Mnema Shared Brain for You and Your AI Agents

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Concern

  dependencies are not pinned.

  INSTALL_UNPINNED

  package.json, line 27

  @ai-sdk/google

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach mnema.example.com. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  src/collab/writeback.ts, line 34

  const res = await fetch(`${collabUrl}/_internal/writeback/${docId}`, {

  src/collab/writeback.ts, line 73

  const res = await fetch(`${collabUrl}/_internal/init/${docId}`, {

  src/collab/writeback.ts, line 110

  const res = await fetch(`${collabUrl}/_internal/replacesection/${docId}`, {

  Show more

  src/collab/writeback.ts, line 149

  const res = await fetch(`${collabUrl}/_internal/replacebody/${docId}`, {

  src/collab/writeback.ts, line 193

  const res = await fetch(`${collabUrl}/_internal/appendblocks/${docId}`, {

  src/lib/google-calendar.ts, line 54

  const res = await fetch(TOKEN_URL, {

  src/lib/google-calendar.ts, line 70

  const res = await fetch(TOKEN_URL, {

  src/lib/google-calendar.ts, line 114

  const res = await fetch(

  Dockerfile, line 58

  CMD node -e "fetch('http://localhost:8080/health').then(r => process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  scripts/mint-test-jwt.mjs, line 5

  const secret = new TextEncoder().encode(process.env.JWT_SECRET);

  src/collab/server.ts, line 106

  if (!secret || secret !== process.env.COLLAB_INTERNAL_SECRET) {

  src/config/env.ts, line 7

  // Walk up from this file to find the nearest .env (repo root or app root).

  Show more

  src/collab/server.ts, line 174

  if (!secret || secret !== process.env.COLLAB_INTERNAL_SECRET) {

  src/collab/server.ts, line 242

  if (!secret || secret !== process.env.COLLAB_INTERNAL_SECRET) {

  src/collab/server.ts, line 368

  if (!secret || secret !== process.env.COLLAB_INTERNAL_SECRET) {

  src/collab/server.ts, line 465

  if (!secret || secret !== process.env.COLLAB_INTERNAL_SECRET) {

  src/config/env.ts, line 11

  const candidate = resolve(dir, '.env');

  src/emails/test-send.ts, line 10

  * Uses RESEND_API_KEY from .env - set it before running.

  src/emails/test-send.ts, line 14

  // Load env vars from repo root .env

  src/emails/test-send.ts, line 20

  dotenv({ path: resolve(__dirname, '../../../../.env') });

  src/lib/email.ts, line 124

  if (!process.env.RESEND_API_KEY) throw new Error('RESEND_API_KEY not set');

  src/lib/email.ts, line 125

  this.client = new Resend(process.env.RESEND_API_KEY);

  src/routes/complete/handler.ts, line 39

  // rest of the .env uses the friendlier name).

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  the file cap was reached before every file was read.

  OBFUSCATION_FILE_CAP_REACHED

  src/tests/round-trip/fuzz.test.ts, line 1

  import { describe, expect, it } from 'vitest';

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit fd578b94685e. dependencies are not pinned. can reach a host that is not written as a fixed address. can reach mnema.example.com. The description does not name that host. reads a credential or environment file. the file cap was reached before every file was read.

Date and source

Date checked: 17 Oct 2026

Read how this letter is chosen