Regex Check

A regular expression means different things to different engines, and agents write them as if it did not: (?P<name>...) is Python and refused by JavaScript, lookbehind is refused by Go and RE2, \d matches Arabic-Indic digits in Python and not in JavaScript, ^abc$ matches "abc\n" in Python and PHP and not in JavaScript, and ^(a+)+$ hangs a server on one crafted input. Regex Check runs the pattern on the real engines, in process:

• JavaScript (V8), Python (CPython's re, through Pyodide), PCRE2 10.48 (PHP's preg_*, grep -P, nginx) and RE2 (the syntax Go's regexp and BigQuery accept).

• Each engine's own verdict: its compile error with the position, or every match with its groups and named groups, and the result of a replacement written in that engine's syntax. Positions are counted in characters for all four, and the report lists where the engines disagree.

• ReDoS: whether a pattern can be made to backtrack catastrophically, exponential or polynomial, the part to blame marked in the pattern, an attack string, and how long each engine actually took on it.

Offline, no key.

Built and maintained by Arhan Canli.

Install

Needs Node.js 20 or newer. No account or key.

Claude Code

claude mcp add regex-check -- npx -y regex-check-mcp

Claude Desktop: download regex-check-mcp-<version>.mcpb from the latest release and open it. The bundle is signed; verify it with gh attestation verify <file> --repo arhancanli/regex-check-mcp.

Any other client (Windsurf, Zed, Cline, Continue and others), in its MCP config file:

{
  "mcpServers": {
    "regex-check": {
      "command": "npx",
      "args": [
        "-y",
        "regex-check-mcp"
      ]
    }
  }
}

Docker

docker build -t regex-check-mcp https://github.com/arhancanli/regex-check-mcp.git && docker run -i --rm regex-check-mcp

Hosted (Streamable HTTP): node src/server.mjs --http serves stateless MCP at POST /mcp (port from PORT, default 3000).

Related MCP server: regex-generator

Example

An agent calls test_regex with:

{
  "pattern": "(?P<year>\\d{4})-(\\d{2})",
  "inputs": [
    "on 2026-09",
    "٢٠٢٦-٠٩ and 1999-12"
  ],
  "replacement": "\\2/\\1"
}

and gets back (recorded from the live server on 2026-09-27):

{
  "engines": [
    {
      "flavor": "javascript",
      "engine": "V8 13.6.233.17-node.51 (Node v24.19.0)",
      "error": {
        "message": "Invalid group"
      }
    },
    {
      "flavor": "python",
      "engine": "CPython 3.14.2 re (Pyodide)",
      "results": [
        {
          "matches": [
            {
              "index": 3,
              "text": "2026-09",
              "groups": [
                "2026",
                "09"
              ],
              "named": {
                "year": "2026"
              }
            }
          ],
          "match_count": 1,
          "replaced": "on 09/2026"
        },
        {
          "matches": [
            {
              "index": 0,
              "text": "٢٠٢٦-٠٩",
              "groups": [
                "٢٠٢٦",
                "٠٩"
              ],
              "named": {
                "year": "٢٠٢٦"
              }
            },
            {
              "index": 12,
              "text": "1999-12",
              "groups": [
                "1999",
                "12"
              ],
              "named": {
                "year": "1999"
              }
            }
          ],
          "match_count": 2,
          "replaced": "٠٩/٢٠٢٦ and 12/1999"
        }
      ]
    },
... (89 more lines)

Tools

How it behaves

• Nothing leaves your machine and there is no network access (factory.allowHosts is empty): the engines are compiled to WebAssembly (Python, PCRE2, RE2) or are Node's own (JavaScript).

• Each engine runs in its own worker thread with a time limit (5 s per call, REGEX_CHECK_TIMEOUT_MS to change it): a pattern that backtracks forever on an input stops that engine only, which is replaced, and the others still answer. The engines start in the background when the server starts, so the first call does not wait for Python to load.

• PCRE2 runs in UTF mode, as PHP's /u modifier uses it, with its default match limit. RE2 takes JavaScript-style $1 replacements, as Go's ReplaceAllString does. Up to 10,000 matches are counted per input and max_matches (default 20) are listed.

• The ReDoS analysis is recheck (MIT), which proves a problem by building an attack string; the attack is then timed on each engine for 2 seconds.

• Results are compact JSON with a matching output schema.

Benchmark

Not yet measured.

Performance

Measured 2026-09-27 from Dubai, home connection against the live upstream, Node 24.19.0 (bench/perf.json, scripts/perf.mjs in the factory).

First call: a fresh server process, including the TLS connection and the upstream's own time. Repeat: the same call again, answered from the in-process cache, so it shows this server's own overhead.

Tool definitions the model reads on every turn (name, description, input schema): 1,490 characters, against 1,251 for @jkumonpm/regex-tester-mcp, a published regex MCP server (JavaScript engine only). The full tool list, with the output schemas and annotations clients use to validate results, is 2,124 characters (1,439 for the alternative).

More MCP servers by Arhan Canli

• Actions Check: Checks GitHub Actions workflows: outdated actions, old Node runtimes, retired runners, injection.

• Config Check: Validates config files against their official schemas: tsconfig, compose, workflows, 1,400+ more.

• Cron Check: Explains cron expressions, lists next run times in any time zone, converts between cron dialects.

• Dockerfile Check: Checks Dockerfiles: build-breaking mistakes, base image tags that exist, digests, platforms, EOL.

• Domain Health: Email and domain checks: SPF lookup limits, DKIM keys, DMARC, DNS records, registration expiry.

• End of Life: Is this version still supported? EOL dates, latest patch and upgrade target for 470+ products.

• Internet Standards: RFC sections, status, obsoleted-by chains, errata and IANA registries for coding agents.

• Kube Check: Checks Kubernetes manifests for your version: removed APIs, unknown fields, Pod Security, risks.

• The whole collection, 12 more

License

MIT, Copyright (c) 2026 Arhan Canli.