kex

The application serves markdown content over an MCP (Model Context Protocol) server. While the Go code itself does not directly perform dangerous operations like 'eval' on arbitrary user input, it fetches and serves markdown documents from local files and potentially remote URLs. If a remote source (e.g., a GitHub Pages site) were compromised or untrusted, it could serve malicious markdown. The responsibility of sanitizing and safely rendering this markdown content falls on the connected AI client/editor, not Kex itself. There are no hardcoded secrets visible in the provided truncated source code, and `os/exec` is only observed in e2e tests, not core server runtime. The `KEX_REMOTE_TOKEN` environment variable or `.kex.yaml` configuration is used for authenticated remote fetches.