ips-le-mcp

ips-le-mcp

An MCP server that finds every IPv4 and IPv6 address, CIDR block and MAC address in a document — with its line, column and key path, its canonical form, and what it is for: loopback, private, link-local, CGNAT, multicast, broadcast, reserved, documentation, unique-local or global. It is the extraction engine behind the IPs-LE editor extension, exposed as a tool an agent can call.

IPv6 comes back in its RFC 5952 form, so 2001:0db8::0001 and 2001:db8::1 are one address rather than two, and ::ffff:127.0.0.1 is classified as the loopback address it is.

Text it cannot read unambiguously comes back as a refusal with the reason, never as a guess. 010.1.1.1 is 8.1.1.1 to a resolver that reads the leading zero as octal and 10.1.1.1 to one that does not, so it is returned as octal_hazard rather than as either address.

No dependencies, no network calls, no filesystem access. It resolves no names and opens no sockets. Content goes in, structured results come out.

Use it

Point any MCP host at npx ips-le-mcp.

Claude Code

claude mcp add ips-le -- npx -y ips-le-mcp

Anything with a JSON config — Cursor, Windsurf, Claude Desktop:

{
  "mcpServers": {
    "ips-le": {
      "command": "npx",
      "args": ["-y", "ips-le-mcp"]
    }
  }
}

VS Code needs nothing here. Install the extension instead — it carries this server and registers it for you: VS Code Marketplace · Open VSX

No Node? The same extract_ips tool ships in a static Rust binary: cargo install ips-le, then ips-le mcp (crates.io). The two servers answer identically — one corpus runs against both, and a differential test feeds both thousands of generated documents in every format, broken JSON included, and compares every answer. The binary additionally offers ips_le_scan, which walks a tree; this server reads no files.

Prefer a global install to npx on every launch:

npm install -g ips-le-mcp

No environment variables, no API key, no configuration of its own. To check it before wiring it into anything:

echo '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | npx -y ips-le-mcp

If that prints the tool name, the server works.

The tool

extract_ips

argument	type
content	string	required. The document text to scan.
format	string	json, yaml, toml, ini, env, csv, tsv or log. Optional — it decides only the key paths, never which addresses are found.
filename	string	Used to infer the format when format is absent, e.g. app.yaml or access.log.1.
kind	string[]	Report only these of ipv4, ipv6, cidr, mac. Refusals are always reported.
class	string[]	Report only these classes. Refusals are always reported.
maxResults	number	Default 500, ceiling 5000.

Every finding carries every field, nulls included: the text as written, a 1-based line and UTF-16 column, the key, the canonical form, the class, a CIDR block's network, last address and host count (as a decimal string — ::/0 holds 2^128), and the refusal:

{
  "ok": true,
  "data": {
    "addresses": [
      {
        "kind": "ipv6",
        "text": "2001:0db8:0000:0000:0000:0000:0000:0001",
        "line": 1,
        "column": 11,
        "key": "upstream",
        "normalized": "2001:db8::1",
        "class": "documentation",
        "cidr": null,
        "refused": null
      },
      {
        "kind": "cidr",
        "text": "10.0.0.0/30",
        "line": 2,
        "column": 8,
        "key": "allow",
        "normalized": "10.0.0.0/30",
        "class": "private",
        "cidr": {
          "prefix": 30,
          "network": "10.0.0.0",
          "broadcast": "10.0.0.3",
          "last": "10.0.0.3",
          "hosts": "4"
        },
        "refused": null
      },
      {
        "kind": "ipv4",
        "text": "010.1.1.1",
        "line": 3,
        "column": 9,
        "key": "legacy",
        "normalized": null,
        "class": null,
        "cidr": null,
        "refused": {
          "reason": "octal_hazard",
          "detail": "010.1.1.1 has a leading zero. Some resolvers read a leading-zero octet as octal and some as decimal, so this text has two addresses and no way to choose."
        }
      }
    ],
    "refused": 1,
    "format": "yaml"
  },
  "diagnostics": [],
  "meta": {
    "tool": "extract_ips",
    "count": 3,
    "truncated": false
  }
}

A JSON document that does not parse still has its addresses reported, with an unparsed warning saying the key paths are missing. ok means the scan ran.

Also in the MCP registry

io.github.nolindnaidoo/ips-le — registry.modelcontextprotocol.io

Thirteen more like it

One tool each, same shape: content in, structured data out, no network and no filesystem. Every one is on npm as <name>-mcp and in the MCP registry as io.github.nolindnaidoo/<name>.

Package	Tool	Does
urls-le-mcp	extract_urls	URLs, with protocol and position
colors-le-mcp	extract_colors	colors from stylesheets and code
dates-le-mcp	extract_dates	dates and timestamps
numbers-le-mcp	extract_numbers	numeric values
paths-le-mcp	extract_paths	file and directory paths
string-le-mcp	extract_strings	string values
regex-le-mcp	extract_patterns	regexes, with a ReDoS verdict
secrets-le-mcp	detect_secrets	credentials, masked — never the value
envsync-le-mcp	compare_env_files	dotenv key drift, names only
scrape-le-mcp	analyze_robots_txt	whether a path may be crawled
unicode-le-mcp	detect_unicode_risks	Unicode that hides meaning, as codepoints
i18n-le-mcp	check_catalogues	translation catalogues, keys only
ids-le-mcp	extract_ids	UUIDs, ULIDs and Snowflakes, with the time inside

Every tool in the family, one page: letools.dev

Built by

Nolin Naidoo — Chief Engineer, AI/ML & Platform Architecture. nolindnaidoo.com · GitHub · LinkedIn

Also from the same workshop

Twelve Rust tools built the same way: small, single-purpose, and driven by a machine rather than a person. pixelcoords and pixelactions make up one loop — pixelcoords answers where, pixelactions acts there. The ten LE crates are the terminal half of the extensions they sit in: the same detection, held to the extension's own corpus, and an exit code instead of a results editor.

pixelcoords	Freeze your screen, mark regions, get pixel-exact coordinates and crops	site · crates.io · docs.rs
pixelactions	Consume human-verified coordinates, perform the interaction, confirm it landed	site · crates.io · docs.rs
paths-le	Find every path in a codebase and report whether it still points at anything	crates.io
secrets-le	Find hardcoded credentials, and never print one	crates.io
urls-le	Extract every URL from a codebase, with its protocol and exact position	crates.io
regex-le	Find every regex in a codebase and report which can be driven into catastrophic backtracking	crates.io
string-le	Get every string in a codebase out where a person can read them	crates.io
numbers-le	Find every hardcoded number in a codebase so a person can check them	crates.io
envsync-le	Compare the dotenv files in a tree and say which keys are missing from which	crates.io
colors-le	Find every colour in a codebase, and say which are not in your palette	crates.io
dates-le	Extract every date and timestamp, and the exact instant each one resolves to	crates.io
scrape-le	Check whether a page is scrapeable before the scraper is written	crates.io

Licence

MIT © Nolin Naidoo