regex-safety-audit-mcp
Parses a regex into a real AST to catch catastrophic-backtracking (ReDoS) risk — nested unbounded quantifiers, ambiguous alternation inside a repeated group, and backreferences — without ever executing the pattern itself. Generates proof-of-concept attack strings and JS-safe rewrites (JS has no atomic groups or possessive quantifiers, so the usual PCRE/.NET fixes don't transfer).
How to pay
Subscribe
$7/month
Predictable monthly cost with included usage. Best for steady, high-volume traffic.
- Unlimited tools within plan limits
- One API key, billed once a month
- Cancel any time
Deploys three tools that catch ReDoS (catastrophic backtracking) risk before it ships: analyze_redos_risk parses the pattern into a real hand-written AST — not string heuristics — to flag nested unbounded quantifiers, ambiguous alternation inside a repeated group, and backreferences; generate_attack_string produces a proof-of-concept input that would trigger exponential backtracking, for you to test in your own sandboxed process (this tool never executes the pattern itself); suggest_safe_rewrite proposes a corrected pattern, correctly separating a quantifier from its base atom before recombining, and explicitly skips the standard PCRE/.NET "wrap it in an atomic group" advice since JavaScript has no atomic groups or possessive quantifiers. Free tier included, no API key required.