regex-le-mcp

Useful? A star or rating is how other developers find it — ★ GitHub · ★ Marketplace · ★ Open VSX

What it does

Open any file and run one of three commands. Extract lists every regex pattern found in the document. Test (Ctrl+Alt+R / Cmd+Alt+R) runs a found — or manually entered — pattern against the file content and reports matches with real line/column positions and capture groups (named groups included). Validate checks every found pattern for syntax errors and screens it for ReDoS-prone shapes. Works in VS Code and VS Code–based editors like Cursor and VSCodium (installable from Open VSX).

Related MCP server: File Context MCP Server

Use it from an AI agent

The same engine runs as an MCP server, so an agent can call it directly instead of you running a command.

extract_patterns(content, maxResults?)

Returns every pattern with its flags, 1-based position and a ReDoS verdict, so "are any of the regexes in this file dangerous?" is one call rather than two.

The server takes content and returns data — it reads no files and makes no network requests of its own. Published as regex-le-mcp on npm and as io.github.nolindnaidoo/regex-le in the MCP registry.

Most hosts read a JSON config. Add one entry:

{
  "mcpServers": {
    "regex-le": {
      "command": "npx",
      "args": ["-y", "regex-le-mcp"]
    }
  }
}

-y skips the install prompt on first run. Pin a version if you would rather not track releases — regex-le-mcp@2.2.1.

Prefer not to go through npx on every launch? Install it once and point at the binary instead:

npm install -g regex-le-mcp

{
  "mcpServers": {
    "regex-le": { "command": "regex-le-mcp" }
  }
}

It speaks MCP over stdio and needs no environment variables, no API key and no configuration of its own. To check it before wiring it into anything:

echo '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | npx -y regex-le-mcp

That prints the tool list and exits — if you see extract_patterns, the server works.

What gets extracted

Extraction scans the whole document (any file type), so constructors split across lines are found too:

What is deliberately not extracted:

• Division, dates, and filesystem paths (a / b, 10/29/2025, /usr/local/bin): a / preceded by an identifier, number, ), ], ., or another / is not treated as a regex — after keywords like return, it is.

• Candidates that do not compile as JavaScript regexes, or with invalid/duplicate flags.

• Constructor calls whose pattern argument is a variable or template literal (only literal string arguments are visible to a text scanner).

Duplicate pattern+flags pairs are listed once. This is lexing by heuristic, not a full JS parser: a slash inside a string or comment can still be picked up when its context looks expression-like.

ReDoS screening

Validate (and Test, before running a risky pattern) screens for the common catastrophic-backtracking shapes:

• High severity — nested unbounded quantifiers: (a+)+, ([a-z]+)*

• Medium severity — quantified alternation with overlapping branches: (a|ab)+

This is a structural scanner, not an automaton analysis: it cannot prove a pattern safe, only flag the dangerous shapes it recognizes. The reports also include a rough performance score based on execution time relative to input size — treat it as a hint, not a benchmark (memory is not measured).

Commands

Settings

Languages

Twelve languages besides English:

German · Spanish · French · Indonesian · Italian · Japanese · Korean · Portuguese (Brazil) · Russian · Ukrainian · Vietnamese · Chinese (Simplified)

Both halves are covered — the manifest (command titles, setting names and descriptions) and everything shown while the extension runs (notifications, the status bar, quick-picks and prompts). The extension follows VS Code's display language, so it matches whatever the editor is already set to; no setting of its own.

Privacy & security

• No network access. The extension never sends data anywhere. The telemetryEnabled setting only writes events to a local Output Channel you can inspect (Regex-LE Telemetry).

• Testing a pattern the ReDoS screen rates high-severity asks for confirmation first.

• The MCP server holds the same line. It takes content as an argument and returns data: no filesystem access, no network calls, no telemetry. Your agent already has file-read tools, so duplicating them inside the server would add a path-traversal surface for no capability. check:mcp-bundle fails the build if the server ever imports something that could reach either.

• Error notifications redact home directories and credential-shaped fragments.

Development

bun install
bun run build            # esbuild bundle -> dist/extension.js
bun run typecheck        # tsc --noEmit (includes tests)
bun run test             # vitest unit suite
bun run test:integration # real VS Code extension host
bun run lint             # biome
bun run package          # VSIX into release/

Architecture and conventions live in AGENTS.md. Changes are tracked in CHANGELOG.md.

Performance

Median of 7 runs after warmup, on Apple M5 Pro, 24 GB RAM, Node 24.3.0. Inputs are generated by scripts/benchmark.ts rather than checked in, so the sizes above are exactly what was measured. Reproduce with bun run benchmark.

These are machine-specific and are not asserted in CI — a benchmark that gates a build only tells you how busy the runner was.

Testing

133 test cases across 12 files, plus an integration suite that runs in a real VS Code extension host and an end-to-end test that installs the built .vsix into a clean profile.

Generated from coverage/coverage-summary.json by scripts/coverage-readme.js; CI fails if this section drifts from a fresh run. Reproduce with bun run test:coverage.

More from the LE Family

Every tool in the family, one page: letools.dev

All ten also ship as MCP servers — npx <name>-mcp gives any agent the same engine.

• String-LE - Extract string values for i18n from JSON, YAML, CSV, TOML, INI, and .env

• Numbers-LE - Extract numeric values from JSON, YAML, CSV, TOML, INI, and .env

• EnvSync-LE - Spot missing keys across your .env files, with a markdown report

• Paths-LE - Extract file paths from JS/TS imports, JSON, HTML, CSS, TOML, CSV, and .env

• Secrets-LE - Detect and sanitize credentials locally, before you commit

• Scrape-LE - Check whether a page is scrapeable before you write the scraper

• Colors-LE - Extract and analyze colors from CSS, SCSS, LESS, Stylus, HTML, JS/TS, and SVG

• URLs-LE - Extract URLs from documentation, configs, and code

• Dates-LE - Extract and analyze dates from logs, configs, and code

Also by nolindnaidoo

Rust

• pixelcoords — Freeze your screen, mark regions, get pixel-exact coordinates and crops pixelcoords.dev · crates.io · docs.rs

• pixelactions — Consume human-verified coordinates, perform the interaction, confirm it landed pixelactions.dev · crates.io · docs.rs

Contact Developer — GitHub · LinkedIn

License

MIT © nolindnaidoo