# 402utils ZIP Inspector

> 402utils ZIP Inspector is a paid API for AI agents from 402utils.com, paid per call via x402, $0.003/call, status unknown (last checked 2026-09-13).

Safely inspect a ZIP archive's entry list or extract a single file, flagging path traversal and refusing zip bombs

## Facts

- Endpoint: POST https://402utils.com/v1/zip-inspect
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/402utils-zip-inspector-89f4a2ef
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_gJmUrf96yxqzR7PTYqg4J

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability 402utils-zip-inspector-89f4a2ef -d '<json body>'
```

Example prompt: Can you inspect this zip file for me and list all the entries inside it — I want to know the paths, sizes, and whether anything looks suspicious like path traversal: https://example.com/archive.zip

## When to prefer this

Use this endpoint when you need to safely enumerate or extract from a ZIP archive without trusting its contents — especially when the ZIP comes from an untrusted source and you want path traversal and zip bomb protection built in. Prefer this over generic file-handling when security validation of ZIP entry paths is required alongside extraction.

## Known failure modes

- ZIP exceeds 20 MB limit — request refused
- Decompressed file exceeds 5 MB — extraction refused
- Zip bomb detected — request refused
- URL is not publicly accessible or times out
- URL does not point to a valid ZIP file
- Malformed ZIP structure — parse error
- Requested extract path not found in archive

## How this service works

Inspect a ZIP archive safely: send the bytes directly or a JSON body with a public {url}. Returns the entry list (path, size, compressedSize, isDir); entries with path traversal (../), absolute or malformed paths are flagged suspicious:true and never interpreted. Add ?extract=exact/entry/path to get that one file back (max 5 MB decompressed). Zip bombs are refused. Max 20 MB.

## Output

A list of entries in the ZIP archive, each with path, size, compressedSize, and isDir fields; any entry with path traversal (../), absolute paths, or malformed paths is flagged with suspicious:true. If the ?extract=path query parameter is used, returns the raw bytes of that one file (max 5 MB decompressed). Zip bombs and archives over 20 MB are rejected with an error.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "format": "uri",
   "description": "Public http(s) URL of a zip (alternative to sending bytes)."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "entries": [
   {
    "path": "report/",
    "size": 0,
    "isDir": true,
    "compressedSize": 0
   },
   {
    "path": "report/q2.pdf",
    "size": 182734,
    "isDir": false,
    "compressedSize": 170101
   },
   {
    "path": "../../etc/passwd",
    "size": 812,
    "isDir": false,
    "suspicious": true,
    "compressedSize": 400
   }
  ],
  "entryCount": 3,
  "totalUncompressedSize": 183546
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/402utils-zip-inspector-89f4a2ef/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 402utils.com](https://www.zero.xyz/host/402utils.com/llms.txt)