MCPB File Format Support

What: Full support for loading MCP servers from MCPB (.mcpb or .dxt) archive files, which are secure ZIP-based packages containing manifest, configuration, and server code.

How to use:

# Load an MCPB file from local path
claude --mcp-config path/to/server.mcpb

# Load an MCPB from URL (downloads and caches automatically)
claude --mcp-config https://example.com/servers/tool.mcpb

Details:

• Secure ZIP extraction with protection against zip bombs, path traversal, and excessive file sizes
• Automatic caching system (.mcpb-cache directory) with hash-based invalidation
• Support for downloading MCPB files from HTTP/HTTPS URLs with progress tracking
• Validates manifest.json against schema and generates MCP server configuration
• Security limits: max 512MB per file, max 1GB total uncompressed size, max 100k files, max 50:1 compression ratio
• Three structured error types for debugging: mcpb-download-failed, mcpb-invalid-manifest, mcpb-extract-failed
• Evidence: PO0() at line 279621, _8B() at line 279846, x8B() at line 279926, mg1() at line 279587 in v2.0.17 (completely absent from v2.0.15)