Skip to content
Limited Edition DevTools

Unicode-LE

Find the Unicode that hides meaning — Trojan Source controls, invisibles, homoglyphs, mixed scripts.

FreeOpen sourceMITNo network access

The command-line tool and its MCP server are written and tested. The VS Code extension is not written yet, so there is nothing to install from the Marketplace or Open VSX — those links appear here when it ships rather than before.

No editor in the loop? unicode-le mcp runs the same engine as an MCP server, so an agent can call detect_unicode_risks over stdio, with no editor and no Node, and cargo install unicode-le puts the same check in a terminal. Every way to install it.

unicode-le src/
src/auth.ts:1:18  [high] bidi-control U+202E  right-to-left override: a bidirectional control reorders how the rest of the line renders, so the text a reviewer reads is not the text that runs
src/auth.ts:1:20  [high] bidi-control U+2066  left-to-right isolate: a bidirectional control reorders how the rest of the line renders, so the text a reviewer reads is not the text that runs
src/auth.ts:1:29  [high] bidi-control U+2069  pop directional isolate: a bidirectional control reorders how the rest of the line renders, so the text a reviewer reads is not the text that runs
src/auth.ts:1:30  [high] bidi-control U+2066  left-to-right isolate: a bidirectional control reorders how the rest of the line renders, so the text a reviewer reads is not the text that runs
src/hosts.ts:1:25  [high] mixed-script U+0430  one word written in Cyrillic and Latin: no single script accounts for it, which is how a name that reads as familiar is forged
src/hosts.ts:1:26  [high] confusable U+0430  a Cyrillic character in a word that is not Cyrillic, and it reduces to the codepoint under `resembles`: the two are indistinguishable on screen
src/zh-CN.json: 18% of this file's letters are Han, and no expected script was declared for it. The confusable and mixed-script checks did not run here: in a file written in another script there is nothing to tell a forged name from a translated one, and answering anyway would bury the real findings. Every other check did run.
6 findings in 3 files, 1 refused (0 not read at all)
name the expected script with --script to have those files judged too
exit 1
A real run against a source tree holding one Trojan Source line, one forged hostname and a Chinese catalogue. The summary above is what a person reads; the same findings go to stdout as JSON, which is what a script reads.

What Unicode-LE does

Some characters are not what they look like. Unicode-LE scans a tree for the ones that hide meaning: the bidirectional controls behind CVE-2021-42574, zero-width and other invisibles, homoglyphs, words no single script accounts for, text that is not in Normalization Form C, and the spaces that are not the space. It reports codepoints and never the characters themselves, because a report that pasted one raw would reorder the terminal, the diff and the pull request of whoever read it. It rewrites nothing. A file plainly written in another script is refused for the homoglyph checks rather than judged by them, which is what lets the screen stay on in an internationalised repository instead of being switched off for noise.

What people use it for

Gate CI on Trojan Source

Fail the build on the bidirectional-control class alone, or on every finding — the exit code is the interface.

Screen for forged names

A Cyrillic character sitting in an otherwise Latin word is a finding; a word written wholly in Cyrillic is not.

Explain the string that never matches

A zero-width space between two values a hash calls different and a person calls identical, reported at its key.

Install Unicode-LE

Command lineComing soon

cargo install unicode-le

Not on crates.io yet — v0.1.0 builds from the repository today, and this command starts working the day it publishes. Follow the repository.

VS CodeComing soon

ext install nolindnaidoo.unicode-le

The extension is not written yet, so this id resolves to nothing on the Marketplace. It is the id it will take. Follow the repository.

Cursor / VSCodiumComing soon

cursor --install-extension OffensiveEdge.unicode-le

Same again for the forks, which resolve Open VSX rather than the Marketplace. Follow the repository.

Zed

unicode-le mcp

Works in Zed today — add the command above as a custom MCP server from the agent panel, and detect_unicode_risks appears in its tool list. There is no one-click listing in Zed's extension registry yet.

AI agents

unicode-le mcp

Runs Unicode-LE's engine as an MCP server over stdio, so an agent can call detect_unicode_risks with no editor and no Node. The binary is the server — there is nothing else to install.

Where it ships

One engine, 6 places to get it. The ids differ by registry — copy the one for the editor you use.

Where Unicode-LE lives

The other 15

Extract string values from JSON, YAML, CSV, TOML, INI, and .env — for i18n.

Extract numeric values from JSON, YAML, CSV, TOML, INI, and .env.

Pull every file path out of JS/TS imports, JSON, HTML, CSS, TOML, CSV, and .env files.

Extract and analyze colors from CSS, SCSS, LESS, Stylus, HTML, JS/TS, and SVG.

Extract URLs from documentation, configs, and code.

Extract date and time data from logs, configs, and code.

Extract every quantity with its unit, normalised to one base unit so two configs can be compared.

Find every UUID, ULID, NanoID, ObjectId and Snowflake, and decode the time inside it.

Find every IP address, CIDR block and MAC address in a tree, normalized and classified.

Find, test, and validate the regular expressions in any file — match reports and built-in ReDoS screening.

Check whether a page is actually scrapeable before you burn hours debugging.

Find where the same dependency is constrained differently across a repository’s manifests.

Audit translation catalogues for missing keys, placeholder drift and structural mismatches.

Detect and sanitize credentials, tokens, API keys, and private keys locally — before you commit.

Spot missing keys across your .env files — automatic checks, a status bar counter, and a markdown report.