io.github.nolindnaidoo/regex-le MCP Server

This MCP server extracts regular expressions from code and returns, for each expression, a ReDoS safety verdict. It supports developers who need to identify regex patterns, assess performance and potential Regular Expression Denial of Service (ReDoS) risk, and validate extracted patterns.

🛠️ Key Features

Extract regular expressions from code
Provide a ReDoS safety verdict per extracted regex
Focus on regex extraction, matching, and validation

🚀 Use Cases

Identify and review regex patterns in codebases
Validate regular expressions for ReDoS risk
Support testing and performance-focused scrutiny of regex usage
Assist workflows related to regex tooling (including VS Code contexts)

⚡ Developer Benefits

Enables extraction of regex patterns for analysis
Adds a security-oriented assessment via ReDoS safety verdicts
Helps classify and validate patterns using consistent extraction and testing data

⚠️ Limitations

Scope is limited to extracting regex from code and issuing ReDoS safety verdicts

Regex-LE Logo

Regex-LE: Zero Hassle Regex Extraction & Validation

Find, test, and validate the regex patterns in the current file
Literal patterns, RegExp constructors, ReDoS screening

Regex-LE Demo

Useful? A star or rating is how other developers find it — ★ GitHub · ★ Marketplace · ★ Open VSX

What it does

Open any file and run one of three commands. Extract lists every regex pattern found in the document. Test (Ctrl+Alt+R / Cmd+Alt+R) runs a found — or manually entered — pattern against the file content and reports matches with real line/column positions and capture groups (named groups included). Validate checks every found pattern for syntax errors and screens it for ReDoS-prone shapes. Works in VS Code and VS Code–based editors like Cursor and VSCodium (installable from Open VSX).

Use it from an AI agent

The same engine runs as an MCP server, so an agent can call it directly instead of you running a command.

Editor	How
VS Code 1.101+	Nothing to install — the extension registers `extract_patterns` with agent mode
Zed	Regex-LE — pending review
Claude Code	`claude mcp add regex-le -- npx -y regex-le-mcp`
Cursor, Windsurf, anything else	point it at `npx regex-le-mcp`

code

extract_patterns(content, maxResults?)

Returns every pattern with its flags, 1-based position and a ReDoS verdict, so "are any of the regexes in this file dangerous?" is one call rather than two.

The server takes content and returns data — it reads no files and makes no network requests of its own. Published as regex-le-mcp on npm and as io.github.nolindnaidoo/regex-le in the MCP registry.

Configuring it by hand — any host with an MCP config file

Most hosts read a JSON config. Add one entry:

json

{
  "mcpServers": {
    "regex-le": {
      "command": "npx",
      "args": ["-y", "regex-le-mcp"]
    }
  }
}

-y skips the install prompt on first run. Pin a version if you would rather not track releases — regex-le-mcp@2.2.1.

Prefer not to go through npx on every launch? Install it once and point at the binary instead:

bash

npm install -g regex-le-mcp

json

{
  "mcpServers": {
    "regex-le": { "command": "regex-le-mcp" }
  }
}

It speaks MCP over stdio and needs no environment variables, no API key and no configuration of its own. To check it before wiring it into anything:

bash

echo '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | npx -y regex-le-mcp

That prints the tool list and exits — if you see extract_patterns, the server works.

What gets extracted

Extraction scans the whole document (any file type), so constructors split across lines are found too:

Form	Example
Literal	`/[a-z]+/gi`
Constructor	`new RegExp('\\d{4}-\\d{2}', 'g')` — including multiline
Bare constructor call	`RegExp("x\|y", "i")`

What is deliberately not extracted:

Division, dates, and filesystem paths (a / b, 10/29/2025, /usr/local/bin): a / preceded by an identifier, number, ), ], ., or another / is not treated as a regex — after keywords like return, it is.
Candidates that do not compile as JavaScript regexes, or with invalid/duplicate flags.
Constructor calls whose pattern argument is a variable or template literal (only literal string arguments are visible to a text scanner).

Duplicate pattern+flags pairs are listed once. This is lexing by heuristic, not a full JS parser: a slash inside a string or comment can still be picked up when its context looks expression-like.

ReDoS screening

Validate (and Test, before running a risky pattern) screens for the common catastrophic-backtracking shapes:

High severity — nested unbounded quantifiers: (a+)+, ([a-z]+)*
Medium severity — quantified alternation with overlapping branches: (a|ab)+

This is a structural scanner, not an automaton analysis: it cannot prove a pattern safe, only flag the dangerous shapes it recognizes. The reports also include a rough performance score based on execution time relative to input size — treat it as a hint, not a benchmark (memory is not measured).

