English Français العربية

Regex Safety Audit

السجل الرسمي الأمن

Detects catastrophic-backtracking (ReDoS) regex risk via AST parsing, with JS-safe rewrites.

الشيفرة المصدرية التوثيق

التثبيت

أضف هذا إلى إعدادات MCP في عميلك (Claude Desktop: claude_desktop_config.json، وCursor: ‏.cursor/mcp.json، ويستخدم VS Code وغيره الصيغة نفسها «mcpServers»).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http regex-safety-audit 'https://regex-safety-audit-mcp.mcpize.run/mcp'
إعداد JSON (Claude Desktop وCursor وVS Code) 
{
    "mcpServers": {
        "regex-safety-audit": {
            "type": "http",
            "url": "https://regex-safety-audit-mcp.mcpize.run/mcp"
        }
    }
}

التوثيق

مأخوذ من ملف README للمشروع على GitHub ويُحدَّث أسبوعيًا. تفتح الروابط على GitHub.

المحتويات
  1. regex-safety-audit-mcp
  2. What it catches
  3. The JS-specific trap
  4. Tools
  5. Use it
  6. Part of a small suite
  7. License

regex-safety-audit-mcp

An MCP server that parses a regex into a real hand-written AST to detect catastrophic-backtracking (ReDoS) risk — without ever executing the pattern itself. A ReDoS scanner that runs the regex it's scanning would be able to hang itself; this one never calls new RegExp(...).test() on anything.

What it catches

Nested unbounded quantifiers ((a+)+), ambiguous alternation inside a repeated group ((a|ab)+), and backreferences — the three shapes behind almost every real-world ReDoS incident. Detection is structural (a real parser, not regex-on-regex string heuristics), verified against the canonical literature examples during testing.

The JS-specific trap

Generic ReDoS advice tells you to wrap the offending group in an atomic group or use a possessive quantifier. JavaScript has neither. analyze_redos_risk says so explicitly, and suggest_safe_rewrite gives the actual JS-safe fix (collapsing redundant nesting, or restructuring with a negated character class) instead of advice that would 400 as a syntax error if you tried it.

Tools

analyze_redos_risk

Full structural analysis. Returns a risk level, every finding with its exact reason, and the JS atomic-group/ possessive-quantifier caveat.

generate_attack_string

For a flagged pattern, generates candidate proof-of-concept inputs at a few sizes, plus a ready-to-run Node snippet that times the match with a hard OS-level subprocess timeout — so testing a genuinely catastrophic regex can't hang your own test process either.

suggest_safe_rewrite

Concrete rewritten pattern for the mechanically-fixable shapes; honest "no mechanical fix, here's what to change by hand" for the ones that aren't.

Use it

Hosted (recommended): MCPize — free tier, $7/mo Pro.

Self-host:

npm install
node server.js

Part of a small suite

mcp-schema-audit-mcp, cron-schedule-audit-mcp, claude-cost-audit-mcp.

License

MIT

الأسئلة الشائعة

ما هو Regex Safety Audit؟

Detects catastrophic-backtracking (ReDoS) regex risk via AST parsing, with JS-safe rewrites.

كيف أثبّت Regex Safety Audit؟

يعمل كخادم بعيد. في Claude Code: claude mcp add --transport http regex-safety-audit 'https://regex-safety-audit-mcp.mcpize.run/mcp'. وفي العملاء الآخرين، الصق إعداد JSON من هذه الصفحة في إعدادات MCP الخاصة بهم.

هل يحتاج Regex Safety Audit إلى مفتاح API؟

لا يذكر إدراجه في السجل أي مفتاح أو سر إلزامي. قد تتطلب بعض الميزات حسابًا لدى الخدمة التي يتصل بها.

هل Regex Safety Audit مفتوح المصدر؟

نعم. شيفرته متاحة على GitHub بترخيص MIT.

من يصون Regex Safety Audit؟

ينشره tylerscomic-lab. يدرجه AI.tn لكنه لا يصونه ولا يوصي به.

من سجل MCP الرسمي. الإدراج ليس توصية: راجع شيفرة الخادم وصلاحياته قبل منحه الوصول إلى بياناتك.