mnemo-memory

Cloud-persistent memory for AI agents. Stateless plugins + TiDB Serverless = cross-session recall, multi-agent sharing, and hybrid vector + keyword search. W...

Security Scan

The skill claims to provide cloud-persistent agent memory using TiDB Serverless, which fits the description, but the SKILL.md expects database credentials and an npm package install even though the registry metadata declares no required credentials or install — that mismatch and the lack of verifiable package/source information is concerning.

Purpose & Capability

The name/description (cloud-persistent memory backed by TiDB) matches the instructions' purpose. However, the published metadata lists no required credentials or config, while the SKILL.md explicitly instructs adding host/username/password (database credentials) to openclaw.json and optionally setting an embed API key. The skill therefore fails to declare the secrets it actually needs.

Instruction Scope

SKILL.md describes network calls to a third‑party DB (TiDB Cloud), instructions to configure a DB host/user/password, and optional use of an embedding API key. It does not (in the visible portion) instruct reading unrelated local files or exfiltrating data elsewhere. The scope stays within 'store/read memory in TiDB' but it grants the agent permission to send possibly sensitive conversation memory to an external service.

Install Mechanism

There is no install spec in the registry (instruction-only), which reduces automatic risk, but the doc tells users to run `npm install mnemo-openclaw`. That npm package is not included in the bundle and its source/maintainer are not verified here—installing it will pull code from an external registry that hasn't been audited in this package.

Credentials

The skill requires database credentials (host, username, password) in configuration and optionally an embedding API key, but the registry metadata declares no required env vars/credentials. Requesting DB credentials is proportionate to the functionality, but the omission from metadata and lack of guidance about least privilege (e.g., creating a restricted DB user) is a red flag.

Persistence & Privilege

The skill does not request 'always: true' or other elevated platform privileges. It instructs users to add a plugin entry to openclaw.json (normal for a plugin). There is no indication it modifies other skills or system-wide settings beyond its own config.

What to consider before installing

This skill appears to do what it says (store agent memory in TiDB Cloud), but several things don't add up and you should verify before installing: - Metadata mismatch: The skill's published metadata declares no required credentials, yet the instructions require a TiDB host/username/password (and optionally an embed API key). Treat those as real secrets you must supply. - Third-party code: The SKILL.md tells you to `npm install mnemo-openclaw`, but the package source is not included here. Inspect the npm package repository and publisher before running npm install; review its code for unexpected network calls or data exfiltration. - Data exposure: Memories (and any text you store) will be sent to an external service (TiDB Cloud). TiDB can also generate embeddings server-side (e.g., amazon/titan-embed-text-v2), meaning your stored content will be processed by that model. If you will store sensitive data, consider encrypting it before storing or self-hosting the database. - Principle of least privilege: Create a dedicated database user with minimal permissions (only the schemas/tables the plugin needs) rather than reusing broad credentials. Prefer short-lived credentials or per-agent tokens if supported. - Verify CRDT/clock behavior: The docs mention vector clocks and conflict resolution. If concurrent writes and correctness matter for your use-case, test these behaviors in a safe environment. - Ask for missing metadata: A well-formed skill should declare required env vars/primary credential in its registry metadata. If you want to use this skill, request the author to include declared env requirements and a link to the package source/homepage. If you cannot verify the npm package/source or are uncomfortable storing data in TiDB Cloud, consider self-hosting an equivalent database or using a memory plugin from a source you trust.

mnemo — Cloud-Persistent Memory for AI Agents \U0001F9E0

Your agents are stateless. Your memory shouldn't be.

Every AI agent session starts from zero. Context is lost, decisions are forgotten, and your agents keep rediscovering what they already knew. mnemo externalizes agent memory into TiDB Cloud Serverless — so agents stay disposable, but memory persists forever.

┌─────────────┐     ┌─────────────┐     ┌─────────────┐
│ Claude Code  │     │  OpenCode   │     │  OpenClaw   │
│   Plugin     │     │   Plugin    │     │   Plugin    │
└──────┬───────┘     └──────┬──────┘     └──────┬──────┘
       │                    │                    │
       └────────────────────┼────────────────────┘
                            │
                    ┌───────┴────────┐
                    │  mnemo-server  │  ← optional (team mode)
                    └───────┬────────┘
                            │
                    ┌───────┴────────┐
                    │   TiDB Cloud   │  ← zero-ops, free tier
                    │   Serverless   │
                    │                │
                    │  • VECTOR type │
                    │  • EMBED_TEXT  │
                    │  • HTTP API    │
                    └────────────────┘

What Problem Does This Solve?

