@utilix-tech/mcp 0.19.0 → 0.20.0

package/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 Full release notes for all Utilix surfaces (browser tools, REST API, SDKs, MCP server) live at [utilix.tech/changelog](https://utilix.tech/changelog). This file tracks just this package.
 
+## 0.20.0
+- Add `detect_redos` tool: statically analyze a regex for ReDoS (catastrophic-backtracking) risk.
+
 ## 0.19.0
 - Added `calculate_time_value` (present/future value) and `vector_similarity` tools.
 

package/README.md

@@ -1,6 +1,6 @@
 # @utilix-tech/mcp
 
-MCP server exposing 127 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
+MCP server exposing 128 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
 
 No API key required. All tools run locally. Requires Node.js 18 or later.
 
@@ -186,7 +186,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `color_palette` | Generate a color palette from a base color |
 | `color_shades` | Generate shades or tints from a base color |
 
-### Code (9 tools)
+### Code (10 tools)
 | Tool | Description |
 |------|-------------|
 | `format_sql` | Format a SQL query with proper indentation |
@@ -198,6 +198,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `parse_docker_image` | Parse a Docker image reference into its components |
 | `lookup_mime` | Look up the MIME type for a file extension, or the extension(s) for a MIME type |
 | `parse_github_url` | Parse a github.com URL (repo, pull request, issue, commit, file, or release) into structured components |
+| `detect_redos` | Statically flag catastrophic-backtracking (ReDoS) risk in a regex: nested quantifiers, overlapping alternation, adjacent overlapping quantifiers |
 
