Archive Zip Unzip Bomb Guard runs on your own machine — the client starts it, so there is no endpoint to ping. Last commit 22 Oct 2026.
Pack a folder with a glob, look inside an archive, unpack it with bomb, traversal and symlink guards
We read the source, 2 d ago · rules 995398eba69f
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
"confound": "actions/setup-node with registry-url wrote NPM_CONFIG_USERCONFIG=$RUNNER_TEMP/.npmrc containing //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}; with no NODE_AUTH_TOKEN secret this expanded to the literal placeholder XXXXX-XXXXX-XXXXX-XXXXX, so npm authen…
for (const [k, v] of Object.entries(process.env)) if (v !== undefined) env[k] = v;
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
Create, inspect and extract zip archives offline, with traversal, symlink and zip-bomb guards.
Create, inspect and extract zip archives offline, with traversal, symlink and zip-bomb guards.
Zip and unzip archives from your AI chat: create, list, extract. Offline, with bomb guards.
Free save layer for AI apps: save links to a person's SaveHQ board and search it, with permission.
Search vetted local guides and travel routes across China, with deep links to chat and booking.
Serve ExpertPack knowledge packs over MCP with hybrid search, graph traversal and provenance.
Search travel eSIM data plans worldwide with live prices, plan details and a buy link.
Breathing guide with voice and bowl, looping music, binaural beats, and a player link for users.
Answers built from our own checks of this server.