
Security News
vlt 1.5.0 Adds Agent Skills Management
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.
MnemoDB — the agent memory format. A database whose files you can read: human-readable .mem.md memory for AI agents. Umbrella package re-exporting @mnemodb/core.
A structured, portable, auditable memory format for AI agents — a database whose files you can read.
claude mcp add mnemodb -- npx -y @mnemodb/mcp@latest
Repo, spec, and security audit: https://github.com/mnemodb/mnemodb
A plain-text, Markdown-compatible file format (.mem.md) for the persistent
memory of AI agents, plus the engine and tooling around it. A memory is a
Markdown heading with a one-line metadata span:
## decision: We use PostgreSQL LISTEN/NOTIFY for cache invalidation, not Redis
`mnemo c4d1 | src: user | conf: high | supersedes: 99e0`
Redis was dropped to cut infra count. Revisit if we exceed ~500 notifications/s.
It renders in any Markdown viewer, diffs cleanly in git, and a program reads
every field unambiguously. Every existing CLAUDE.md / AGENTS.md is already a
valid (untyped) MnemoDB file — adoption requires renaming and migrating nothing.
AI agents already have some memory: CLAUDE.md loads a flat file into context,
and Claude's memory tool
gives the model a folder to organize however it likes. Both work. MnemoDB
isn't a replacement — it's the structure and discipline they don't provide.
"Give the model a folder and trust it" is simple and often good enough. MnemoDB is the opposite bet — a defined format with real guarantees:
compact pass that archives what's expired or replaced. A flat memory file
only grows and rots; MnemoDB forgets on purpose, auditably.user / agent /
tool). Anything the agent takes from tool output or the web is labelled
tool, flagged untrusted, and can't supersede or retire a trusted entry. The agent applies
that label itself: it catches mistakes, not an injection that leaves it off.git diff shows exactly
what your agent learned, and mnemo doctor lints for staleness, contradictions,
and damage.Worth it when you want the agent to maintain memory itself across many
sessions without decay, you work across more than one AI tool, or you need to
audit and trust what's in memory. Overkill when a short hand-curated
CLAUDE.md already does the job — we'd rather say so up front.
npx @mnemodb/cli init # create a store (or migrate CLAUDE.md)
claude mcp add mnemodb -- npx -y @mnemodb/mcp@latest # give your agent the tools
npx @mnemodb/cli list # inspect anytime — it's just files
Then add a short instruction to CLAUDE.md so the agent actually calls the
tools. Full walkthrough: https://github.com/mnemodb/mnemodb/blob/main/docs/USAGE.md
mnemodb (this package) — umbrella; re-exports @mnemodb/core and bundles the spec@mnemodb/core — parse, serialize, index, resolve, lifecycle, merge, validate (zero deps)@mnemodb/cli — the mnemo command line@mnemodb/mcp — the memory engine as an MCP server for Claude Code, Cursor, any MCP clientv0.1 — early. Honest feedback wanted, not stars. Security-hardened by an adversarial audit; 46 tests enforced as a ship gate on every release.
License: Apache-2.0 (code), CC BY 4.0 (spec).
FAQs
MnemoDB — the agent memory format. A database whose files you can read: human-readable .mem.md memory for AI agents. Umbrella package re-exporting @mnemodb/core.
We found that mnemodb demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.

Security News
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.