utility to generate a table of contents from an mdast tree
Installations
npm install mdast-util-toc
Developer Guide
Typescript
Yes
Module System
ESM
Node Version
22.0.0
NPM Version
10.8.0
Score
98.2
Supply Chain
99.5
Quality
79.9
Maintenance
100
Vulnerability
100
License
Releases
Contributors
Unable to fetch Contributors
Languages
JavaScript (100%)
Love this project? Help keep it running — sponsor us today! 🚀
Developer
Download Statistics
Total Downloads
79,408,273
Last Day
42,317
Last Week
284,063
Last Month
1,102,552
Last Year
15,497,818
GitHub Statistics
MIT License
84 Stars
160 Commits
13 Forks
10 Watchers
1 Branches
16 Contributors
Updated on Jan 29, 2025
Bundle Size
14.54 kB
Minified
5.75 kB
Minified + Gzipped
Sponsor this package
Package Meta Information
Latest Version
7.1.0
Package Id
mdast-util-toc@7.1.0
Unpacked Size
31.14 kB
Size
9.01 kB
File Count
18
NPM Version
10.8.0
Node Version
22.0.0
Published on
Jun 02, 2024
Total Downloads
Cumulative downloads
Total Downloads
79,408,273
Last Day
-12.1%
42,317
Compared to previous day
Last Week
18.1%
284,063
Compared to previous week
Last Month
40.1%
1,102,552
Compared to previous month
Last Year
28.9%
15,497,818
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
mdast-util-toc
mdast utility to generate a table of contents.
Contents
- What is this?
- When should I use this?
- Install
- Use
- API
- Types
- Compatibility
- Security
- Related
- Contribute
- License
What is this?
This package is a utility that generates a table of contents from a document.
When should I use this?
This utility is useful to generate a section so users can more easily navigate through a document.
This package is wrapped in remark-toc
for ease of use with
remark, where it also injects the table of contents into the document.
Install
This package is ESM only. In Node.js (version 16+), install with npm:
1npm install mdast-util-toc
In Deno with esm.sh
:
1import {toc} from 'https://esm.sh/mdast-util-toc@7'
In browsers with esm.sh
:
1<script type="module"> 2 import {toc} from 'https://esm.sh/mdast-util-toc@7?bundle' 3</script>
Use
1import {toc} from 'mdast-util-toc' 2 3/** @type {import('mdast').Root} */ 4const tree = { 5 type: 'root', 6 children: [ 7 {type: 'heading', depth: 1, children: [{type: 'text', value: 'Alpha'}]}, 8 {type: 'heading', depth: 2, children: [{type: 'text', value: 'Bravo'}]}, 9 {type: 'heading', depth: 3, children: [{type: 'text', value: 'Charlie'}]}, 10 {type: 'heading', depth: 2, children: [{type: 'text', value: 'Delta'}]} 11 ] 12} 13 14const table = toc(tree) 15 16console.dir(table, {depth: 3})
Yields:
1{ 2 index: undefined, 3 endIndex: undefined, 4 map: { 5 type: 'list', 6 ordered: false, 7 spread: true, 8 children: [ { type: 'listItem', spread: true, children: [Array] } ] 9 } 10}
API
This package exports the identifier toc
.
There is no default export.
toc(tree[, options])
Generate a table of contents from tree
.
Looks for the first heading matching options.heading
(case insensitive) and
returns a table of contents (a list) for all following headings.
If no heading
is specified, creates a table of contents for all headings in
tree
.
tree
is not changed.
Links in the list to headings are based on GitHub’s style.
Only top-level headings (those not in blockquotes or lists), are used.
This default behavior can be changed by passing options.parents
.
Parameters
Returns
Results (Result
).
Options
Configuration (TypeScript type).
