Regex catastrophic-backtracking check, then test cases only if proven safe

$0.005 USDC per call · Developer and security · POST /api/v1/regex-check · Id regex-check

Statically analyses an ECMAScript regular expression (up to 500 characters) for catastrophic backtracking (nested or overlapping quantifiers, ambiguous alternation in a loop, backreferences, lookarounds) for agents that write or accept regexes. Runs the caller's test subjects (up to 20, 1000 characters each) only when the pattern is proven polynomially bounded and the subject is short enough for that bound; otherwise reports the risk and runs nothing. A fail names a pattern with a provable exponential split; unknown means not proven safe, not proven unsafe. Does not translate other regex flavors.

What you get

A single ReDoS pattern pinned a Worker or Node loop in many public incidents; this checks before the regex ships.

Call it

Send the JSON body below to https://agents.writerslogic.com/api/v1/regex-check. An unpaid request answers 402 with the price and how to pay; a request that fails with a 5xx status is not charged.

curl -i -X POST https://agents.writerslogic.com/api/v1/regex-check \
  -H 'content-type: application/json' \
  -d '{"pattern":"^(\\w+\\s?)*$","cases":[{"subject":"hello world","expectMatch":true}]}'

Input

Field	Type	Required	Description
`pattern`	string; length 0..500	yes	ECMAScript regex source, without slashes.
`flags`	string; length 0..8	no	Flags among dgimsuy (v is reported unsupported).
`cases`	array<object>; max 20 items	no	Subjects to test; at most 10000 characters in total.

Example request body

{
  "pattern": "^(\\w+\\s?)*$",
  "cases": [
    {
      "subject": "hello world",
      "expectMatch": true
    }
  ]
}

Result

The response is { "data": ..., "_provenance": ... }. data carries these fields; _provenance is a signed W3C Verifiable Credential with a C2PA-style manifest, checked free at POST /api/v1/verify-provenance.

Field	Type	Required	Description
`status`	string; one of "pass", "fail", "unknown", "unsupported"	no	pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass.
`pattern`	string	no
`flags`	string	no
`valid`	boolean	no
`executed`	boolean	no
`degree`	integer	no	Worst-case step growth exponent in subject length (1 + number of unbounded quantifiers on an unanchored search).
`subjectCap`	integer	no	Longest subject this pattern may run on within the step budget; 0 when execution is refused.
`risks`	array<object>	no
`cases`	array<object>	no
`witnesses`	array<object>	no
`versions`	object	no	Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile).
`limits`	array<string>	no
`deterministic`	boolean	no	Always true: pure code, no model.

Pay and connect

Available through: x402 (USDC on Base), MCP. MCP clients reach it through the code-preflight-kit package.

Machine-readable

This agent as JSON (schemas, example, OpenAPI operation)
Free signed sample response
OpenAPI 3.1 · Catalog · Index of every agent