Skip to content

TKMD/ReftrixMCP

v0.1.3 Security

This release includes 4 security fixes for security teams reviewing exposed deployments.

Published 2mo MCP Developer Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 4 known CVEs

Topics

accessibility claude core-web-vitals design-analysis gdpr layout-analysis
+14 more
mcp mcp-server motion-detection ollama onnx-runtime pgvector playwright reftrix responsive-design semantic-search typescript vector-db wcag web-design

Affected surfaces

auth deps

Summary

AI summary

Added user preference profiling (GDPR‑compliant) with search reranking, an embedding idle timer for GPU VRAM auto‑release, and GPU mismatch detection.

Full changelog

ReftrixMCP v0.1.3 — 嗜好プロファイリング & Embedding Idle Timer / Preference Profiling & Embedding Idle Timer

ユーザー嗜好プロファイリング(3 MCPツール + GDPR対応)と検索リランキング、EmbeddingアイドルタイマーによるGPU VRAM自動解放、GPU不整合検出を追加。

Added user preference profiling (3 MCP tools + GDPR compliance) with search reranking, Embedding idle timer for GPU VRAM auto-release, and GPU mismatch detection.

新機能 / New Features

Preference Profiling(嗜好プロファイリング)

  • preference.hear: Stateless hearing session — Mode A: sample presentation with progress tracking, Mode B: feedback recording / ステートレスヒアリング(Mode A: サンプル提示、Mode B: フィードバック記録)
  • preference.get: Profile retrieval with GDPR data portability (Art. 20) / プロファイル取得(GDPRデータポータビリティ対応)
  • preference.reset: Soft reset / hard delete (GDPR Art. 17 Right to Erasure) / ソフトリセット+完全削除(忘れられる権利)
  • 2-factor confidence model (MoodCategory coverage 0.6 + interaction sufficiency 0.4, threshold 0.8, max 15 hearings) / 2因子信頼度モデル
  • GDPR Art. 13/14 compliant profiling notice on new profile creation / 新規プロファイル作成時にGDPR準拠通知
  • Preference-aware search reranking across all 5 search tools (layout, motion, background, narrative, responsive) via applyPreferenceReranking() shared helper / 全5検索ツールに嗜好リランキング統合

Embedding Idle Timer(GPU VRAM自動解放)

  • Auto-release CUDA VRAM from EmbeddingService Worker Thread after 30s idle / 30秒アイドル後にVRAM自動解放
  • Enables GPU acceleration for subsequent Ollama Vision analysis / 後続のOllama Vision解析がGPUで実行可能に
  • Configurable via EMBEDDING_IDLE_TIMEOUT_MS env var (0 to disable) / 環境変数で設定可能

GPU Mismatch Detection(GPU不整合検出)

  • system.health cross-checks nvidia-smi GPU detection vs Ollama VRAM allocation / nvidia-smi検出とOllama VRAM割当のクロスチェック
  • Actionable warning with fix steps; downgrades status to degraded / 修正手順付きの警告を表示

修正 / Fixes

  • RRF hybrid search missing id for preference reranking / RRFハイブリッド検索のid欠落修正
  • Responsive search reranking ID mismatch / レスポンシブ検索リランキングID不一致修正
  • DI factory registration for PrismaClient and EmbeddingService at startup / DIファクトリ登録欠落修正
  • GPU VRAM contention — ONNX Embedding held ~1,406MiB blocking Ollama Vision / GPU VRAM競合修正

セキュリティ / Security

  • express-rate-limit CVE-2026-30827 fixed (pnpm override >=8.2.2) / CVE修正
  • truncateId() PII-safe logging (21 locations) / PII安全ログ出力
  • parseVectorString() NaN/Infinity defense / NaN/Infinity防御
  • sanitizeErrorMessage() preventing DB structure leakage / DB構造漏洩防止

ドキュメント / Documentation

  • PRIVACY.md / DATA_RETENTION.md — profiling privacy policy / プロファイリングプライバシーポリシー
  • Users guide Chapter 14: Preference tools / ユーザーガイド第14章
  • Legal docs updated (Privacy Policy v0.1.1, Terms of Service) / 法務ドキュメント更新

テスト / Tests

  • 138 new tests (29 service + 13 security + 96 tool/schema) / テスト138件追加
  • SEC/TDA/LCC 3-agent audit: 12 audits across 4 phases, all PASS / 3エージェント監査全12回合格

Database

  • New tables: preference_profiles, preference_signals with HNSW index / 新テーブル2つ + HNSWインデックス
  • MCP tool count: 20 → 23 / MCPツール数: 20 → 23

Security Fixes

  • CVE-2026-30827 — fixed `express-rate-limit` vulnerability by overriding to >=8.2.2
  • PII‑safe logging via `truncateId()` across 21 locations
  • `parseVectorString()` now defends against NaN/Infinity inputs
  • `sanitizeErrorMessage()` prevents database structure leakage

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track TKMD/ReftrixMCP

Get notified when new releases ship.

Sign up free

About TKMD/ReftrixMCP

Web design analysis MCP server with 26 tools for layout extraction, motion detection, quality scoring, and semantic search. Uses Playwright, pgvector HNSW, and Ollama Vision to turn web pages into searchable, structured design knowledge.

All releases →

Beta — feedback welcome: [email protected]