Regex Le

What regex-le MCP server does

The regex-le MCP server gives MCP-compatible agents a way to inspect regular expressions embedded in source code. It receives document content directly and returns detected patterns, their flags, one-based locations, and ReDoS screening results. The server does not access the filesystem or make outbound network requests, so the calling agent controls which content is analyzed.

The main use is reviewing a file or code snippet for regex inventory and potential catastrophic backtracking. A reported ReDoS result includes the input that triggered the finding, allowing a developer or agent to reproduce the observation rather than relying only on a structural warning.

How it works

The server exposes extract_patterns over MCP using stdio. Its input accepts content and optional format, filename, and maxResults values. Extraction scans the complete document, including patterns whose constructors span multiple lines.

Language-aware recognition covers JavaScript and TypeScript literals and constructors; Python compilation calls; Rust regex constructors; Go compilation calls; Java Pattern calls; Ruby literals and constructors; PHP matching functions; and C# regex usage. When the format is known, the scanner can avoid treating unrelated slash expressions as JavaScript-style literals. Unknown formats are scanned using the supported spellings without language-specific filtering.

The regex-le MCP server removes candidates in comments and strings when the language rules allow that distinction, ignores duplicate pattern-and-flag pairs, and excludes many non-pattern slash expressions such as dates and paths. It uses heuristic lexing rather than a full parser, so unusual source constructs may still affect extraction.

ReDoS analysis compiles a pattern to an automaton, explores paths resembling a backtracking engine, generates inputs at multiple lengths, and measures work against a budget. A result is reported when a supplied input demonstrably causes excessive backtracking. No result should be interpreted as proof that an unreadable or untested pattern is safe.

Setup and configuration

Run the published package with npx -y regex-le-mcp, or install it globally with npm install -g regex-le-mcp and invoke regex-le-mcp directly. MCP hosts can register either command in their server configuration. Version pinning is supported by specifying a package version with npx.

The server communicates over stdio and requires no environment variables, API key, or server-specific configuration. A basic configuration uses npx with -y and regex-le-mcp as its argument. Piping an MCP tools/list request to the command provides a simple way to confirm that extract_patterns is available.

Tools and capabilities

The regex-le MCP server provides one documented MCP tool:

The tool can identify static string and template-literal arguments in supported constructor forms, but not constructor patterns supplied through variables or template substitutions. It also recognizes language-specific forms such as Python re.compile, Rust Regex::new, Go regexp.Compile, Java Pattern.compile, PHP preg_match, and C# regex calls.

Limitations and notes

Extraction is not a parser for the supported languages. A slash inside a string can be identified incorrectly when its surrounding context resembles an expression. Unsupported or malformed syntax is generally excluded, while another language's recognized spelling may still be reported as written.

Flags are extracted directly for JavaScript literals and constructors; other languages use their own inline flags, constants, or builder methods. Dynamic constructor arguments and template substitutions are not evaluated. Comments and documentation examples are excluded only when the language is known well enough to apply those rules.

ReDoS screening reports demonstrated blow-ups rather than declaring safety from pattern shape alone. Silence is not a clearance, especially for constructs the analyzer cannot fully read, such as some advanced regex features.