ootar

USTAR archive manager with traversal resistance, zero zip-slip vulnerability, and MCP surface.

v0.1.0 100% openOODA Zero Ambient Authority Zero Zip-Slip Model Context Protocol

Install

Universal Standalone Binary:

curl -fsSL https://openooda-tools.github.io/ootar/install.sh | bash

Native Package Managers (Tri-Distribution Parity)

# Fedora / RHEL / CentOS (DNF)
curl -fsSL https://openooda-tools.github.io/ootar/install.sh | bash -s -- --dnf

# Ubuntu / Debian (APT)
curl -fsSL https://openooda-tools.github.io/ootar/install.sh | bash -s -- --deb

# Arch Linux / Manjaro (Pacman / PKGBUILD)
curl -fsSL https://openooda-tools.github.io/ootar/install.sh | bash -s -- --pkgbuild

Clean Uninstallation

Remove ootar binaries, package registrations, and symlinks at any time:

# Locally installed companion CLI
ootar-uninstall

# Standalone web uninstaller
curl -fsSL https://openooda-tools.github.io/ootar/uninstall.sh | bash

Why Sovereign ootar?

Dimension	Conventional Alternatives	openOODA ootar
Security	Ambient filesystem access	Bounded by &FsReadCap and &FsWriteCap tokens
Zip-Slip Defense	Permissive extraction defaults	Hard refusal of directory escape attempts (../)
Standard	Proprietary GNU extensions	Pure POSIX.1-1988 USTAR archive format
AI Agents	No agent interface	MCP stdio tools: tar_list, tar_inspect

Usage & Features

ootar -cf archive.tar file1.txt file2.txt # Create sovereign USTAR archive
ootar -tf archive.tar          # Inspect archive table of contents
ootar -xf archive.tar -C /dest # Safe traversal-resistant extract
ootar --mcp                    # Launch MCP stdio server