secrets-le-mcp

An MCP server that extracts URLs from documentation, configuration and code — the extraction engine behind the Secrets-LE editor extension, exposed as a tool an agent can call.

No dependencies, no network calls, no filesystem access. Content goes in, structured results come out.

Use it

Point any MCP host at npx secrets-le-mcp.

Claude Code

claude mcp add secrets-le -- npx -y secrets-le-mcp

Anything with a JSON config — Cursor, Windsurf, Claude Desktop:

{
  "mcpServers": {
    "secrets-le": {
      "command": "npx",
      "args": ["-y", "secrets-le-mcp"]
    }
  }
}

VS Code and Zed need nothing here. Install the extension instead — it carries this server and registers it for you: VS Code Marketplace · Open VSX · Zed (no listing yet — add it by hand)

No Node? The same detect_secrets tool ships in a static Rust binary: cargo install secrets-le, then secrets-le mcp (crates.io). The two servers answer identically — one fixture corpus runs against both and CI fails if they diverge — and both mask the same way. The binary additionally offers secrets_le_scan, which walks a tree; this server reads no files, which is what lets an agent call it anywhere.

Prefer a global install to npx on every launch:

npm install -g secrets-le-mcp

{
  "mcpServers": {
    "secrets-le": { "command": "secrets-le-mcp" }
  }
}

No environment variables, no API key, no configuration of its own. To check it before wiring it into anything:

echo '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | npx -y secrets-le-mcp

If that prints the tool name, the server works.

The tool

detect_secrets

| argument | type | | |---|---|---| | content | string | required. The text to scan. | | format | string | The language: markdown, yaml, json, typescript… Required unless filename is given. | | filename | string | Used to infer format when it is absent — README.md resolves to markdown. | | dedupe | boolean | Collapse repeats. Default false. | | maxResults | number | Default 500, ceiling 5000. |

Returns each URL with its protocol and 1-based line and column, plus meta.truncated so a capped result is never mistaken for a complete one.

{
  "ok": true,
  "data": {
    "secrets": [
      { "value": "https://example.com/guide", "protocol": "https", "line": 2, "column": 15 }
    ]
  },
  "meta": { "count": 1, "truncated": false }
}

Extraction is heuristic, and what it deliberately does not match is documented as carefully as what it does — see the extension README.

Also in the MCP registry

io.github.nolindnaidoo/secrets-le — registry.modelcontextprotocol.io

Nine more like it

One tool each, same shape: content in, structured data out, no network and no filesystem. Every one is on npm as <name>-mcp and in the MCP registry as io.github.nolindnaidoo/<name>.

| Package | Tool | Extracts | |---|---|---| | urls-le-mcp | extract_urls | URLs, with protocol and position | | colors-le-mcp | extract_colors | colors from stylesheets and code | | dates-le-mcp | extract_dates | dates and timestamps | | paths-le-mcp | extract_paths | file and directory paths | | numbers-le-mcp | extract_numbers | numeric values | | string-le-mcp | extract_strings | string values | | regex-le-mcp | extract_patterns | regexes, with a ReDoS verdict | | envsync-le-mcp | compare_env_files | dotenv key drift, names only | | scrape-le-mcp | analyze_robots_txt | whether a path may be crawled |

Every tool in the family, one page: letools.dev

Built by

Nolin Naidoo — Chief Engineer, AI/ML & Platform Architecture. nolindnaidoo.com · GitHub · LinkedIn

Also from the same workshop

Twelve Rust tools built the same way: small, single-purpose, and driven by a machine rather than a person. pixelcoords and pixelactions make up one loop — pixelcoords answers where, pixelactions acts there. The nine LE crates are the terminal half of the extensions they sit in: the same detection, held to the extension's own corpus, and an exit code instead of a results editor.

| | | | |---|---|---| | pixelcoords | Freeze your screen, mark regions, get pixel-exact coordinates and crops | site · crates.io · docs.rs | | pixelactions | Consume human-verified coordinates, perform the interaction, confirm it landed | site · crates.io · docs.rs | | paths-le | Find every path in a codebase and report whether it still points at anything | crates.io | | secrets-le | Find hardcoded credentials, and never print one | crates.io | | urls-le | Extract every URL from a codebase, with its protocol and exact position | crates.io | | regex-le | Find every regex in a codebase and report which can be driven into catastrophic backtracking | crates.io | | string-le | Get every string in a codebase out where a person can read them | crates.io | | numbers-le | Find every hardcoded number in a codebase so a person can check them | crates.io | | envsync-le | Compare the dotenv files in a tree and say which keys are missing from which | crates.io | | colors-le | Find every colour in a codebase, and say which are not in your palette | crates.io | | scrape-le | Check whether a page is scrapeable before the scraper is written | crates.io |

Licence

MIT © Nolin Naidoo