{"version":"2.1.181","anchor":"mcp-archive-skills","canonical_anchor":"mcp-archive-skills","heading":"MCP Archive Skills","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.181\/e\/mcp-archive-skills","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.181","markdown":"### MCP Archive Skills\n\n**What**\n\nMCP servers can now deliver skills (slash commands) as downloadable tar.gz or zip archive bundles. Claude Code fetches, validates, and unpacks the archive, then registers its SKILL.md as a command \u2014 all transparently.\n\n**Usage**\n\n`(Automatic \u2014 no user action required. Archive skills appear in the command list alongside regular MCP skills once the server is connected.)` **Details** - Archives are fetched via the MCP `resources\/read` protocol. - Supported formats: `application\/gzip` \/ `application\/x-gzip` (tar.gz) and `application\/zip`. - Cached by content hash or declared `digest` field; subsequent connections to the same server skip re-downloading if nothing changed. - Hard limits enforced: maximum archive size, maximum file count, maximum uncompressed size. - Security: rejects path traversal entries, symlinks\/hardlinks, sparse\/GNU-extension tar entries, base-256 numeric fields, and entries that alias the same disk path under case-folding or dot-segment normalization. - Requires the MCP server to declare a `digest` or the archive's SHA-256 to be consistent between calls. - On load, shows progress message: \"Downloading skill archive from \\<server\\>\". **Evidence** Archive fetch and extraction (search for `\"Downloading skill archive from\"`) \u2014 `WUd()` at line ~324105; tar parser (search for `\"tar archive contains an unsafe entry\"`) \u2014 `YZi` at line ~323530"}