# ZIP Entry Header Inspector

> ZIP Entry Header Inspector is a paid API for AI agents from file-formats.x402tookit.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-10-30).

Parses the first entry header of a ZIP file from hex bytes, extracting name, compression method, sizes, CRC32, encryption status, and detecting zip-slip path or executable-name risks.

## Facts

- Endpoint: GET https://file-formats.x402tookit.com/zip-entry?utm_source=zero.xyz
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-30
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/zip-entry-header-inspector-c66e8798
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_8k4Px7Y2jvHmzLlfdAQ0b

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability zip-entry-header-inspector-c66e8798
```

Example prompt: Can you inspect the first entry in this ZIP file for me? Here are its first 512 bytes as hex: 504b03040a000000000087b04e5200000000... — check for zip-slip path risks, whether it's encrypted, and what compression method is used.

## When to prefer this

Use this endpoint when you need to quickly inspect the first entry of a ZIP archive for security risks (zip-slip, hidden executables, encryption) or metadata (compression method, sizes, CRC32) without fully downloading or extracting the archive. It is ideal for pre-flight security screening of user-uploaded ZIPs, for validating ZIP structure before processing, or for forensic analysis of suspicious archives. Prefer this over generic file-type detectors when you specifically need ZIP entry-level metadata and risk assessment.

## Known failure modes

- Insufficient hex bytes provided — header fields can't be fully parsed if fewer than the local file header length + name length are supplied
- Invalid or non-hex input causes a parsing error
- Hex string doesn't begin with ZIP local file header signature (PK\x03\x04), resulting in an error or degraded result
- Truncated name field — if hex is too short to include full file name, nameComplete will be false and some risk checks may be skipped
- Non-ZIP file bytes submitted — service may return error or degraded flag

## How this service works

Parse a ZIP's first entry header: name, method, sizes, CRC, encryption, and zip-slip path or executable-name risks.

## Output

Returns a structured object including the entry's file name, compression method name and code, compressed and uncompressed sizes, CRC32 checksum, encryption status, general-purpose bit flags, last-modified timestamp, UTF-8 name flag, data descriptor flag, version needed, name and extra field lengths, whether the name is complete, any detected path risks (zip-slip traversal), executable-name risks, an overall verdict and summary, and a list of any checks that could not be performed given the bytes provided.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "hex"
     ],
     "properties": {
      "hex": {
       "type": "string",
       "description": "First 30 + name length bytes of the ZIP as hex (up to 512 bytes)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "asOf": {
       "type": [
        "null",
        "string"
       ]
      },
      "name": {
       "type": [
        "null",
        "string"
       ]
      },
      "crc32": {
       "type": [
        "null",
        "string"
       ]
      },
      "flags": {
       "type": [
        "null",
        "number"
       ]
      },
      "method": {
       "type": [
        "null",
        "number"
       ]
      },
      "source": {
       "type": [
        "null",
        "string"
       ]
      },
      "reasons": {
       "type": [
        "array",
        "null"
       ]
      },
      "summary": {
       "type": [
        "null",
        "string"
       ]
      },
      "verdict": {
       "type": [
        "null",
        "string"
       ]
      },
      "degraded": {
       "type": [
        "boolean",
        "null"
       ]
      },
      "modified": {
       "type": [
        "null",
        "string"
       ]
      },
      "utf8Name": {
       "type": [
        "boolean",
        "null"
       ]
      },
      "encrypted": {
       "type": [
        "boolean",
        "null"
       ]
      },
      "pathRisks": {
       "type": [
        "array",
        "null"
       ]
      },
      "disclaimer": {
       "type": [
        "null",
        "string"
       ]
      },
      "methodName": {
       "type": [
        "null",
        "string"
       ]
      },
      "nameLength": {
       "type": [
        "null",
        "number"
       ]
      },
      "notChecked": {
       "type": [
        "array",
        "null"
       ],
       "items": {
        "type": "string"
       }
      },
      "extr
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/zip-entry-header-inspector-c66e8798/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from file-formats.x402tookit.com](https://www.zero.xyz/host/file-formats.x402tookit.com/llms.txt)