Skip to content

Standalone URLs outside the embed allowlist end up as plain unlinked text #262

Description

@katanumahotori

Summary

A URL placed alone on a line is converted to an embed only when it matches one of the specific patterns in EMBED_PATTERNS (YouTube / Twitter / note / Gist / GitHub / Zenn / Qiita / connpass / ...). Any other URL — e.g. a personal site, a blog, an Amazon product page — stays as plain text inside a <p>: not an embed, not even an <a> link. Readers cannot click it.

note.com's own editor turns any pasted standalone URL into a link card, so users writing Markdown with this MCP get a notably worse result than pasting into the editor.

Reproduction

https://example.com/some-article

→ published article shows the raw URL as unclickable text.

Confirmed on a real note.com article (2026-06-10).

Suggestion

get_embed_service() can fall back to external-article for any other http(s) URL — the same service type already used for Zenn / Qiita / connpass via /v2/embed_by_external_api. I tested this against the real API: note.com happily registers arbitrary external URLs (including Amazon product URLs with query strings) and renders proper link cards.

Two related hardening points included in the incoming PR:

  1. resolve_embed_keys(): when key registration fails, the figure currently keeps its unregistered placeholder key, which note.com's frontend renders as nothing (the URL silently disappears). Degrading the figure to a visible <a> link paragraph is safer.
  2. _convert_standalone_embed_urls(): the captured URL is HTML-escaped (&amp;), which breaks query-string URLs (e.g. Amazon affiliate links) via double-escaping. Unescape before matching/generation.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions