Regex Safety Audit MCP server
not respondingDetects catastrophic-backtracking (ReDoS) regex risk via AST parsing, with JS-safe rewrites.
0 stars
Reviews
Write oneNobody has reviewed Regex Safety Audit yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Regex Safety Audit tools
Tool list not cached yet. `describe` through the gateway fetches it live.
Public scan report
scanner v0.1.10 · 2026-10-28 · same rubric, same numbers if you re-run it
- –Code scanremote-only server, no package to scann/a
- Live reliabilityremote unreachable: HTTP 5000/20
- –Tool poisoningtools not inspected (endpoint requires auth); not countedn/a
- Auth qualityno auth information5/15
- Maintenancelast push 95 days ago8/15
- Maintainer identityregistry namespace matches repository owner6/10
Findings (1)
- highRemote endpoint did not respond
reliability.unreachableHTTP 500
How Regex Safety Audit compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 32/100
- higher than 6% of 48,255 servers
- Uptime
- 21%
- of our recent checks; the typical remote server answers 100%
- Response time
- 1,491 ms
- faster than 5% of 30,031 servers
Install Regex Safety Audit in Claude Code, Cursor or VS Code
claude mcp add --transport http regex-safety-audit-mcp https://regex-safety-audit-mcp.mcpize.run/mcp
What the publisher says
From the Regex Safety Audit repository's README, as published. We do not edit it. Read it on GitHub
regex-safety-audit-mcp
An MCP server that parses a regex into a real hand-written AST to detect catastrophic-backtracking (ReDoS) risk — without ever executing the pattern itself. A ReDoS scanner that runs the regex it's scanning would be able to hang itself; this one never calls new RegExp(...).test() on anything.
What it catches
Nested unbounded quantifiers ((a+)+), ambiguous alternation inside a repeated group ((a|ab)+), and backreferences — the three shapes behind almost every real-world ReDoS incident. Detection is structural (a real parser, not regex-on-regex string heuristics), verified against the canonical literature examples during testing.
The JS-specific trap
Generic ReDoS advice tells you to wrap the offending group in an atomic group or use a possessive quantifier. JavaScript has neither. analyzeredosrisk says so explicitly, and suggestsaferewrite gives the actual JS-safe fix (collapsing redundant nesting, or restructuring with a negated character class) instead of advice that would 400 as a syntax error if you tried it.
Tools
analyzeredosrisk
Full structural analysis. Returns a risk level, every finding with its exact reason, and the JS atomic-group/ possessive-quantifier caveat.
generateattackstring
For a flagged pattern, generates candidate proof-of-concept inputs at a few sizes, plus a ready-to-run Node snippet that times the match with a hard OS-level subprocess timeout — so testing a genuinely catastrophic regex can't hang your own test process either.
suggestsaferewrite
Concrete rewritten pattern for the mechanically-fixable shapes; honest "no mechanical fix, here's what to change by hand" for the ones that aren't.
Use it
Hosted (recommended): MCPize — free tier, $7/mo Pro.
Self-host:
npm install
node server.jsPart of a small suite
mcp-schema-audit-mcp, cron-schedule-audit-mcp, claude-cost-audit-mcp.
License
MIT
Nothing above is checked by us. What we check is on the safety report.
Grade history
- 2026-10-28revokeA → Fscore 32: Remote endpoint did not respond
Regex Safety Audit: common questions
- Is Regex Safety Audit MCP server safe?
- No: it is graded F and blocked at the gateway (32/100). Read the Regex Safety Audit safety report
- How do I install Regex Safety Audit?
- It runs remotely at regex-safety-audit-mcp.mcpize.run. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
- Does Regex Safety Audit need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is Regex Safety Audit maintained?
- The last commit was 102 days ago (2026-07-25). The latest release is v1.0.0.
- Is Regex Safety Audit up?
- 21% of our last 28 checks got an answer. We check remote servers about four times a day.
- How does Regex Safety Audit compare with other MCP servers?
- safety score 32/100 (higher than 6% of 48,255 servers); uptime 21% (of our recent checks; the typical remote server answers 100%); response time 1,491 ms (faster than 5% of 30,031 servers). Full comparison.