Skip to main content
Glama
tylerscomic-lab

regex-safety-audit-mcp

by tylerscomic-lab
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Hybrid

regex-safety-audit-mcp

License: MIT Live on MCPize

An MCP server that parses a regex into a real hand-written AST to detect catastrophic-backtracking (ReDoS) risk — without ever executing the pattern itself. A ReDoS scanner that runs the regex it's scanning would be able to hang itself; this one never calls new RegExp(...).test() on anything.

What it catches

Nested unbounded quantifiers ((a+)+), ambiguous alternation inside a repeated group ((a|ab)+), and backreferences — the three shapes behind almost every real-world ReDoS incident. Detection is structural (a real parser, not regex-on-regex string heuristics), verified against the canonical literature examples during testing.

Related MCP server: js-reverse-analyzer

The JS-specific trap

Generic ReDoS advice tells you to wrap the offending group in an atomic group or use a possessive quantifier. JavaScript has neither. analyze_redos_risk says so explicitly, and suggest_safe_rewrite gives the actual JS-safe fix (collapsing redundant nesting, or restructuring with a negated character class) instead of advice that would 400 as a syntax error if you tried it.

Tools

analyze_redos_risk

Full structural analysis. Returns a risk level, every finding with its exact reason, and the JS atomic-group/ possessive-quantifier caveat.

generate_attack_string

For a flagged pattern, generates candidate proof-of-concept inputs at a few sizes, plus a ready-to-run Node snippet that times the match with a hard OS-level subprocess timeout — so testing a genuinely catastrophic regex can't hang your own test process either.

suggest_safe_rewrite

Concrete rewritten pattern for the mechanically-fixable shapes; honest "no mechanical fix, here's what to change by hand" for the ones that aren't.

Use it

Hosted (recommended): MCPize — free tier, $7/mo Pro.

Self-host:

npm install
node server.js

Part of a small suite

mcp-schema-audit-mcp, cron-schedule-audit-mcp, claude-cost-audit-mcp.

License

MIT

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityStale
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • RegexForge

    walkojas-boop
    F
    license
    Not graded
    quality
    C
    maintenance
    RegexForge gives AI agents a reliable way to get a regex without asking an LLM to hallucinate one. Pass in labeled examples (strings that should match, strings that shouldn't) plus an optional description; get back the regex, a proof matrix showing it handles every example, and a backtracking-risk audit flagging catastrophic-backtracking patterns. Pure symbolic synthesis over a template bank with
    -

  • regex-quality

    XlogicX
    A
    license
    A
    quality
    D
    maintenance
    Provides tools to test regex patterns for correctness, performance (ReDoS), and memory usage, and suggests safe rewrites. Enables LLMs to iterate on regex generation with verifiable feedback.
    9
    MIT

  • regex-le-mcp

    nolindnaidoo
    A
    license
    Not graded
    quality
    A
    maintenance
    Provides a tool to extract and validate regex patterns from text content, including flags, positions, and ReDoS risk assessment. Enables AI agents to identify potentially dangerous regular expressions in code or files without needing filesystem access.
    2
    MIT