@hasna/mementos
Universal memory system for AI agents - CLI + MCP server + library API
9
Versions
Apache-2.0
License
Yes
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
andreihasna2
Keywords
memorymementosmcpaicoding-agentclaudecodexgeminiclisqlite
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Provenance direction unchanged; likely build-env variance, not takeover. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Well-known libs matching stated CLI/dashboard/OCR features. | ai | |
| source-diff | obfuscated-file:dashboard/dist/assets/index-DqyMbv89.js | AI (source-diff): Vite-bundled dashboard JS with React banner, not true obfuscation. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Bundled build output for new dashboard/CLI/MCP surfaces. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Expected growth from new dashboard bundle and dependencies. | ai | |
| phantom-deps | phantom-dep:@ai-sdk/anthropic | AI (phantom-deps): Config-referenced AI SDK dep, benign. | ai | |
| phantom-deps | phantom-dep:@hasna/events | AI (phantom-deps): Same-org package, expected phantom pattern. | ai | |
| phantom-deps | phantom-dep:@ai-sdk/openai | AI (phantom-deps): Config-referenced AI SDK dep, benign. | ai | |
| phantom-deps | phantom-dep:ai | AI (phantom-deps): Used via build externals/config, not a direct import concern. | ai | |
| phantom-deps | phantom-dep:@ai-sdk/openai-compatible | AI (phantom-deps): Config-referenced AI SDK dep, benign. | ai | |
| phantom-deps | phantom-dep:commander | AI (phantom-deps): Deps are bundled via bun build; phantom-dep false positive for this bundled package. | ai | |
| phantom-deps | phantom-dep:pg | AI (phantom-deps): Deps are bundled via bun build; phantom-dep false positive for this bundled package. | ai | |
| phantom-deps | phantom-dep:pdf-parse | AI (phantom-deps): Bundled externally; phantom-dep is a false positive for this build setup. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall only creates local config directories under $HOME; no network access or code execution. | ai | |
| phantom-deps | phantom-dep:ink | AI (phantom-deps): Externalized at build time via bun build --external ink; not directly imported in dist. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): Bundled externally; phantom-dep is a false positive for this build setup. | ai | |
| phantom-deps | phantom-dep:react | AI (phantom-deps): Externalized at build time; not directly imported in dist. | ai | |
| phantom-deps | phantom-dep:tesseract.js | AI (phantom-deps): Bundled externally; phantom-dep is a false positive for this build setup. | ai |