Pain Point	Without mnemo	With mnemo
Session amnesia	Agent forgets everything on restart	Memory persists in the cloud
Machine-locked	Memory in local files, lost on device switch	Same memory from any machine
Agent silos	Claude can't see what OpenCode learned	All agents share one memory pool
Team isolation	Teammate's agent starts from scratch	Shared spaces with per-agent tokens
No semantic search	Grep through flat files	Hybrid vector + keyword search
Concurrent conflicts	Last write silently overwrites	CRDT vector clocks detect & resolve

Why TiDB Cloud Serverless?

mnemo chose TiDB Cloud Serverless because it uniquely combines everything agent memory needs — in one service, at zero cost:

• Native VECTOR type — Semantic search in the same table as your metadata. No separate vector database.
• EMBED_TEXT() auto-embedding — TiDB generates embeddings server-side (e.g. tidbcloud_free/amazon/titan-embed-text-v2). No OpenAI API key required for semantic search.
• HTTP Data API — Agents talk to TiDB via fetch/curl. No database drivers, no connection pools.
• Free tier — 25 GiB storage, 250M Request Units/month. More than enough for individual use.
• MySQL compatible — Migrate to self-hosted TiDB or MySQL anytime.

One database gives you relational storage + vector search + auto-embedding + HTTP access. No glue code. No infra.

Hybrid Search: Vector + Keyword

              Embedding configured?
              ┌─────────┴─────────┐
             Yes                  No
              │                    │
        Hybrid search        Keyword only
        (vector + keyword)   (LIKE '%q%')
              │                    │
    ┌─────────┴─────────┐         │
 Vector results     Keyword       │
 (ANN cosine)       results       │
    └─────────┬─────────┘         │
         Merge & rank         Direct results

Three embedding options — pick one or none:

1. TiDB auto-embedding — EMBED_TEXT() generates vectors server-side. Zero config. Free.
2. OpenAI / compatible API — Set MNEMO_EMBED_API_KEY. Works with Ollama too.
3. No embedding — Keyword search works immediately. Add vectors later, no migration needed.

Multi-Agent Conflict Resolution (CRDT)

When multiple agents write to the same memory, mnemo uses vector clocks — no coordination required:

Agent A: clock {A:3, B:1}        Agent B: clock {A:2, B:2}
         \                                /
          └──── Server compares ─────────┘
                       │
               Neither dominates →
               Concurrent conflict!
                       │
            Deterministic tie-break
                       │
               Winner saved, clocks merged: {A:3, B:2}

Scenario	Result
A's clock dominates B's	A wins — B's write is stale
B's clock dominates A's	B wins — A's write is outdated
Concurrent (neither dominates)	Deterministic tie-break — no data loss
No clock sent (legacy client)	LWW fast path — backward compatible

Deletes are soft (tombstone + clock increment) — no ghost resurrection from agents that missed the delete.

Install for OpenClaw

npm install mnemo-openclaw

Add to openclaw.json:

{
  "plugins": {
    "slots": { "memory": "mnemo" },
    "entries": {
      "mnemo": {
        "enabled": true,
        "config": {
          "host": "<your-tidb-host>",
          "username": "<your-tidb-user>",
          "password": "<your-tidb-pass>"
        }
      }
    }
  }
}

Get a free cluster in 30 seconds at tidbcloud.com.

Optional — enable auto-embedding (no API key needed):

{
  "config": {
    "host": "...",
    "username": "...",
    "password": "...",
    "autoEmbedModel": "tidbcloud_free/amazon/titan-embed-text-v2",
    "autoEmbedDims": 1024
  }
}

Also Works With

Platform	Install
Claude Code	/plugin marketplace add qiffang/mnemos → /plugin install mnemo-memory@mnemos
OpenCode	"plugin": ["mnemo-opencode"] in opencode.json
Any HTTP client	REST API or TiDB HTTP Data API directly

5 Memory Tools

Tool	What it does
memory_store	Store a memory (upsert by key, with optional CRDT clock)
memory_search	Hybrid vector + keyword search across all memories
memory_get	Retrieve a single memory by ID
memory_update	Update an existing memory
memory_delete	Soft delete with tombstone (CRDT-aware)

Two Modes, One Plugin

	Direct Mode	Server Mode
For	Individual developers	Teams with multiple agents
Backend	Plugin → TiDB Serverless	Plugin → mnemo-server → TiDB
Deploy	Nothing — free tier	Self-host Go binary
Features	Hybrid search, auto-embedding	+ Space isolation, per-agent tokens, CRDT

Mode is inferred from config. Start personal, scale to team — no code change.

Links

• GitHub: github.com/qiffang/mnemos
• Design Doc: docs/DESIGN.md
• CRDT Proposal: crdt-memory-proposal.md
• TiDB Cloud Serverless: tidbcloud.com (free tier)

---

Built for agents that need to remember. Powered by TiDB Cloud Serverless.