tomcp

The server fetches content from arbitrary user-provided URLs. While Cloudflare Workers offer isolation, this pattern (SSRF) inherently carries a theoretical risk if the worker's network access isn't fully sandboxed. The `htmlToMarkdown` function uses basic regex replacements, which might be fragile against highly malformed HTML but does not involve `eval` or direct parsing into a DOM, mitigating some direct code injection risks. User-provided Cloudflare API keys are handled securely by being stored locally in the browser and passed only per-request, never stored on the server.