This release includes 4 security fixes for security teams reviewing exposed deployments.
Topics
+14 more
Affected surfaces
Summary
AI summaryAdded user preference profiling (GDPR‑compliant) with search reranking, an embedding idle timer for GPU VRAM auto‑release, and GPU mismatch detection.
Full changelog
ReftrixMCP v0.1.3 — 嗜好プロファイリング & Embedding Idle Timer / Preference Profiling & Embedding Idle Timer
ユーザー嗜好プロファイリング(3 MCPツール + GDPR対応)と検索リランキング、EmbeddingアイドルタイマーによるGPU VRAM自動解放、GPU不整合検出を追加。
Added user preference profiling (3 MCP tools + GDPR compliance) with search reranking, Embedding idle timer for GPU VRAM auto-release, and GPU mismatch detection.
新機能 / New Features
Preference Profiling(嗜好プロファイリング)
preference.hear: Stateless hearing session — Mode A: sample presentation with progress tracking, Mode B: feedback recording / ステートレスヒアリング(Mode A: サンプル提示、Mode B: フィードバック記録)preference.get: Profile retrieval with GDPR data portability (Art. 20) / プロファイル取得(GDPRデータポータビリティ対応)preference.reset: Soft reset / hard delete (GDPR Art. 17 Right to Erasure) / ソフトリセット+完全削除(忘れられる権利)- 2-factor confidence model (MoodCategory coverage 0.6 + interaction sufficiency 0.4, threshold 0.8, max 15 hearings) / 2因子信頼度モデル
- GDPR Art. 13/14 compliant profiling notice on new profile creation / 新規プロファイル作成時にGDPR準拠通知
- Preference-aware search reranking across all 5 search tools (layout, motion, background, narrative, responsive) via
applyPreferenceReranking()shared helper / 全5検索ツールに嗜好リランキング統合
Embedding Idle Timer(GPU VRAM自動解放)
- Auto-release CUDA VRAM from EmbeddingService Worker Thread after 30s idle / 30秒アイドル後にVRAM自動解放
- Enables GPU acceleration for subsequent Ollama Vision analysis / 後続のOllama Vision解析がGPUで実行可能に
- Configurable via
EMBEDDING_IDLE_TIMEOUT_MSenv var (0 to disable) / 環境変数で設定可能
GPU Mismatch Detection(GPU不整合検出)
system.healthcross-checks nvidia-smi GPU detection vs Ollama VRAM allocation / nvidia-smi検出とOllama VRAM割当のクロスチェック- Actionable warning with fix steps; downgrades status to
degraded/ 修正手順付きの警告を表示
修正 / Fixes
- RRF hybrid search missing
idfor preference reranking / RRFハイブリッド検索のid欠落修正 - Responsive search reranking ID mismatch / レスポンシブ検索リランキングID不一致修正
- DI factory registration for PrismaClient and EmbeddingService at startup / DIファクトリ登録欠落修正
- GPU VRAM contention — ONNX Embedding held ~1,406MiB blocking Ollama Vision / GPU VRAM競合修正
セキュリティ / Security
express-rate-limitCVE-2026-30827 fixed (pnpm override >=8.2.2) / CVE修正truncateId()PII-safe logging (21 locations) / PII安全ログ出力parseVectorString()NaN/Infinity defense / NaN/Infinity防御sanitizeErrorMessage()preventing DB structure leakage / DB構造漏洩防止
ドキュメント / Documentation
PRIVACY.md/DATA_RETENTION.md— profiling privacy policy / プロファイリングプライバシーポリシー- Users guide Chapter 14: Preference tools / ユーザーガイド第14章
- Legal docs updated (Privacy Policy v0.1.1, Terms of Service) / 法務ドキュメント更新
テスト / Tests
- 138 new tests (29 service + 13 security + 96 tool/schema) / テスト138件追加
- SEC/TDA/LCC 3-agent audit: 12 audits across 4 phases, all PASS / 3エージェント監査全12回合格
Database
- New tables:
preference_profiles,preference_signalswith HNSW index / 新テーブル2つ + HNSWインデックス - MCP tool count: 20 → 23 / MCPツール数: 20 → 23
Security Fixes
- CVE-2026-30827 — fixed `express-rate-limit` vulnerability by overriding to >=8.2.2
- PII‑safe logging via `truncateId()` across 21 locations
- `parseVectorString()` now defends against NaN/Infinity inputs
- `sanitizeErrorMessage()` prevents database structure leakage
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About TKMD/ReftrixMCP
Web design analysis MCP server with 26 tools for layout extraction, motion detection, quality scoring, and semantic search. Uses Playwright, pgvector HNSW, and Ollama Vision to turn web pages into searchable, structured design knowledge.
Related context
Beta — feedback welcome: [email protected]