모든 AI 에이전트가 방금 생성한 정규식을 배포 전에 검증할 수 있게 해주는 MCP 서버입니다. 정규식이 실제로 무엇과 매칭되는지, 그리고 신뢰할 수 없는 입력에 대해 실행해도 안전한지 여부를 모두 확인할 수 있습니다. 완전히 로컬에서 동작합니다: API 키가 필요 없고, 네트워크 호출도 없으며, MCP SDK와 Zod 외에는 의존성이 없습니다.
정규식은 우연히 테스트한 모든 예제에서는 멀쩡해 보이는 버그가 유입되기로 악명 높은 영역입니다. 특히 다음 두 가지 실패 모드는 흔하면서도 눈으로 놓치기 쉽습니다:
생각한 대로 매칭되지 않습니다. explain_regex는 패턴을 실제 구문 트리로 변환하고 평이한 언어로 설명하므로, "이 패턴이 실제로 숫자를 하나 이상 요구하나요?"라는 질문에 중첩된 괄호를 직접 읽고 판단하지 않아도 되는 빠른 답을 얻을 수 있습니다.
서비스 거부(denial-of-service) 벡터입니다. 중첩된 수량자((a+)+)나 반복 그룹 내부의 모호한 선택((a|a)+)이 있는 정규식은 백트래킹 엔진이 악의적으로 만들어진(또는 우연한) 매칭 실패 입력에 대해 지수적 시간을 소요하게 만들 수 있습니다. 이것은 ReDoS로, 실존하며 반복적으로 악용되어 온 취약점 클래스이고, 에이전트가 적대적 입력에 대해 테스트하지 않고 작성한 정규식에서 나타날 수 있는 그럴듯한 결함입니다. check_redos_risk는 패턴을 실행하지 않고도 구조적 형태를 감지하므로, 신뢰할 수 없거나 의도적으로 악의적인 정규식 소스에 대해 실행해도 안전합니다.
Related MCP server: cron-mcp
explain_regex패턴을 AST로 파싱하고 무엇과 매칭되는지에 대한 평이한 언어 설명을 반환합니다.
check_redos_risk패턴의 구조에서 중첩된 수량자와 반복 그룹 내부의 모호한 선택(파국적 백트래킹의 두 가지 전형적인 원인)을 정적으로 분석합니다. 발견된 각 문제에 대한 구체적인 근거와 함께 "safe", "high", 또는 "critical"을 반환합니다.
두 도구 모두 하나의 파서(src/services/parser.ts)를 공유합니다. 이는 패턴의 원본 소스 텍스트에 문자열 매칭 휴리스틱을 적용하는 방식이 아니라 실제 재귀 하강(recursive-descent) 정규식 파서입니다(리터럴, 문자 클래스, 축약 클래스, 앵커, 캡처/비캡처/명명된 그룹, 전후방 탐색(lookaround), 선택, 수량자, 역참조).
이 검사는 형식 검증기가 아니라 휴리스틱 구조 검사입니다. check_redos_risk는 패턴이 교과서적인 지수 폭발 형태를 가졌는지 알려줄 수 있지만, 패턴이 모든 입력에서 빠르게 동작한다는 것을 증명할 수는 없으며, 현재 감지하는 두 가지 형태 밖의 ReDoS 패턴도 존재합니다. "safe" 결과는 "뚜렷한 문제가 없음"으로 취급하되, 보장으로 받아들이지 마세요.
git clone https://github.com/wedo911/regexguard-mcp-server.git
cd regexguard-mcp-server
npm install
npm run buildMCP 클라이언트의 설정에 추가하세요(예: claude_desktop_config.json, 또는 Claude Code의 프로젝트 .mcp.json):
{
"mcpServers": {
"regexguard": {
"command": "node",
"args": ["/absolute/path/to/regexguard-mcp-server/dist/index.js"]
}
}
}npm run build
node --test tests/parser.test.mjs tests/explain.test.mjs tests/redosCheck.test.mjs44개의 테스트가 파서 문법, 설명 출력, 그리고 ReDoS 검사의 참긍정((a+)+, (a*)*, (a|a)+, (a|ab)+, 비캡처 그룹 내부에 중첩된 패턴)과 참부정((cat|dog)+, 현실적인 사용자 이름 패턴, 현실적인 이메일 패턴, 중첩이 아닌 형제 관계의 반복)을 모두 다룹니다. 따라서 일반적인 패턴에 대한 오탐률은 막연한 기대가 아니라 테스트로 검증된 속성입니다.
npx @modelcontextprotocol/inspector --cli node dist/index.js \
--method tools/call --tool-name check_redos_risk \
--tool-arg pattern='^(([a-zA-Z0-9])+([\.-]?([a-zA-Z0-9])+)*)$'MIT — LICENSE를 참조하세요.
Statically analyze a regex's structure for the two classic causes of catastrophic backtracking: nested quantifiers (e.g. "(a+)+") and ambiguous alternation inside a repeated group (e.g. "(a|a)+"). Both can make a backtracking regex engine take exponential time on a crafted or even accidental non-matching input -- a real, exploitable denial-of-service vector, and a common defect in regexes generated without testing against adversarial input.
This tool NEVER executes the pattern -- it only parses and inspects the pattern's source structure, so it's safe to run on untrusted or deliberately malicious patterns without risk of hanging.
