# ECMAScript Regex Backtracking Risk Scanner

> ECMAScript Regex Backtracking Risk Scanner is a paid API for AI agents from rooke-token-risk-pilot.rookepoole.workers.dev, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-16).

Analyzes a regular expression pattern for catastrophic backtracking (ReDoS) risk using static heuristics and returns a risk verdict, score, and flagged complexity concerns.

## Facts

- Endpoint: POST https://rooke-token-risk-pilot.rookepoole.workers.dev/v1/x402/regex-backtracking-risk
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-16
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ecmascript-regex-backtracking-risk-scanner-9716f69b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_eXike1z9atvHH9PWnwHSL

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ecmascript-regex-backtracking-risk-scanner-9716f69b -d '<json body>'
```

Example prompt: Can you check this regex for catastrophic backtracking risk: `^(a+)+$` with no flags, assuming inputs up to 100,000 characters? I need to know if it's safe to use on untrusted user input.

## When to prefer this

Choose this endpoint when you need a fast, stateless, per-pattern ReDoS risk signal without setting up your own static analysis toolchain. It is especially useful in CI/CD pipelines, agent workflows that accept user-submitted patterns, or pre-deployment audits. It is not a substitute for runtime fuzzing or formal complexity proofs, as the claim boundary explicitly flags its heuristic limitations.

## Known failure modes

- Pattern exceeds 4096-character limit — returns validation error
- Invalid flags outside [dgimsuvy] — schema rejects request
- minLength violation if pattern is empty string — returns 400
- Static heuristics may produce false positives or miss complex runtime behavior (noted in evidenceGaps)
- No runtime benchmark performed — deterministic field is true but runtimeBenchmarked is false

## How this service works

Public static preview plus paid token controls, risk consensus, AI security, webhook reliability, developer security, schedule risk, decision analysis, API release compatibility, accounts-payable reconciliation, e-commerce return eligibility, SaaS subscription-proration, sales-commission reconciliation, parcel-charge reconciliation, SLA service-credit reconciliation, advertising spend-and-fee audit, contract-renewal audit, workforce timecard reconciliation, hotel booking-commission reconciliation, and warehouse cycle-count adjustment reconciliation products for autonomous agents.

## Output

Returns a JSON object with: a verdict string (e.g. HIGH_BACKTRACKING_RISK), a numeric risk score, an array of risk flags (e.g. QUANTIFIED_OVERLAPPING_ALTERNATION), a complexity concern label (e.g. POTENTIALLY_EXPONENTIAL), evidence gaps noting limitations of static analysis, a claim boundary object clarifying what was and wasn't tested, a report hash for auditability, and the schema version identifier.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "flags": {
   "type": "string",
   "default": "",
   "pattern": "^[dgimsuvy]*$",
   "maxLength": 8
  },
  "pattern": {
   "type": "string",
   "maxLength": 4096,
   "minLength": 1
  },
  "expectedMaximumInputCharacters": {
   "type": "integer",
   "default": 10000,
   "maximum": 10000000,
   "minimum": 1
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "verdict": "HIGH_BACKTRACKING_RISK",
  "findings": [],
  "riskFlags": [
   "QUANTIFIED_OVERLAPPING_ALTERNATION"
  ],
  "riskScore": 50,
  "reportHash": "sha256-hex",
  "evidenceGaps": [
   "STATIC_HEURISTICS_ARE_NOT_A_COMPLETE_COMPLEXITY_PROOF"
  ],
  "claimBoundary": {
   "deterministic": true,
   "runtimeBenchmarked": false,
   "attackerInputGenerated": false,
   "definitiveSafetyVerdict": false,
   "submittedPatternExecuted": false
  },
  "schemaVersion": "ECMASCRIPT_REGEX_BACKTRACKING_RISK_SCAN_V1",
  "complexityConcern": "POTENTIALLY_EXPONENTIAL"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ecmascript-regex-backtracking-risk-scanner-9716f69b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from rooke-token-risk-pilot.rookepoole.workers.dev](https://www.zero.xyz/host/rooke-token-risk-pilot.rookepoole.workers.dev/llms.txt)