Skip to content

TKMD/ReftrixMCP

v0.1.7 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 2mo MCP Developer Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

accessibility claude core-web-vitals design-analysis gdpr layout-analysis
+14 more
mcp mcp-server motion-detection ollama onnx-runtime pgvector playwright reftrix responsive-design semantic-search typescript vector-db wcag web-design

Affected surfaces

rce_ssrf deps

Summary

AI summary

Section Screenshot Fallback Multi‑Tile Capture adds dynamic multi‑tile image generation for oversized sections.

Full changelog

v0.1.7 — God Function Refactor, Security Hardening & Multi-Tile Capture

大規模リファクタリング、セキュリティ強化、および Section Screenshot Fallback Multi-Tile Capture を含むリリース。

A major release including large-scale refactoring, security hardening, and Section Screenshot Fallback Multi-Tile Capture.


Refactored / リファクタリング

  • God Function分割: page-analyze-worker を7フェーズモジュール(phase-0〜phase-5 + common)に分割。analyze.toolsync-processing 抽出、evaluate.toolevaluate-engine 抽出 / God Function splits: page-analyze-worker → 7 phase modules. analyze.tool → sync-processing, evaluate.tool → evaluate-engine
  • スキーマ分割: motion/schemas → 3ファイル、page/schemas → 3ファイル(re-export hub方式で後方互換性維持) / Schema splits: motion/schemas → 3 files, page/schemas → 3 files (re-export hub for backward compatibility)
  • llama-vision.adapter分割: LLMプロンプトと型定義を分離 / llama-vision.adapter split: separated LLM prompts and type definitions
  • Dead code 13件削除、narrative-search重複統合、ESLint warning 27件修正 / Removed 13 dead code items, consolidated narrative-search duplicates, fixed 27 ESLint warnings

Security / セキュリティ

  • SSRF・XSSサニタイズ・DOMPurifyバイパス修正: 複数のセキュリティ脆弱性を解消 / SSRF, XSS sanitization, and DOMPurify bypass fixes: resolved multiple security vulnerabilities
  • isDevelopment()ガード違反25箇所修正: catchブロック内でのエラーサイレント吸収を防止。全環境で logger.warn/logger.error を出力するよう統一 / Fixed 25 isDevelopment() guard violations: prevented silent error absorption in catch blocks
  • 脆弱性解消: undici 7.18.2→7.24.3 (High×6件)、flatted >=3.4.0 (High×1件) / Vulnerability fixes: undici 7.18.2→7.24.3 (6 High), flatted >=3.4.0 (1 High)

Added / 追加

  • Section Screenshot Fallback Multi-Tile Capture (v0.1.10): section.height > viewportHeight の場合、セクションを動的に複数タイルに分割してキャプチャし、Sharp composite で垂直結合して完全なセクション画像を生成 / Multi-tile capture: dynamically splits sections exceeding viewport height into tiles, captures each via Playwright, composites with Sharp
    • デフォルト上限20タイル(MAX_TILES_PER_SECTION で調整可能、絶対上限100) / Default cap 20 tiles (configurable via MAX_TILES_PER_SECTION, absolute limit 100)
    • Viewport統一: 1920x1080 / Viewport unification: 1920x1080
    • scrollY実測値による clipY計算(sticky header対策) / scrollY measurement for clipY calculation (sticky header compensation)
    • 診断ログ: per-section path追跡(in_range/fallback/dynamic/dedup/skipped) / Diagnostic logging: per-section path tracking
  • Section Merge Post-Processor (v0.1.7-v0.1.8): Phase 1内ポストプロセッサ / Post-processor within Phase 1 (Layout Analysis)
    • Rule 1: 同一タイプ3+連続セクションマージ(11 MERGEABLE_TYPES) / Rule 1: merge 3+ consecutive same-type sections
    • Rule 2: コンテンツ空unknownセクション吸収 / Rule 2: absorb content-empty unknown sections
    • Rule 3: 同名隣接マージ / Rule 3: same-heading adjacent merge
  • Section Split Post-Processor Rule 4 (v0.1.9): height > 10,000px の巨大セクション再分割(3戦略: HTML子要素→等分割→分割不可) / Rule 4: oversized section re-splitting (3 strategies)
  • Blank Image Detection + Dynamic Fallback (v0.1.9): isBlankImage() で白画像検出→動的Fallback再取得→DINOv2 visual embedding生成 / Blank image detection with dynamic fallback re-capture
  • Lazy Loading Scroll (v0.1.9): Phase 0でfullPage screenshot前にページ全体スクロールしLazy Loading発火 / Scrolls entire page before screenshot to trigger lazy loading
  • Type-aware dedupヘルパー関数抽出: shouldSkipDuplicateVision() 共通ヘルパー+テスト7件 / Extracted shouldSkipDuplicateVision() helper with 7 tests

