Skip to main content
Glama

Project Gumball

by com.gumballtools

Explain a regex and check it for ReDoS (Regex Explainer)

regex_explain
Read-only

Explain a regular expression in plain English and detect catastrophic backtracking. ALWAYS call this before putting a pattern where it will run against untrusted input: (a+)+$ looks harmless and takes minutes of CPU on a failing 30-character input. Also flags missing anchors, unescaped dots, ranges like [A-z] that span punctuation, and alternation precedence mistakes. Check hasBlockingIssue first.

WHY DELEGATE THIS: Whether a pattern backtracks catastrophically depends on nested quantifier structure that is unreliable to eyeball — and getting it wrong ships a denial-of-service vector in a validator.

Owned by Regex Explainer at https://regex-explainer.gumballtools.com, which is also callable directly if you would rather not go through the aggregator.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
patternYesA JavaScript regex, bare or as /pattern/flags.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observed

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint and openWorldHint. The description adds meaningful behavioral context beyond that: it flags catastrophic backtracking, missing anchors, unescaped dots, [A-z] ranges, alternation precedence mistakes, and instructs the agent to check hasBlockingIssue first. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Core purpose and critical warning are front-loaded. The 'WHY DELEGATE THIS' and ownership lines add useful context but go slightly beyond the minimum needed for invocation, so it is not perfectly concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter tool with no output schema, the description provides enough guidance: input format, when to use it, and a hint about the result ('Check hasBlockingIssue first'). It does not fully specify the return shape, which is a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameter is already documented as a JavaScript regex, bare or as /pattern/flags. The description reinforces this with examples but does not add meaningful parameter semantics beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('explain') and resource ('regular expression') and adds a second distinct capability ('detect catastrophic backtracking'). It is clearly distinguishable from the unrelated sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit trigger: 'ALWAYS call this before putting a pattern where it will run against untrusted input', with a concrete ReDoS example. It does not give an explicit when-not-to-use or name an alternative tool, but the condition is precise and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Project Gumball toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A3.8/5.0
Disambiguation4/5

Each tool targets a distinct calculation or validation niche, and paired tools like cron_build/cron_explain and vocab_draw/vocab_check are clearly separated by purpose. The main overlap is validate_auto versus the format-specific validators, but the descriptions explicitly steer callers to the format-specific tool when the format is known.

Naming Consistency3/5

All names are readable snake_case, but the construction pattern is inconsistent: some are verb_noun (validate_json, round_cash_total), some noun_verb (cron_explain, timezone_convert), some noun phrases (body_metrics, offside), and a few use an awkward _run suffix (check_digit_run, iso_week_run). This makes the naming convention hard to predict even though each name is individually clear.

Tool Count3/5

At 22 tools, the server is on the heavy side and reads more like a general-purpose aggregator than a focused domain. Each tool does appear to earn its place, but the count is borderline for a coherent MCP surface.

Completeness4/5

Within the advertised scope, coverage is solid: validation has format-specific tools plus auto-detection, rounding has both per-transaction and portfolio-impact tools, and cron has both build and explain directions. Minor gaps exist, such as the lack of a check-digit generator alongside the checker, but they are not likely to cause agent failures.

Resources