tomcp

The server processes arbitrary URLs, fetching and converting their HTML to Markdown. While the HTML parsing is basic (regex-based, which can be brittle but is generally less prone to complex DOM-based vulnerabilities), it relies on fetching untrusted external content. User-provided Cloudflare API keys for paid models are sent in the request body to the worker, requiring users to trust the `tomcp` service not to log or misuse their keys, even if they are not persistently stored on the server. There are no obvious hardcoded sensitive secrets (Cloudflare account IDs configured in `wrangler.toml` are for the service owner's free tier, not secret data) or 'eval' usage. The Cloudflare Workers platform provides some inherent security benefits.