Fixed / 修正

  • onnxruntime-node ABIミスマッチ解消: バージョン固定でNode.js ABIクラッシュを修正 / Pin onnxruntime-node to fix ABI mismatch crash
  • isBlankImage()ダークテーマ誤検出修正: stddev + mean 2条件判定に変更(ダークテーマの誤検出防止) / Fix dark theme false positive with dual-condition check
  • Dynamic Fallbackバグ修正3件: isBlank論理反転、screenshotBuffer解放、Rule 3 excludeIds適用 / 3 Dynamic Fallback fixes
  • Phase 2.5 Progress範囲逆行修正: 35-45% → 60-63% に修正 / Phase 2.5 progress range regression fix
  • resolveMemoryConfig遅延初期化: 起動時の不要なメモリ設定計算を排除 / Lazy initialization for resolveMemoryConfig
  • Pre-Return Pauseレースコンディション解消 / Fix Pre-Return Pause race condition
  • Worker path postProcessSections統合: saveSectionPatterns前にRule 1-4実行 / postProcessSections integration in Worker path

Tests / テスト

  • デッドテスト11件削除(4,367行削減)、セキュリティテスト3件追加 / Removed 11 dead tests (4,367 lines), added 3 security tests
  • テストカバレッジ拡充(Worker系、スコアリング、グラデーション検出) / Test coverage expansion (Worker, scoring, gradient detection)

CI/CD

  • E2Eテストジョブ追加: PostgreSQL+pgvector+Playwright+Redis統合テスト環境 / E2E test job with full integrated environment
  • format:check 有効化、.git-blame-ignore-revs 作成 / Enabled format:check, created .git-blame-ignore-revs

Code Style / コードスタイル

  • コードベース全体(1,261ファイル)にPrettier整形適用 / Applied Prettier formatting across entire codebase (1,261 files)

Changed / 変更

  • エージェント設計をv3.0に刷新(問題領域ベース、15エージェント体制) / Agent architecture redesigned to v3.0 (problem-domain-based, 15 agents)
  • Fallback viewport: 1280x800 → 1920x1080 統一 / Viewport unification to 1920x1080

Full Changelog: https://github.com/TKMD/ReftrixMCP/compare/v0.1.6...v0.1.7

Breaking Changes

  • page-analyze-worker split into 7 phase modules (phase-0 … phase-5 + common)
  • motion/schemas and page/schemas each split into 3 files with re‑export hub for backward compatibility
  • llama-vision.adapter split: LLM prompts separated from type definitions

Security Fixes

  • Fixed SSRF, XSS sanitization bypasses and DOMPurify issues resolving multiple security vulnerabilities
  • Upgraded undici from 7.18.2 to 7.24.3 (6 High severity CVEs fixed)
  • Updated flatted to >=3.4.0 (1 High severity CVE fixed)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track TKMD/ReftrixMCP

Get notified when new releases ship.

Sign up free

About TKMD/ReftrixMCP

Web design analysis MCP server with 26 tools for layout extraction, motion detection, quality scoring, and semantic search. Uses Playwright, pgvector HNSW, and Ollama Vision to turn web pages into searchable, structured design knowledge.

All releases →

Beta — feedback welcome: [email protected]