 ### Data (6 tools)
 | Tool | Description |

package/dist/index.js

@@ -3461,5 +3461,258 @@ server.tool(
     return text(JSON.stringify(result, null, 2));
   }
 );
+var _REDOS_UNBOUNDED_MCP = /* @__PURE__ */ new Set(["*", "+"]);
+var _REDOS_ALPHABET_MCP = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_ 	.,-@/:;#%&=";
+function _redosParseQuantMcp(src, i) {
+  const ch = src[i];
+  if (ch === "*" || ch === "+" || ch === "?") {
+    let end = i + 1;
+    if (src[end] === "?" || src[end] === "+") end++;
+    return { unbounded: _REDOS_UNBOUNDED_MCP.has(ch), raw: src.slice(i, end), end };
+  }
+  if (ch === "{") {
+    const close = src.indexOf("}", i);
+    if (close === -1) return null;
+    const inner = src.slice(i + 1, close);
+    if (!/^\d+(,\d*)?$/.test(inner)) return null;
+    let end = close + 1;
+    if (src[end] === "?" || src[end] === "+") end++;
+    return { unbounded: /^\d+,$/.test(inner), raw: src.slice(i, end), end };
+  }
+  return null;
+}
+function _redosParseAlternationMcp(src, start, endExclusive) {
+  const alternatives = [];
+  let current = [];
+  let i = start;
+  while (i < endExclusive) {
+    const ch = src[i];
+    if (ch === "|") {
+      alternatives.push(current);
+      current = [];
+      i++;
+      continue;
+    }
+    let node;
+    if (ch === "\\") {
+      const atomEnd = i + 2 <= endExclusive ? i + 2 : i + 1;
+      node = { kind: "char", start: i, end: atomEnd, quant: null, quantEnd: atomEnd, raw: src.slice(i, atomEnd) };
+      i = atomEnd;
+    } else if (ch === "[") {
+      let j = i + 1;
+      if (src[j] === "^") j++;
+      if (src[j] === "]") j++;
+      while (j < endExclusive && src[j] !== "]") {
+        j += src[j] === "\\" ? 2 : 1;
+      }
+      const classEnd = j < endExclusive ? j + 1 : endExclusive;
+      node = { kind: "class", start: i, end: classEnd, quant: null, quantEnd: classEnd, raw: src.slice(i, classEnd) };
+      i = classEnd;
+    } else if (ch === "(") {
+      let depth = 1;
+      let j = i + 1;
+      while (j < endExclusive && depth > 0) {
+        const cj = src[j];
+        if (cj === "\\") {
+          j += 2;
+          continue;
+        }
+        if (cj === "[") {
+          j++;
+          if (src[j] === "^") j++;
+          if (src[j] === "]") j++;
+          while (j < endExclusive && src[j] !== "]") {
+            j += src[j] === "\\" ? 2 : 1;
+          }
+          j++;
+          continue;
+        }
+        if (cj === "(") depth++;
+        else if (cj === ")") depth--;
+        j++;
+      }
+      const closeIdx = depth === 0 ? j - 1 : endExclusive;
+      let contentStart = i + 1;
+      let lookaround = false;
+      if (src[i + 1] === "?") {
+        const after = src[i + 2];
+        if (after === ":") contentStart = i + 3;
+        else if (after === "=" || after === "!") {
+          contentStart = i + 3;
+          lookaround = true;
+        } else if (after === "<") {
+          const a3 = src[i + 3];
+          if (a3 === "=" || a3 === "!") {
+            contentStart = i + 4;
+            lookaround = true;
+          } else {
+            const gt = src.indexOf(">", i + 2);
+            contentStart = gt !== -1 && gt < closeIdx ? gt + 1 : i + 3;
+          }
+        }
+      }
+      node = {
+        kind: "group",
+        start: i,
+        end: closeIdx + 1,
+        quant: null,
+        quantEnd: closeIdx + 1,
+        raw: src.slice(i, closeIdx + 1),
+        alternatives: _redosParseAlternationMcp(src, contentStart, closeIdx),
+        lookaround
+      };
+      i = closeIdx + 1;
+    } else if (ch === ".") {
+      node = { kind: "dot", start: i, end: i + 1, quant: null, quantEnd: i + 1, raw: "." };
+      i++;
+    } else if (ch === "^" || ch === "$") {
+      node = { kind: "anchor", start: i, end: i + 1, quant: null, quantEnd: i + 1, raw: ch };
+      i++;
+    } else {
+      node = { kind: "char", start: i, end: i + 1, quant: null, quantEnd: i + 1, raw: ch };
+      i++;
+    }
+    if (node.kind !== "anchor") {
+      const q = _redosParseQuantMcp(src, i);
+      if (q) {
+        node.quant = q;
+        node.quantEnd = q.end;
+        i = q.end;
+      }
+    }
+    current.push(node);
+  }
+  alternatives.push(current);
+  return alternatives;
+}
+function _redosFirstMatcherMcp(node) {
+  if (node.kind === "dot") return (c) => c !== "\n";
+  if (node.kind === "char") {
+    if (node.raw.startsWith("\\")) {
+      const body = node.raw.slice(1);
+      if (/^[dDwWsS]$/.test(body)) {
+        try {
+          const re = new RegExp("\\" + body);
+          return (c) => re.test(c);
+        } catch {
+          return null;
+        }
+      }
+      const literal = { n: "\n", t: "	", r: "\r", f: "\f", v: "\v" }[body] ?? body;
+      return (c) => c === literal;
+    }
+    const lit = node.raw;
+    return (c) => c === lit;
+  }
+  if (node.kind === "class") {
+    try {
