Scan mem0 for memory poisoning, prompt injection and leaked secrets

Mimvo is an open-source Python package for Python 3.11+, published on PyPI. The mem0 extra adds the mem0 client and nothing else.

pip install "mimvo[mem0]"

One command reads every record, runs the secrets, injection and poisoning checks, and writes a self-contained HTML report you can forward.

mimvo scan mem0 \  --config mem0_config.yaml \  --report report.html

• Open source: pass --config with the same file your app passes to Memory.from_config.
• Platform: pass --api-key (defaults to MEM0_API_KEY) and one of --user-id, --agent-id or --run-id.
• Leave out the ids on the open-source store to scan every memory, or set --user-id to scan one user.

The same scan from your own code, for a scheduled job or a notebook.

from pathlib import Pathfrom mem0 import Memoryfrom mimvo import Mimvofrom mimvo.scan import Mem0ScanSource, render_htmlmemory = Memory.from_config(config)  # the same config your app usessource = Mem0ScanSource(memory)report = Mimvo().scan(source)report.source = "mem0:all"Path("report.html").write_text(render_html(report), encoding="utf-8")

Thirteen finding codes across three checks. Each finding comes with a severity, a recommended action, the evidence (secrets masked), fix steps, and an OWASP and CWE mapping. Details are in the finding code reference.

Fail the job on high-severity findings, send results to GitHub code scanning as SARIF, and put a summary on the run page. See Use in CI for a full GitHub Actions workflow.

mimvo scan mem0 \  --config mem0_config.yaml \  --fail-on high \  --sarif mimvo.sarif \  --markdown "$GITHUB_STEP_SUMMARY"

Reads with get_all and the vector store's list. Never adds, updates, or deletes memories.

The default detectors run on your machine with no API key and no model download, so memory text does not leave it. Secret values are masked in every report. Hosted detectors are opt-in.

• ChScan Chroma
• QdScan Qdrant
• pgScan Postgres and pgvector
• PcScan Pinecone
• LCScan LangChain and LangGraph
• {}Scan JSONL exports