Regex-LE
Find every regex in a codebase, and report which can be driven into catastrophic backtracking
No editor in the loop? npx -y regex-le-mcp runs the same engine as an MCP server, so an agent can call extract_patterns with nothing else installed, and cargo install regex-le puts the same check in a terminal. Every way to install it.
Overview
What Regex-LE does
A regular expression is easy to write and hard to trust. Regex-LE finds every pattern in the current file, a folder or the whole workspace, runs one against the document to show real matches with line and column positions and capture groups, and screens each pattern for the shapes that cause catastrophic backtracking. Three jobs: extract, test, validate.
What people use it for
Extract
List every regex pattern found in the document: literals, and RegExp constructors built from strings, template literals or String.raw.
Test
Run a found — or manually entered — pattern against the file and see matches with positions and named capture groups.
Validate
Check every pattern for syntax errors and screen it for ReDoS-prone shapes before it reaches production.
Palette
9 commands
Open the command palette and type the name. Nothing is bound to a shortcut by default — the editor's keymap is the user's, not ours.
regex-le.showPositions: Show the line and column of each pattern and match. On by default.
- Test Regex
regex-le.test - Extract Patterns
regex-le.extract - Extract Patterns from Workspace
regex-le.extractWorkspace - Extract Patterns from Folder
regex-le.extractFolder - Validate Regex
regex-le.validate - Validate Patterns in Workspace
regex-le.validateWorkspace - Validate Patterns in Folder
regex-le.validateFolder - Open Settings
regex-le.openSettings - Help & Troubleshooting
regex-le.help
Install
Install Regex-LE
VS Code
ext install nolindnaidoo.regex-leOpen Quick Open (Cmd/Ctrl+P) and paste.
Cursor / Windsurf
cursor --install-extension nolindnaidoo.regex-leCursor, Windsurf, VSCodium and the other VS Code forks pull from Open VSX. The id is the same as on the Marketplace.
AI agents
npx -y regex-le-mcpRuns Regex-LE's engine as an MCP server, so an agent can call extract_patterns with no editor involved. VS Code 1.101+ needs nothing — the extension registers it for you.
Channels
Where it ships
One engine, 5 places to get it. Copy the one for the editor you use.
Links
Where Regex-LE lives
- VS Code Marketplaceregex-le
- Open VSXfor Cursor, Windsurf and VSCodium
- npmregex-le-mcp
- GitHubsource, issues, changelog
- MCP registryio.github.nolindnaidoo/regex-le
The family
The other 16
String-LEExtract every string in a codebase, so a person can read them
Numbers-LEExtract every hardcoded number in a codebase, so a person can check them
Paths-LEExtract every file path in a codebase, and say whether it still points at anything
Colors-LEExtract every color in a codebase, and say which ones are not in your palette
URLs-LEExtract every URL in a codebase, with its protocol and exact position
Dates-LEExtract every date and timestamp, and the exact instant each one resolves to
Units-LEExtract every quantity with its unit, normalized, and refuse the ambiguous ones by name
IDs-LEExtract every UUID, ULID, NanoID, ObjectId and Snowflake, and decode the time inside
IPs-LEExtract every IP address, CIDR block and MAC, normalized and classified by scope
Scrape-LECheck whether a page is scrapeable before the scraper is written, and say when it cannot tell
Versions-LEFind where one dependency is constrained differently across a repository's manifests
i18n-LEIdentify the i18n library a project uses, then audit its catalogs by that library's rules
DecisionLintLint Jev and Luna questions before they are sent: the questions you write for TypeSafe's Jev, OpenAI's Decisions API (gpt-6-luna) or any platform that serves one, as you type, with no API key and no network calls. An optional command asks the model itself to check a file
Secrets-LEFind hardcoded credentials in a codebase, and never print one into the report
EnvSync-LECompare the dotenv files in a tree, and say which keys are missing from which
Unicode-LEFind the Unicode that hides meaning — bidi controls, invisibles, homoglyphs, mixed scripts