Inlay, Markdown that runs

The difference

Most Markdown apps strip this. Inlay runs it.

A <script> that draws a chart, an inline SVG diagram, a<style> block or a slider widget runs as it would on a web page, in an isolated view that cannot reach your Mac or the network.

# Quarterly report

Revenue grew in every region.

<canvas id="revenue"></canvas>
<script src="https://cdn.jsdelivr.net/npm/chart.js@4"></script>
<script>
  new Chart(document.getElementById('revenue'), {
    type: 'bar',
    data: { labels: ['EU', 'US', 'APAC'],
            datasets: [{ label: 'Q3', data: [12, 19, 7] }] },
  });
</script>

Quarterly reportrendered offline

Revenue grew in every region.

01020EUUSAPAC

This chart is drawn by Chart.js from the script on the left. In Inlay the CDN URL is swapped for the copy bundled with the app, so no network request is made.

What ships in v1

An editor that respects the page and the file.

Full rendering of embedded content

Raw HTML, inline and linked SVG, document-level styles and scripts run at page level in the Read view. No iframes, no sanitizer surprises.

Offline charts

Chart.js, ECharts, D3, Mermaid and KaTeX URLs on cdnjs, jsDelivr and unpkg are swapped for bundled copies. Your report renders on a plane.

WYSIWYG with raw islands

Write in a rich editor. Anything that cannot round-trip losslessly, such as raw HTML, front matter or comments, becomes an island with its own in-place source editor.

Source and Split modes

CodeMirror 6 for the whole file when you want it. Split shows the source beside the live Read view with scroll sync.

Quick Look for .md

Press Space in Finder. SVG always renders, scripts are opt-in, and a static fallback covers the rest. Same renderer as the app.

The file on disk is sacred

Open and save without edits: byte-identical. Edit one block: only that block's bytes change, line endings and BOM included.

Also:GFM tables, task lists and footnotesFront matterKaTeX mathMermaidLight and dark themesHTML and PDF exportVietnamese Telex, VNI and CJK input10,000-line files open instantly

Security model

Running your document's JavaScript is the point. So the view is locked down.

Each document gets its own web view with a non-persistent data store and no bridge to native code.
A Content Security Policy blocks fetch, XHR and WebSockets. A per-document “Allow network” toggle relaxes it for files you trust.
The app serves only files in the document's folder and resolves every path to block traversal.
Downloaded files open with scripts off until you choose “Trust this document”. Inlay never modifies the file to remember that.

Read the full policy, ADR-0007 →

Quick Look

Press Space. See the real document.

The Quick Look extension renders through the same parser as the app, running in JavaScriptCore with no web view. Inline SVG always renders; scripts stay off unless you opt in; everything else falls back to a clean static page.

Be first to open it.

Inlay is open source under Apache-2.0 and in early development. Watch the repository to hear about the first build, or star it to follow along.

Watch on GitHub Releases