Regex Safety Audit
Detects catastrophic-backtracking (ReDoS) regex risk via AST parsing, with JS-safe rewrites.
Installation
Ajoutez ceci à la configuration MCP de votre client (Claude Desktop : claude_desktop_config.json ; Cursor : .cursor/mcp.json ; VS Code et les autres utilisent la même forme « mcpServers »).
claude mcp add --transport http regex-safety-audit 'https://regex-safety-audit-mcp.mcpize.run/mcp'{
"mcpServers": {
"regex-safety-audit": {
"type": "http",
"url": "https://regex-safety-audit-mcp.mcpize.run/mcp"
}
}
}Documentation
Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.
Sommaire
regex-safety-audit-mcp
An MCP server that parses a regex into a real hand-written AST to detect catastrophic-backtracking (ReDoS) risk —
without ever executing the pattern itself. A ReDoS scanner that runs the regex it's scanning would be able to
hang itself; this one never calls new RegExp(...).test() on anything.
What it catches
Nested unbounded quantifiers ((a+)+), ambiguous alternation inside a repeated group ((a|ab)+), and
backreferences — the three shapes behind almost every real-world ReDoS incident. Detection is structural (a real
parser, not regex-on-regex string heuristics), verified against the canonical literature examples during testing.
The JS-specific trap
Generic ReDoS advice tells you to wrap the offending group in an atomic group or use a possessive quantifier.
JavaScript has neither. analyze_redos_risk says so explicitly, and suggest_safe_rewrite gives the actual
JS-safe fix (collapsing redundant nesting, or restructuring with a negated character class) instead of advice that
would 400 as a syntax error if you tried it.
Tools
analyze_redos_risk
Full structural analysis. Returns a risk level, every finding with its exact reason, and the JS atomic-group/ possessive-quantifier caveat.
generate_attack_string
For a flagged pattern, generates candidate proof-of-concept inputs at a few sizes, plus a ready-to-run Node snippet that times the match with a hard OS-level subprocess timeout — so testing a genuinely catastrophic regex can't hang your own test process either.
suggest_safe_rewrite
Concrete rewritten pattern for the mechanically-fixable shapes; honest "no mechanical fix, here's what to change by hand" for the ones that aren't.
Use it
Hosted (recommended): MCPize — free tier, $7/mo Pro.
Self-host:
npm install
node server.jsPart of a small suite
mcp-schema-audit-mcp, cron-schedule-audit-mcp, claude-cost-audit-mcp.
License
MIT
Questions fréquentes
Qu'est-ce que Regex Safety Audit ?
Detects catastrophic-backtracking (ReDoS) regex risk via AST parsing, with JS-safe rewrites.
Comment installer Regex Safety Audit ?
Il fonctionne comme serveur distant. Dans Claude Code : claude mcp add --transport http regex-safety-audit 'https://regex-safety-audit-mcp.mcpize.run/mcp'. Pour les autres clients, collez la configuration JSON de cette page dans leurs réglages MCP.
Faut-il une clé API pour Regex Safety Audit ?
Son entrée au registre n'indique aucune clé ni secret obligatoire. Certaines fonctions peuvent tout de même demander un compte auprès du service auquel il se connecte.
Regex Safety Audit est-il open source ?
Oui. Son code est sur GitHub sous licence MIT.
Qui maintient Regex Safety Audit ?
Il est publié par tylerscomic-lab. AI.tn le référence sans le maintenir ni le recommander.
Issu du registre MCP officiel. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.