"author:tylerscomic-lab" matching MCP servers:

Enables users to statically analyze regular expressions for catastrophic-backtracking (ReDoS) risk through real AST parsing rather than executing the pattern, flagging nested quantifiers, ambiguous alternation, and backreferences. It also generates candidate proof-of-concept attack strings with a timeout-guarded test snippet and suggests JavaScript-safe rewrites.

Enables users to audit Dockerfiles for container-security anti-patterns, including missing USER, baked-in secrets, curl | sh / wget | bash, unpinned base images, and ADD with remote URLs. It parses Dockerfile structure to return risk levels and actionable fixes.

Enables users to scan AI agent skills and configuration files for hidden Unicode instructions, prompt injection, download-and-execute payloads, exfiltration patterns, and overly broad permissions before installation. It provides static audit tools for skill files, agent configs, and revealing hidden text without executing or fetching the input.

Enables scanning arbitrary text and added lines in unified git diffs for accidentally committed credentials, using precise vendor-format matches and entropy-based detection. All detected secrets are redacted before results are returned, helping coding agents and developers catch leaks without exposing full values.

Enables static auditing of Pine Script v6 strategies to catch backtest-vs-live divergence traps before deployment, returning specific lines and plain-English explanations. It identifies fill-timing, ATR-smoothing, lookahead bias, VWAP-anchoring drift, exit-drift, and v6 syntax issues.

Scores MCP tool definitions and tool lists from 0-100, flagging vague descriptions, missing parameter docs, non-verb-first naming, oversized enums, and nested schemas with severity, rationale, and concrete fixes. It also validates marketplace listings against platform character caps such as MCPize's 500-character short-description limit before deploy.

Enables auditing package.json files for real npm supply-chain attack mechanisms — typosquatted dependency names, malicious preinstall/install/postinstall scripts that pipe downloads into a shell or decode base64 payloads, and unpinned versions — plus live npm registry lookups that flag nonexistent, brand-new, deprecated, or typosquatted packages. It exposes dedicated tools for full manifest audits and single-name typosquat checks.

Enables exact Claude API cost estimation from token counts with correct prompt-cache economics, plus cache break-even analysis showing whether and at which TTL reusing a prefix pays off. It also scans source code for tiktoken-based token counting used alongside Claude models and points to the correct fix.