{"uid":"cap_gJmUrf96yxqzR7PTYqg4J","slug":"402utils-zip-inspector-89f4a2ef","name":"402utils ZIP Inspector","description":"Inspect a ZIP archive safely: send the bytes directly or a JSON body with a public {url}. Returns the entry list (path, size, compressedSize, isDir); entries with path traversal (../), absolute or malformed paths are flagged suspicious:true and never interpreted. Add ?extract=exact/entry/path to get that one file back (max 5 MB decompressed). Zip bombs are refused. Max 20 MB.","url":"https://402utils.com/v1/zip-inspect","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"url":{"type":"string","format":"uri","description":"Public http(s) URL of a zip (alternative to sending bytes)."}}},"responseSchema":{"type":"json","example":{"entries":[{"path":"report/","size":0,"isDir":true,"compressedSize":0},{"path":"report/q2.pdf","size":182734,"isDir":false,"compressedSize":170101},{"path":"../../etc/passwd","size":812,"isDir":false,"suspicious":true,"compressedSize":400}],"entryCount":3,"totalUncompressedSize":183546}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_sZRWKkNzn66eNJ0GAoKXt","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Safely inspect a ZIP archive's entry list or extract a single file, flagging path traversal and refusing zip bombs","exampleAgentPrompt":"Can you inspect this zip file for me and list all the entries inside it — I want to know the paths, sizes, and whether anything looks suspicious like path traversal: https://example.com/archive.zip","exampleUseCases":[{"title":"Validate untrusted ZIP before processing","prompt":"I just received a ZIP file from an external vendor and I'm not sure I trust it — can you check it for path traversal attacks, zip bombs, or anything suspicious before we let our pipeline touch it? Here's the URL: https://uploads.example.com/vendor-delivery.zip"},{"title":"Preview ZIP contents before downloading","prompt":"Before I download the whole thing, can you peek inside this ZIP archive and tell me what files are in there, how big they are, and whether anything looks off? https://cdn.example.com/dataset-export.zip"},{"title":"Extract one file from archive","prompt":"There's a ZIP at https://storage.example.com/release-bundle.zip and I only need the file at config/settings.json from inside it — can you safely pull just that one file out for me without extracting everything?"}],"resultDescription":"A list of entries in the ZIP archive, each with path, size, compressedSize, and isDir fields; any entry with path traversal (../), absolute paths, or malformed paths is flagged with suspicious:true. If the ?extract=path query parameter is used, returns the raw bytes of that one file (max 5 MB decompressed). Zip bombs and archives over 20 MB are rejected with an error.","failureModes":["ZIP exceeds 20 MB limit — request refused","Decompressed file exceeds 5 MB — extraction refused","Zip bomb detected — request refused","URL is not publicly accessible or times out","URL does not point to a valid ZIP file","Malformed ZIP structure — parse error","Requested extract path not found in archive"],"whenToPreferThis":"Use this endpoint when you need to safely enumerate or extract from a ZIP archive without trusting its contents — especially when the ZIP comes from an untrusted source and you want path traversal and zip bomb protection built in. Prefer this over generic file-handling when security validation of ZIP entry paths is required alongside extraction.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-16T00:47:31.006Z","isFirstParty":false}