MnemoVulns

Known vulnerabilities in your projects, from OSV.dev.

Choose a project folder. MnemoVulns reads its lockfile, asks OSV.dev which installed versions have a known vulnerability, and shows each one with the version that fixes it. Each vulnerability is then tracked across scans: open, fixed, or a risk you accepted with your reason.

The cartridge id is @mnemosyne-plugins/mnemo-vulns. Its code lives at Mnemosyne-OS/MnemoVulns.

Lockfiles it reads

At the project root:

• npm: pnpm-lock.yaml, package-lock.json, yarn.lock
• Python: Pipfile.lock, poetry.lock, uv.lock, requirements.txt
• Rust: Cargo.lock

Some entries have no pinned registry version: an unpinned requirement, a link, a file, git or a workspace package. They are not asked, and the summary counts them.

Scan a project

1. Press Choose a project and pick the folder.
2. Open the project and press Scan. The progress shows the versions asked and the records read. Stop stops it.
3. Read Where to start: the open vulnerabilities, sorted by what to upgrade first.

A partial scan says so: some versions were not asked, and the list is not complete.

Read the result

Packages are grouped by where they sit:

• In the product: the package goes out with what people install or visit. The vulnerability reaches them.
• Dev tool: only development dependencies reach this version. It can still ship, for example as an Electron runtime or code a bundler copies.
• Not known: the lockfile does not say.

The chips All, In the product and Dev tools filter the list. Each package shows Upgrade to a version, and how many vulnerabilities it closes. Severities are Critical, High, Moderate and Low. Malicious packages are listed apart, to remove.

Track a vulnerability

• Accept the risk asks Why you keep it. The vulnerability stops counting as open.
• Take back reopens it.
• A vulnerability gone from the next scan counts as Fixed. When the database drops a record, the vulnerability is counted apart, not as a fix.

Pin on the canvas puts the project's card on your canvas, with its open count and its fixes.

Scan offline

By default, scans ask OSV.dev online and download only the records of each project. Local database lets you download an ecosystem's database once. Scan with the local database then works without going online. A local scan says the date of its database: vulnerabilities published since are missing.

Where your data goes

• Records, tracking and reports go to MnemoVulns's folder inside your knowledge folder: one JSON per OSV record under records/, and per project a tracking.json and the report.md of the last scan. On the first scan, MnemoVulns asks you to choose the knowledge folder.
• Each record enters MnemoVulns's memory pack with its source, its licence and its date. OSV.dev gathers several databases, each under its own licence.
• To ask in your own words, open the chat and tick MnemoVulns under Knowledge in its scope.

For agents

Action	Effect	What it does
projects	read	The projects watched and the summary of their last scan
vulnerabilities	read	The vulnerabilities of one project, with their tracking state
openProject	write	One project's page
home	write	The list of projects
showPackage	write	Opens one vulnerable package on the project page
filterPackages	write	The chips: all, shipped, dev, unknown
scan	write	Scans a project now
stopScan	write	Stops the scan running
setScanSource	write	Local database or OSV.dev online
acceptRisk	write	Accepts the risk of one open vulnerability, with the reason
reopenRisk	write	Takes an accepted risk back

scan takes minutes. It answers started. Call projects until scanning is false.

Voice examples: "show the lodash package", "show only what ships in the product", "stop the scan", "switch to the local database".