add. It answers at https://mcp.zovo.one/mcp/zip over streamable HTTP, and it listed its tools to an anonymous client, so no sign-in was needed for that. Our probes reached it 6 of 6 times since 11 September 2026; the last check, on 24 October 2026, succeeded.
Create, inspect and extract zip archives offline, with traversal, symlink and zip-bomb guards.
Description as the publisher wrote it.
| Tool | What it does |
|---|---|
license_activate | Turn Pro on for this connection with key, an MCPL1.<payload>.<signature> issued at checkout for this server or the bundle. Data under your token stays; a wrong or expired key changes nothing. license_status confirms it. Inputs: key |
license_status | Report this endpoint's licence state for your token as JSON: the product, the tier free or pro, why it is not Pro, and the checkout URL. Call it to explain a free-tier refusal. No arguments, nothing changes. |
zip_add | Call this tool to add files to an existing archive under their own names, or under prefix. A name clash is refused unless replace. An archive holding unsafe entries is refused rather than rewritten. Inputs: path, paths, prefix, replace, level, password |
zip_bundle_month | Local (stdio) install only. On this hosted endpoint /mcp/invoice, /mcp/quotes, /mcp/expense-tracker, /mcp/docx and /mcp/resume return their documents as one-hour download links and keep no output folder to read, so there is nothing for this Inputs: month, out_path, servers, overwrite, dry_run |
zip_create | Call this tool to pack files uploaded with zip_upload into a new .zip and get a download link valid for one hour. Entry names are always relative, so the archive cannot write outside where it is unpacked. Inputs: out_path, paths, dir, patterns, exclude, level |
zip_delete_upload | Delete one uploaded file stored for your token. The register rows zip_history lists are kept. Inputs: name |
zip_extract | Call this tool to unpack an archive; every entry comes back as its own download link valid for one hour. Traversal, absolute-path and symlink entries are refused, a size and ratio cap stops a zip bomb, and dry_run reports exactly what would Inputs: path, out_dir, patterns, dry_run, overwrite, skip_unsafe |
zip_extract_text | Call this tool to read one text entry out of an archive without unpacking anything: give the entry name and the text comes back inline. Binary entries are refused by name rather than printed as noise. Inputs: path, entry, max_chars |
zip_files | List the files stored for your token on this endpoint, with their sizes. These are the names every path argument here resolves against. |
zip_history | List the archives created for your token, newest first, with entry counts, sizes and names, plus how much of the free 20 a month is used. Each download link expires after an hour; the row keeps the name. Inputs: limit |
zip_list | Call this tool to list an archive's entries with sizes and ratios and flag what is dangerous: absolute paths, .., symlinks, encrypted entries, duplicate names and bombs. Read-only. Run it before zip_extract. Inputs: path, limit, patterns, max_ratio |
zip_upload | Send a file to this hosted endpoint. There is no filesystem here, so instead of a path you upload the file once with zip_upload and then pass its name wherever a path is asked for: an archive to zip_list, zip_extract, zip_extract_text or zi Inputs: name, content, content_base64, url |
Every block below points at https://mcp.zovo.one/mcp/zip. Pick your client and copy.
claude mcp add --transport http zip-archive-create-extract-bomb https://mcp.zovo.one/mcp/zip
{
"mcpServers": {
"zip-archive-create-extract-bomb": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://mcp.zovo.one/mcp/zip"]
}
}
}{
"mcpServers": {
"zip-archive-create-extract-bomb": {
"url": "https://mcp.zovo.one/mcp/zip"
}
}
}{
"servers": {
"zip-archive-create-extract-bomb": {
"type": "http",
"url": "https://mcp.zovo.one/mcp/zip"
}
}
}{
"context_servers": {
"zip-archive-create-extract-bomb": {
"url": "https://mcp.zovo.one/mcp/zip"
}
}
}{
"mcpServers": {
"zip-archive-create-extract-bomb": {
"serverUrl": "https://mcp.zovo.one/mcp/zip"
}
}
}{
"mcpServers": {
"zip-archive-create-extract-bomb": {
"url": "https://mcp.zovo.one/mcp/zip"
}
}
}name: Zip Archive Create Extract Bomb Guard
version: 0.0.1
schema: v1
mcpServers:
- name: Zip Archive Create Extract Bomb Guard
type: streamable-http
url: https://mcp.zovo.one/mcp/zip{
"mcpServers": {
"zip-archive-create-extract-bomb": {
"httpUrl": "https://mcp.zovo.one/mcp/zip"
}
}
}{
"mcpServers": {
"zip-archive-create-extract-bomb": {
"type": "http",
"url": "https://mcp.zovo.one/mcp/zip"
}
}
}{
"mcpServers": {
"zip-archive-create-extract-bomb": {
"url": "https://mcp.zovo.one/mcp/zip"
}
}
}goose://extension?url=https%3A%2F%2Fmcp.zovo.one%2Fmcp%2Fzip&type=streamable_http&id=zip-archive-create-extract-bomb&name=Zip%20Archive%20Create%20Extract%20Bomb%20Guard
It answered our last check on 24 October 2026 in 91 ms. Over 6 checks since 11 September 2026 it answered 6. Status here comes from Neuronto's own probes, not from the publisher.
12, as returned by the server's own tools/list on 21 September 2026: license_activate, license_status, zip_add, zip_bundle_month, zip_create, zip_delete_upload, zip_extract, zip_extract_text, and 4 more.
It answered our last check on 24 October 2026 in 91 ms. Over 6 checks since 11 September 2026 it answered 6.
Put the server under mcpServers in ~/.cursor/mcp.json with the URL https://mcp.zovo.one/mcp/zip. The exact JSON is above, with the same setup for Claude Code, Claude Desktop, VS Code, Windsurf, Zed, Gemini CLI and the rest.
It listed its tools to an anonymous client, so reading the tool list needs no key. Individual tools can still ask for credentials in their own inputs.
Publisher: io.github.theluckystrike. Endpoint host: mcp.zovo.one. ARD identifier: urn:air:io.github.theluckystrike:mcp:zip-archive-create-extract-bomb-guard.
First indexed 10 September 2026. The tools are exactly what the server returned; nothing on this page
is inferred from its name. Ranking in Neuronto search is never for sale.