Commands

Command	Description
`Regex-LE: Test Regex` (`Ctrl+Alt+R` / `Cmd+Alt+R`)	Test a found or entered pattern against the file
`Regex-LE: Extract Patterns`	List every regex pattern found in the document
`Regex-LE: Validate Regex`	Syntax + ReDoS report for every found pattern
`Regex-LE: Open Settings`	Open Regex-LE settings
`Regex-LE: Help & Troubleshooting`	Built-in documentation

Settings

Setting	Default	Description
`regex-le.openResultsSideBySide`	`true`	Open results beside the current editor
`regex-le.copyToClipboardEnabled`	`false`	Also copy results to the clipboard
`regex-le.notificationsLevel`	`silent`	`all` = every notification, `important` = warnings + errors, `silent` = errors only
`regex-le.safety.enabled`	`true`	Guardrails for very large files and outputs
`regex-le.safety.fileSizeWarnBytes`	`1000000`	Refuse processing above this file size
`regex-le.safety.largeOutputLinesThreshold`	`50000`	Refuse result documents above this line count
`regex-le.statusBar.enabled`	`true`	Show the status bar item
`regex-le.telemetryEnabled`	`false`	Local-only event log (see Privacy)
`regex-le.regex.redosDetectionEnabled`	`true`	ReDoS screening in Test/Validate
`regex-le.regex.maxMatchLimit`	`1000`	Cap on matches collected per test (10–10000)

Languages

Twelve languages besides English:

German · Spanish · French · Indonesian · Italian · Japanese · Korean · Portuguese (Brazil) · Russian · Ukrainian · Vietnamese · Chinese (Simplified)

Both halves are covered — the manifest (command titles, setting names and descriptions) and everything shown while the extension runs (notifications, the status bar, quick-picks and prompts). The extension follows VS Code's display language, so it matches whatever the editor is already set to; no setting of its own.

Privacy & security

No network access. The extension never sends data anywhere. The telemetryEnabled setting only writes events to a local Output Channel you can inspect (Regex-LE Telemetry).
Testing a pattern the ReDoS screen rates high-severity asks for confirmation first.
The MCP server holds the same line. It takes content as an argument and returns data: no filesystem access, no network calls, no telemetry. Your agent already has file-read tools, so duplicating them inside the server would add a path-traversal surface for no capability. check:mcp-bundle fails the build if the server ever imports something that could reach either.
Error notifications redact home directories and credential-shaped fragments.

Development

bash

bun install
bun run build            # esbuild bundle -> dist/extension.js
bun run typecheck        # tsc --noEmit (includes tests)
bun run test             # vitest unit suite
bun run test:integration # real VS Code extension host
bun run lint             # biome
bun run package          # VSIX into release/

Architecture and conventions live in AGENTS.md. Changes are tracked in CHANGELOG.md.

Performance

Input	Size	Found	Time	Rate	Scan speed
JS with literals	1.12 MB	25,000	44.19 ms	565,679/sec	25.4 MB/s
JS with constructors	1.27 MB	25,000	41.86 ms	597,268/sec	30.3 MB/s
Source without regexes	1.24 MB	0	18.75 ms	—	66 MB/s

Median of 7 runs after warmup, on Apple M5 Pro, 24 GB RAM, Node 24.3.0. Inputs are generated by scripts/benchmark.ts rather than checked in, so the sizes above are exactly what was measured. Reproduce with bun run benchmark.

These are machine-specific and are not asserted in CI — a benchmark that gates a build only tells you how busy the runner was.

Testing

Metric	Coverage
Statements	90.66%
Branches	75.89%
Functions	97.36%
Lines	91.16%

133 test cases across 12 files, plus an integration suite that runs in a real VS Code extension host and an end-to-end test that installs the built .vsix into a clean profile.

Generated from coverage/coverage-summary.json by scripts/coverage-readme.js; CI fails if this section drifts from a fresh run. Reproduce with bun run test:coverage.

Also by nolindnaidoo

Rust

pixelcoords — Freeze your screen, mark regions, get pixel-exact coordinates and crops pixelcoords.dev · crates.io · docs.rs
pixelactions — Consume human-verified coordinates, perform the interaction, confirm it landed pixelactions.dev · crates.io · docs.rs

Contact Developer — GitHub · LinkedIn

Regex-LE

io.github.nolindnaidoo/regex-le MCP Server

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

Topics

Regex-LE: Zero Hassle Regex Extraction & Validation

What it does

Use it from an AI agent

What gets extracted

ReDoS screening

Commands

Settings

Languages

Privacy & security

Development

Performance

Testing

More from the LE Family

Also by nolindnaidoo

License

Install