Args:
pattern (string, 1-1000 chars): the regex source, without delimiters.
Returns: For JSON format: { "parsed": boolean, "error": string | null, "risk": "safe" | "high" | "critical", "findings": [ { "category": "nested_quantifier" | "ambiguous_alternation", "severity": "high" | "critical", "message": string } ] }
Examples:
Use when: "is this regex I just generated safe to run against user input?" -> pass the pattern before using it
Use when: reviewing a regex from an untrusted source before adding it to a codebase
Don't use when: you need proof a regex is fast on all inputs -- this is a heuristic structural check (no false negatives are guaranteed to be caught), not a formal verifier
Error Handling:
Returns an error (not an exception) if the pattern doesn't parse.
| Name | Required | Description | Default |
|---|---|---|---|
| pattern | Yes | The regex source, without the surrounding slashes, e.g. "^(a+)+$". |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only, idempotent, non-destructive. The description adds critical behavioral context: the tool never executes the pattern, is safe on untrusted or malicious input, returns errors rather than exceptions on parse failure, and is heuristic with possible missed risks. This is significant added transparency with no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with headings for purpose, usage, arguments, return format, examples, and error handling. Every section contributes useful operational information and the purpose is front-loaded within the first sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Since no output schema exists, the description provides the full JSON return structure, error behavior, and usage boundaries, making the tool actionable. Minor ambiguity about regex flavor is acceptable given the structural check nature, and the description is otherwise complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%: the pattern parameter is fully described with type, min/max length, and an example in the schema. The description repeats the 'without delimiters' point but adds no new semantic meaning beyond what the schema already provides. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: statically analyzing a regex's structure for the two classic causes of catastrophic backtracking (nested quantifiers and ambiguous alternation). This clearly distinguishes it from a generic regex explainer like the sibling explain_regex, even without naming it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit 'Use when' scenarios (generated regex before use, reviewing untrusted regex) and a clear 'Don't use when' caution that it is a heuristic structural check, not a formal verifier. This gives the agent clear selection criteria and exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Parse a regular expression into a real syntax tree and describe in plain English what it matches. Use this to sanity-check a regex you (or someone else) wrote actually does what you intended, before shipping it.
Args:
pattern (string, 1-1000 chars): the regex source, without delimiters (no leading/trailing "/").
Returns: For JSON format: { "explanation": string, "parsed": boolean, "error": string | null } explanation is empty and error is set if the pattern could not be parsed (e.g. unbalanced parentheses, unsupported syntax).
Examples:
Use when: "does this regex actually require the string to start with a letter?" -> pass the pattern, read the explanation
Don't use when: you need to actually run the regex against text -- this tool never executes the pattern, only analyzes its source
Error Handling:
Returns an error (not an exception) if the pattern doesn't parse, with the parser's best guess at where the problem is.
| Name | Required | Description | Default |
|---|---|---|---|
| pattern | Yes | The regex source, without the surrounding slashes, e.g. "^[a-z0-9_]{3,16}$". |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, the description discloses important behavioral traits: the tool never executes the pattern, returns a parsed boolean, returns an error rather than throwing an exception on unparseable input, and provides the parser's best guess at the problem. This adds real context beyond the readOnly/idempotent hints and contains no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with Args, Returns, Examples, and Error Handling sections, and it front-loads the core purpose. It is slightly redundant with the schema in the Args section, but the overall organization makes it easy for an agent to parse and apply.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With only one parameter and no output schema, the description fully compensates by specifying the exact JSON return shape, the meaning of each field, error behavior, and a concrete usage example. An agent has enough information to call the tool correctly and interpret its result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the description's Args section essentially repeats the schema: pattern string, 1-1000 chars, no delimiters. It adds no new semantic information beyond what the input schema already provides, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Parse a regular expression into a real syntax tree and describe in plain English what it matches.' It also clearly differentiates the tool from running a regex by explicitly saying it 'never executes the pattern, only analyzes its source,' which distinguishes it from execution-oriented tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit use guidance: 'Use this to sanity-check a regex... before shipping it' and includes both a 'Use when' example and a 'Don't use when' exclusion. It does not explicitly name check_redos_risk as the alternative for security risk assessment, so it misses the full when/when-not/alternatives pattern, but the context is otherwise clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.0.0check_redos_riskexplain_regexScored across 2 tools
The two tools have clearly distinct purposes: explain_regex describes what a pattern matches, while check_redos_risk analyzes vulnerability to catastrophic backtracking. They share input format but have no functional overlap, making misselection unlikely.
Both tools follow a consistent verb_noun snake_case pattern (explain_regex and check_redos_risk). The naming is predictable and aligns with the domain.
With only two tools, the server is minimally scoped, but for a dedicated regex-analysis utility this is reasonable and each tool addresses a core need. Slightly under typical range but appropriate for the narrow focus.
The server covers the essential aspects of regex analysis: comprehension (explain_regex) and security risk (check_redos_risk). Syntax validation is implicitly handled via parse errors. There are no obvious missing operations within the stated purpose.
Explain a regex in plain English and detect catastrophic backtracking risk.
Security scanner for AI agents: prompt injection, leaked secrets, PII, and SSRF-risk URL detection.
The WAF for agents. Pattern-based + heuristic firewall scans prompts, RAG documents, tool argume...
Detects catastrophic-backtracking (ReDoS) regex risk via AST parsing, with JS-safe rewrites.