联合国

□ 项目介绍

ZIP 磁共振 服务器是一个基于快取MCP和zip.js的压缩服务器,执行"模式上下文协议"(MCP). 这个工程提供了完全由参数控制的ZIP压缩,解压缩,和查询压缩包信息功能.

□ 特性

• 支持文件和数据的压缩和解压缩
• 支持多文件包装压缩
• 提供压缩级别控制(0-9)
• 支持密码保护和加密强度设置
• 为压缩软件包元数据提供查询功能
• 校验ZIP在解压上的入行路径,以防止路径转弯写入

□ 警卫

版本 1.0.6 并随后在 [T0] 工具中修正任意文件写入问题:恶意的 ZIP 条目名(例如 ../outside.txt) 之前可以与输出目录相接并写入所要提取根外. 提取器现在解决了输出根一次,验证了每个输入路径,并拒绝绝对路径,驱动-字母路径,..段,以及任何会从输出目录中逃脱的路径.

感谢Ryan([email protected])负责任地报道了这个问题.

ZIP MCP Server

中文 | English

Project Introduction

ZIP MCP Server is a compression server based on fastMCP and zip.js, implementing the Model Context Protocol (MCP). This project provides fully parameter-controlled ZIP compression, decompression, and query compression package information functions.

Features

• Supports compression and decompression of files and data
• Supports multi-file packaging compression
• Provides compression level control (0-9)
• Supports password protection and encryption strength settings
• Provides query function for compressed package metadata
• Validates ZIP entry paths on decompression to prevent path traversal writes

Security

Versions 1.0.6 and later fix an arbitrary file write issue in the decompress tool: malicious ZIP entry names (for example ../outside.txt) could previously be joined with the output directory and written outside the intended extraction root. Extraction now resolves the output root once, validates each entry path, and rejects absolute paths, drive-letter paths, .. segments, and any path that would escape the output directory.

Thanks to Ryan ([email protected]) for responsibly reporting this issue.

Project Structure

zip-mcp
├── src
│   ├── index.ts               # Application entry point
│   ├── utils
│   │   ├── compression.ts     # Compression and decompression implementation
│   │   └── safePath.ts        # Safe ZIP entry path validation
├── tsconfig.json              # TypeScript configuration file
├── package.json               # npm configuration file
└── README.md                  # Project documentation

Installation

You can install ZIP MCP Server globally using npm:

npm install -g zip-mcp

MCP Configuration

After installation, you can configure ZIP MCP in your MCP JSON configuration:

{
  "mcpServers": {
    "zip-mcp": {
      "command": "zip-mcp",
      "args": []
    }
  }
}

Configure the MCP JSON in the AI Client

• Claude Client: https://modelcontextprotocol.io/quickstart/user
• Raycast: requires installing the MCP plugin
• Cursor: https://docs.cursor.com/context/model-context-protocol#configuring-mcp-servers

MCP Tool Description

ZIP MCP Server provides the following tools, which can be called through the MCP protocol:

Compression Tool (compress)

Compress local files or directories into a ZIP file.

Parameters:

• input: Path of the file or directory to be compressed (string or string array)
• output: Path of the output ZIP file
• options: Compression options (optional)
  • level: Compression level (0-9, default is 5)