Fields
heading
(string
, optional) — heading to look for, wrapped innew RegExp('^(' + value + ')$', 'i')
maxDepth
(number
, default:6
) — maximum heading depth to include in the table of contents. This is inclusive: when set to3
, level three headings are included (those with three hashes,###
)minDepth
(number
, default:1
) — minimum heading depth to include in the table of contents. This is inclusive: when set to3
, level three headings are included (those with three hashes,###
)skip
(string
, optional) — headings to skip, wrapped innew RegExp('^(' + value + ')$', 'i')
. Any heading matching this expression will not be present in the table of contentsparents
(Test
, default:tree
) — allow headings to be children of certain node types. Can by anyunist-util-is
compatible testtight
(boolean
, default:false
) — whether to compile list items tightlyordered
(boolean
, default:false
) — whether to compile list items as an ordered list, otherwise they are unorderedprefix
(string
, optional) — add a prefix to links to headings in the table of contents. Useful for example when later going from mdast to hast and sanitizing withhast-util-sanitize
.
Result
Results (TypeScript type).
Fields
index
(number
orundefined
) — index of the node right after the table of contents heading,-1
if no heading was found,undefined
if noheading
was givenendIndex
(number
orundefined
) — index of the first node afterheading
that is not part of its section,-1
if no heading was found,undefined
if noheading
was given, same asindex
if there are no nodes betweenheading
and the first heading in the table of contentsmap
(List
orundefined
) — list representing the generated table of contents,undefined
if no table of contents could be created, either because no heading was found or because no following headings were found
Types
This package is fully typed with TypeScript.
It exports the types Options
and Result
.
Compatibility
Projects maintained by the unified collective are compatible with maintained versions of Node.js.
When we cut a new major release, we drop support for unmaintained versions of
Node.
This means we try to keep the current release line, mdast-util-toc@^7
,
compatible with Node.js 16.
Security
Use of mdast-util-toc
does not involve hast, user content, or change the
tree, so there are no openings for cross-site scripting (XSS) attacks.
Injecting map
into the syntax tree may open you up to XSS attacks as existing
nodes are copied into the table of contents.
The following example shows how an existing script is copied into the table of
contents.
For the following Markdown:
1# Alpha 2 3## Bravo<script>alert(1)</script> 4 5## Charlie
Yields in map
:
1- [Alpha](#alpha) 2 3 - [Bravo<script>alert(1)</script>](#bravoscriptalert1script) 4 - [Charlie](#charlie)
Always use hast-util-santize
when transforming to hast.
Related
github-slugger
— generate a slug just like GitHub doesunist-util-visit
— visit nodesunist-util-visit-parents
— likevisit
, but with a stack of parents
Contribute
See contributing.md
in syntax-tree/.github
for
ways to get started.
See support.md
for ways to get help.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.
License

No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
0 existing vulnerabilities detected
Reason
license file detected
Details
- Info: project has a license file: license:0
- Info: FSF or OSI recognized license: MIT License: license:0
Reason
no binaries found in the repo
Reason
security policy file detected
Details
- Info: security policy file detected: github.com/syntax-tree/.github/security.md:1
- Info: Found linked content: github.com/syntax-tree/.github/security.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/syntax-tree/.github/security.md:1
- Info: Found text in security policy: github.com/syntax-tree/.github/security.md:1
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/bb.yml:1
- Warn: no topLevel permission defined: .github/workflows/main.yml:1
- Info: no jobLevel write permissions found
Reason
Found 1/30 approved changesets -- score normalized to 0
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/bb.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/syntax-tree/mdast-util-toc/bb.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/syntax-tree/mdast-util-toc/main.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/syntax-tree/mdast-util-toc/main.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/main.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/syntax-tree/mdast-util-toc/main.yml/main?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/main.yml:15
- Info: 0 out of 2 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 2 third-party GitHubAction dependencies pinned
- Info: 0 out of 1 npmCommand dependencies pinned
Reason
branch protection not enabled on development/release branches
Details
- Warn: branch protection not enabled for branch 'main'
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 1 are checked with a SAST tool
Score
4.1
/10
Last Scanned on 2025-02-03
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More