Rexact

io.github.Nicolasmar91Published by GitHub account Nicolasmar91v0.1.2Updated Oct 24, 2026

Verify, explain and audit regexes (ReDoS, engine compatibility) offline.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Local MCP server that lets an assistant verify, explain, ReDoS-audit and check engine compatibility of regular expressions, plus optionally generate regexes.

What you can do
  • Verify regex patterns against test cases and return a corpus report
  • Audit patterns for ReDoS risk and get a verdict
  • Explain a pattern token by token, with a locale option
  • Check compatibility of a pattern against chosen regex engine targets
  • Generate a verified pattern from a description and cases (requires an Anthropic API key)
When to use it
Useful when you write or review regular expressions and want an assistant to test them against sample inputs, explain what they match, spot catastrophic backtracking, or confirm they work across different regex engines.
Requirements
Runs locally over stdio, typically launched with npx from the rexact-mcp npm package, so Node.js and network access for the first install are needed. Four of the five tools work offline with no key; the generate_regex tool needs an ANTHROPIC_API_KEY environment variable. An optional self-hosted HTTP mode is also documented.
Before you install
The generate_regex tool sends your description and cases to Anthropic using your own ANTHROPIC_API_KEY, billed to your account. The README states supplied regexes are only run inside a sandboxed worker with a hard timeout, but you are still handing untrusted patterns to a local process.

Installation

In SourceWeft

  1. Open Rexact in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

rexact-mcp

Serveur MCP (Model Context Protocol) pour Rexact — vérification, analyse ReDoS, explication et compatibilité multi-moteurs de regex, adossées à @rexact/core (le même moteur déterministe que le site).

Quatre des cinq outils fonctionnent hors ligne, sans clé API, sans coût :

OutilEntréeSortie
verify_regexpattern, flags, casesCorpusReport
check_redospattern, flagsRedosVerdict
explain_regexpattern, flags, localeExplainToken[]
check_compatpattern, flags, targetsCompatIssue[]
generate_regexdescription, cases, flavormotif vérifié — nécessite ANTHROPIC_API_KEY

Aucune regex fournie n'est jamais exécutée en dehors d'un bac à sable worker_threads avec timeout dur et terminaison forcée (invariant I2 du dépôt) — jamais un new RegExp().test() direct côté serveur.

Installation locale (transport stdio)

Le plus simple pour un client MCP comme Claude Desktop : coller ce bloc dans sa configuration MCP.

json
{  "mcpServers": {    "rexact": {      "command": "npx",      "args": ["-y", "rexact-mcp"]    }  }}

Pour activer generate_regex (facultatif), ajouter votre propre clé Anthropic — c'est votre clé, à votre coût, jamais le quota gratuit du site :

json
{  "mcpServers": {    "rexact": {      "command": "npx",      "args": ["-y", "rexact-mcp"],      "env": {        "ANTHROPIC_API_KEY": "sk-ant-..."      }    }  }}

Transport HTTP streamable

Pour héberger le serveur (auto-hébergement, réseau interne) :

bash
pnpm --filter rexact-mcp buildPORT=3300 pnpm --filter rexact-mcp start:http

Le serveur écoute sur / (POST pour ouvrir une session et envoyer des requêtes, GET pour le flux SSE d'une session existante). L'en-tête mcp-session-id, renvoyé à l'initialisation, identifie la session sur les requêtes suivantes.

Développement

bash
pnpm --filter rexact-mcp dev      # rebuild à chaque changementpnpm --filter rexact-mcp typecheck

Liens

Page d'accueil, exemples et installation par client : https://rexact.dev/fr/mcp (EN : https://rexact.dev/en/mcp). Licence : MIT.

Source: apps/mcp/README.md at commit f5237e1

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.2LatestOct 15, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts