ProvenPin Install

marked Markdown to sanitized HTML: working versions (tested 2026-10-15)

Render Markdown with marked then strip unsafe tags and attributes with sanitize-html, covering links, code blocks and XSS payloads offline.

passed3 passed · 0 failed2026-10-15 16:02 UTC
Status
passed
Last passed
2026-10-15 16:02 UTC
Tests
3 / 3
Language
TypeScript
Runtime
node v22.23.3
pinned versions5
marked@18.1.1sanitize-html@2.18.1@types/node@26.6.5tsx@4.23.15@types/sanitize-html@2.16.2
run it
npm install --no-audit --no-fund --ignore-scripts=false
npm test
test environment
node v22.23.3
linux 6.17.0-1022-azure
x64
runner: github-actions 38764699834

The code

Exactly the files that passed. Your agent can pull them with get_recipe("marked-sanitize-html") (install), or see them on GitHub.

package.json
{
  "name": "marked-sanitize-html",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node --import tsx --test test/*.test.ts"
  },
  "dependencies": {"marked":"18.1.1","sanitize-html":"2.18.1"},
  "devDependencies": {"@types/node":"26.6.5","tsx":"4.23.15","@types/sanitize-html":"2.16.2"}
}
src/markdown.ts
import { marked } from "marked";
import sanitizeHtml from "sanitize-html";

const ALLOWED = {
  allowedTags: sanitizeHtml.defaults.allowedTags.concat(["img", "h1", "h2"]),
  allowedAttributes: {
    ...sanitizeHtml.defaults.allowedAttributes,
    img: ["src", "alt"],
    a: ["href", "name", "target", "rel"],
  },
  transformTags: {
    a: sanitizeHtml.simpleTransform("a", { rel: "noopener noreferrer" }),
  },
};

export async function renderSafeMarkdown(source: string) {
  const html = await marked.parse(source, { async: true, gfm: true });
  return sanitizeHtml(html, ALLOWED);
}
test/markdown.test.ts
import { test } from "node:test";
import assert from "node:assert/strict";
import { renderSafeMarkdown } from "../src/markdown.ts";

test("renders headings and links", async () => {
  const html = await renderSafeMarkdown("# Hello\n\nSee [docs](https://example.com).");
  assert.match(html, /<h1[^>]*>Hello<\/h1>/);
  assert.match(html, /href="https:\/\/example.com"/);
  assert.match(html, /rel="noopener noreferrer"/);
});

test("strips script tags", async () => {
  const html = await renderSafeMarkdown('Hi <script>alert(1)</script> **there**');
  assert.doesNotMatch(html, /<script/i);
  assert.match(html, /<strong>there<\/strong>/);
});

test("keeps code fences", async () => {
  const html = await renderSafeMarkdown("```js\nconst x = 1;\n```");
  assert.match(html, /<code/);
  assert.match(html, /const x = 1/);
});

Connect to ProvenPin

Add the free MCP server so your agent can pull this recipe and others like it. Same setup as the docs.

terminal
claude mcp add --transport http provenpin https://mcp.provenpin.com/mcp

Any other MCP client: Streamable HTTP at https://mcp.provenpin.com/mcp. No API key, no signup.