+      const re = new RegExp(node.raw);
+      return (c) => re.test(c);
+    } catch {
+      return null;
+    }
+  }
+  if (node.kind === "group") {
+    const first = node.alternatives?.[0]?.[0];
+    return first ? _redosFirstMatcherMcp(first) : null;
+  }
+  return null;
+}
+function _redosOverlapsMcp(a, b) {
+  const fa = _redosFirstMatcherMcp(a);
+  const fb = _redosFirstMatcherMcp(b);
+  if (!fa || !fb) return false;
+  for (const c of _REDOS_ALPHABET_MCP) if (fa(c) && fb(c)) return true;
+  return false;
+}
+function _redosAnalyzeGroupMcp(node, findings) {
+  const alts = node.alternatives ?? [];
+  const outerUnbounded = node.quant?.unbounded === true && !node.lookaround;
+  if (outerUnbounded) {
+    for (const alt of alts) {
+      const meaningful = alt.filter((n) => n.kind !== "anchor");
+      if (meaningful.length === 1 && meaningful[0].quant?.unbounded) {
+        findings.push({
+          type: "nested-quantifier",
+          severity: "high",
+          message: "Nested unbounded quantifiers: a repeated group whose body is itself unbounded-repeated can match the same input in exponentially many ways, causing catastrophic backtracking.",
+          snippet: node.raw + (node.quant?.raw ?? ""),
+          index: node.start
+        });
+        break;
+      }
+    }
+    if (alts.length > 1) {
+      const firsts = alts.map((alt) => alt.find((n) => n.kind !== "anchor")).filter((n) => !!n);
+      let flagged = false;
+      for (let x = 0; x < firsts.length && !flagged; x++) {
+        for (let y = x + 1; y < firsts.length; y++) {
+          if (_redosOverlapsMcp(firsts[x], firsts[y])) {
+            findings.push({
+              type: "overlapping-alternation",
+              severity: "medium",
+              message: "Overlapping alternation under a repetition: two branches can match the same starting input, so the engine has multiple ways to split each repeat and may backtrack heavily.",
+              snippet: node.raw + (node.quant?.raw ?? ""),
+              index: node.start
+            });
+            flagged = true;
+            break;
+          }
+        }
+      }
+    }
+  }
+  for (const alt of alts) _redosAnalyzeSequenceMcp(alt, findings);
+}
+function _redosAnalyzeSequenceMcp(seq, findings) {
+  for (let k = 0; k + 1 < seq.length; k++) {
+    const a = seq[k];
+    const b = seq[k + 1];
+    if (a.quant?.unbounded && b.quant?.unbounded && _redosOverlapsMcp(a, b)) {
+      findings.push({
+        type: "adjacent-quantifier",
+        severity: "medium",
+        message: "Adjacent unbounded quantifiers over overlapping characters: the engine can distribute the same input between them in many ways, causing quadratic backtracking.",
+        snippet: seq[k].raw + (a.quant?.raw ?? "") + seq[k + 1].raw + (b.quant?.raw ?? ""),
+        index: a.start
+      });
+    }
+  }
+  for (const node of seq) if (node.kind === "group") _redosAnalyzeGroupMcp(node, findings);
+}
+function _detectRedosMcp(pattern) {
+  if (typeof pattern !== "string" || pattern === "") return { error: "Empty pattern" };
+  if (pattern.length > 5e3) return { error: "Pattern too long (max 5,000 chars)" };
+  let valid = true;
+  let compileError;
+  try {
+    new RegExp(pattern);
+  } catch (e) {
+    valid = false;
+    compileError = e instanceof Error ? e.message : String(e);
+  }
+  const findings = [];
+  for (const alt of _redosParseAlternationMcp(pattern, 0, pattern.length)) _redosAnalyzeSequenceMcp(alt, findings);
+  const seen = /* @__PURE__ */ new Set();
+  const unique = findings.filter((f) => {
+    const key = `${f.type}:${f.index}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+  unique.sort((a, b) => a.index - b.index);
+  const risk = unique.some((f) => f.severity === "high") ? "high" : unique.length > 0 ? "medium" : "none";
+  return { pattern, valid, ...compileError ? { compileError } : {}, risk, safe: unique.length === 0, findings: unique };
+}
+server.tool(
+  "detect_redos",
+  "Statically analyze a regex pattern for catastrophic-backtracking (ReDoS) risk. Flags nested unbounded quantifiers ((a+)+), overlapping alternation under a repeat ((a|ab)*), and adjacent overlapping quantifiers (\\d+\\d+). Heuristic linter, not a formal proof. Pass the pattern body only, no delimiters or flags.",
+  { pattern: z.string().describe("The regex pattern body to analyze, e.g. (a+)+") },
+  async ({ pattern }) => {
+    const result = _detectRedosMcp(pattern);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
 var transport = new StdioServerTransport();
 await server.connect(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@utilix-tech/mcp",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "MCP server exposing 125 Utilix developer tools to Claude, Cursor, VS Code Copilot, and any MCP-compatible AI assistant.",
   "author": "Utilix <hello@utilix.tech>",
   "license": "MIT",