Regex Safety Audit

io.github.tylerscomic-labPublished by GitHub account tylerscomic-labv1.0.0Updated Oct 24, 2026

Detects catastrophic-backtracking (ReDoS) regex risk via AST parsing, with JS-safe rewrites.

The publisher's own server: audit.domains - Domain Valuation

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Audits regular expressions for catastrophic-backtracking (ReDoS) risk using AST parsing and suggests JavaScript-safe rewrites.

What you can do
Parses a regex into a hand-written AST to detect catastrophic-backtracking (ReDoS) risk without ever executing the pattern. It catches nested unbounded quantifiers, ambiguous alternation inside a repeated group, and backreferences. analyze_redos_risk returns a risk level, findings with reasons, and a JavaScript caveat; generate_attack_string produces candidate proof-of-concept inputs plus a Node snippet with a hard subprocess timeout; suggest_safe_rewrite gives concrete JS-safe rewrites or an honest note when no mechanical fix exists.
When to use it
Useful when reviewing or hardening regular expressions in JavaScript code and you want structural ReDoS detection rather than string heuristics. It fits security review, code audit, and dependency or pattern-validation workflows where a flagged pattern needs a safe rewrite or a bounded proof-of-concept test. Less relevant if you only need to test whether a pattern matches.},
Requirements
A remote streamable HTTP endpoint at with OAuth authentication required. No packages, environment variables, or headers are declared. Self-hosting is described as possible via npm install and node server.js, which would need Node.js.
Before you install
The hosted endpoint requires OAuth authentication. The README mentions a free tier and a paid Pro plan at $7/mo, so paid usage may apply. The generate_attack_string tool produces proof-of-concept inputs and a Node snippet intended to be run locally; running it against a genuinely catastrophic pattern is the scenario the hard subprocess timeout is meant to contain, so treat generated snippets carefully. No secrets or environment variables are declared.

Installation

In SourceWeft

  1. Open Regex Safety Audit in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.tylerscomic-lab%2Fregex-safety-audit-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "regex-safety-audit": {
      "type": "http",
      "url": "https://regex-safety-audit-mcp.mcpize.run/mcp"
    }
  }
}

README

regex-safety-audit-mcp

[License: MIT] [Live on MCPize]

An MCP server that parses a regex into a real hand-written AST to detect catastrophic-backtracking (ReDoS) risk — without ever executing the pattern itself. A ReDoS scanner that runs the regex it's scanning would be able to hang itself; this one never calls new RegExp(...).test() on anything.

What it catches

Nested unbounded quantifiers ((a+)+), ambiguous alternation inside a repeated group ((a|ab)+), and backreferences — the three shapes behind almost every real-world ReDoS incident. Detection is structural (a real parser, not regex-on-regex string heuristics), verified against the canonical literature examples during testing.

The JS-specific trap

Generic ReDoS advice tells you to wrap the offending group in an atomic group or use a possessive quantifier. JavaScript has neither. analyze_redos_risk says so explicitly, and suggest_safe_rewrite gives the actual JS-safe fix (collapsing redundant nesting, or restructuring with a negated character class) instead of advice that would 400 as a syntax error if you tried it.

Tools

analyze_redos_risk

Full structural analysis. Returns a risk level, every finding with its exact reason, and the JS atomic-group/ possessive-quantifier caveat.

generate_attack_string

For a flagged pattern, generates candidate proof-of-concept inputs at a few sizes, plus a ready-to-run Node snippet that times the match with a hard OS-level subprocess timeout — so testing a genuinely catastrophic regex can't hang your own test process either.

suggest_safe_rewrite

Concrete rewritten pattern for the mechanically-fixable shapes; honest "no mechanical fix, here's what to change by hand" for the ones that aren't.

Use it

Hosted (recommended): MCPize — free tier, $7/mo Pro.

Self-host:

bash
npm installnode server.js

Part of a small suite

mcp-schema-audit-mcp, cron-schedule-audit-mcp, claude-cost-audit-mcp.

License

MIT

Source: README.md at commit 12fa26e

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Audit integrations

audit.domains - Domain Valuation

domains.auditOfficial publisher

Deterministic domain-name valuation: fair-value intervals, comparable recorded sales, availability checks, and a verified for-sale listing market.

Streamable HTTPWeb executable
Business & Commerce27 toolsNov 1, 2026

Revenue Agent — OpenAPI Audit & Change Detection

news.prhOfficial publisher

A remote MCP endpoint that audits OpenAPI specifications and detects API changes, charging $0.10 USDC per analysis via x402 on Base.

Streamable HTTPWeb executable
Developer Tools2 toolsOct 24, 2026

SEO Audit & Broken Link Checker

Published by GitHub account prometheus-maker

An Apify-hosted MCP server that audits a website's pages for SEO metadata and finds broken links and images, returning per-page scores.

Streamable HTTPWeb executableAuth
Data & AnalyticsCredential requiredNov 7, 2026

FinePrint AI Legal Risk & Contract Audit MCP Server

Published by GitHub account RitualDev-Lab

Local in-memory scanner that grades legal contracts, NDAs and leases for risk and drafts redline amendments for coding agents.

STDIODesktop only
AI & MLNot validated yetNov 7, 2026

Mcp Supply Audit

Published by GitHub account kimmawla

Audits MCP servers as supply-chain artifacts — registry entries, PyPI/npm packages, client configs and tool definitions — using read-only static checks.

STDIODesktop only
Developer ToolsNot validated · the package did not installNov 5, 2026