regex-safety-audit-mcp
An MCP server that parses a regex into a real hand-written AST to detect catastrophic-backtracking (ReDoS) risk —
without ever executing the pattern itself. A ReDoS scanner that runs the regex it's scanning would be able to
hang itself; this one never calls new RegExp(...).test() on anything.
What it catches
Nested unbounded quantifiers ((a+)+), ambiguous alternation inside a repeated group ((a|ab)+), and
backreferences — the three shapes behind almost every real-world ReDoS incident. Detection is structural (a real
parser, not regex-on-regex string heuristics), verified against the canonical literature examples during testing.
The JS-specific trap
Generic ReDoS advice tells you to wrap the offending group in an atomic group or use a possessive quantifier.
JavaScript has neither. analyze_redos_risk says so explicitly, and suggest_safe_rewrite gives the actual
JS-safe fix (collapsing redundant nesting, or restructuring with a negated character class) instead of advice that
would 400 as a syntax error if you tried it.
Tools
analyze_redos_risk
Full structural analysis. Returns a risk level, every finding with its exact reason, and the JS atomic-group/ possessive-quantifier caveat.
generate_attack_string
For a flagged pattern, generates candidate proof-of-concept inputs at a few sizes, plus a ready-to-run Node snippet that times the match with a hard OS-level subprocess timeout — so testing a genuinely catastrophic regex can't hang your own test process either.
suggest_safe_rewrite
Concrete rewritten pattern for the mechanically-fixable shapes; honest "no mechanical fix, here's what to change by hand" for the ones that aren't.
Use it
Hosted (recommended): MCPize — free tier, $7/mo Pro.
Self-host:
npm install
node server.js
Part of a small suite
mcp-schema-audit-mcp, cron-schedule-audit-mcp, claude-cost-audit-mcp.
License
MIT