Regex Safety Audit
Detects catastrophic-backtracking (ReDoS) regex risk via AST parsing, with JS-safe rewrites.
Install
Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).
claude mcp add --transport http regex-safety-audit 'https://regex-safety-audit-mcp.mcpize.run/mcp'{
"mcpServers": {
"regex-safety-audit": {
"type": "http",
"url": "https://regex-safety-audit-mcp.mcpize.run/mcp"
}
}
}Documentation
From the project's README on GitHub, refreshed weekly. Links open on GitHub.
Contents
regex-safety-audit-mcp
An MCP server that parses a regex into a real hand-written AST to detect catastrophic-backtracking (ReDoS) risk —
without ever executing the pattern itself. A ReDoS scanner that runs the regex it's scanning would be able to
hang itself; this one never calls new RegExp(...).test() on anything.
What it catches
Nested unbounded quantifiers ((a+)+), ambiguous alternation inside a repeated group ((a|ab)+), and
backreferences — the three shapes behind almost every real-world ReDoS incident. Detection is structural (a real
parser, not regex-on-regex string heuristics), verified against the canonical literature examples during testing.
The JS-specific trap
Generic ReDoS advice tells you to wrap the offending group in an atomic group or use a possessive quantifier.
JavaScript has neither. analyze_redos_risk says so explicitly, and suggest_safe_rewrite gives the actual
JS-safe fix (collapsing redundant nesting, or restructuring with a negated character class) instead of advice that
would 400 as a syntax error if you tried it.
Tools
analyze_redos_risk
Full structural analysis. Returns a risk level, every finding with its exact reason, and the JS atomic-group/ possessive-quantifier caveat.
generate_attack_string
For a flagged pattern, generates candidate proof-of-concept inputs at a few sizes, plus a ready-to-run Node snippet that times the match with a hard OS-level subprocess timeout — so testing a genuinely catastrophic regex can't hang your own test process either.
suggest_safe_rewrite
Concrete rewritten pattern for the mechanically-fixable shapes; honest "no mechanical fix, here's what to change by hand" for the ones that aren't.
Use it
Hosted (recommended): MCPize — free tier, $7/mo Pro.
Self-host:
npm install
node server.jsPart of a small suite
mcp-schema-audit-mcp, cron-schedule-audit-mcp, claude-cost-audit-mcp.
License
MIT
Frequently asked questions
What is Regex Safety Audit?
Detects catastrophic-backtracking (ReDoS) regex risk via AST parsing, with JS-safe rewrites.
How do I install Regex Safety Audit?
It runs as a remote server. In Claude Code: claude mcp add --transport http regex-safety-audit 'https://regex-safety-audit-mcp.mcpize.run/mcp'. For other clients, paste the JSON configuration from this page into their MCP settings.
Does Regex Safety Audit need an API key?
Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.
Is Regex Safety Audit open source?
Yes. Its code is on GitHub under the MIT license.
Who maintains Regex Safety Audit?
It is published by tylerscomic-lab. AI.tn lists it but does not maintain or endorse it.
From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.