CLI Reference - Mnemom Docs

The mnemom CLI manages authentication, alignment cards, protection cards, and agent diagnostics for the Mnemom trust stack.

Looking to launch a governed coding agent? See mnemom agent — install once, run mnemom agent, and it launches Claude Code through the gateway with an agent set up for you. mnemom agent is available by invitation only; see Redeem an invitation.

Installation

npm install -g @mnemom/mnemom

Authentication

Organizations

mnemom login binds no org — the session carries no org context. Org-scoped commands (like agent claim) target your active org, set with mnemom org use, defaulting to your personal org when none is set.

Card commands

Policy commands (removed)

The standalone mnemom policy command group has been removed — policy (capability mappings, forbidden rules, enforcement defaults) is now authored directly in the alignment card and evaluated with mnemom card evaluate, per the table below.

Old command	Replacement
`mnemom policy init`	Author `capabilities`/`enforcement` directly in a YAML alignment card. See Card Management.
`mnemom policy validate <file>`	`mnemom card validate <file>`
`mnemom policy publish <file>`	`mnemom card publish <file>`
`mnemom policy list`	`mnemom card show --agent <name>`
`mnemom policy test <file>`	`mnemom card evaluate <file> --tools <tools>`
`mnemom policy evaluate`	`mnemom card evaluate <file> --tools <tools>`

See Policy Engine for how the card’s capabilities + enforcement sections work.

Posture commands

Manage Trust Postures (team-scoped oversight policy — not to be confused with the per-agent alignment/protection cards above).

Protection commands

Agent commands

mnemom agent is one namespace for everything about your governed agents: the launcher and its sub-verbs (setup, doctor, config, invite, help), and the verbs list, claim, move, sessions, show and the experimental goal.

`mnemom agent`

Launch a governed coding-agent session (Claude Code today) through the gateway. Available by invitation only (see Redeem an invitation). A bare mnemom agent asks for a session name, then launches; pass --goal to seal a goal. Every launch first makes sure the agent it runs as is claimed in your org, and claims it if it is not; it never starts a session on an unclaimed agent. The launcher, its sub-verbs, sign-in options, saved settings, contracts, guardrails, context folding and profiles, and the experimental implicit goal mode are documented on their own page: mnemom agent.

mnemom agent                    # prompts for a session name
mnemom agent fix-auth --goal "make login work on Safari"
mnemom agent doctor             # read-only preflight
mnemom agent --dry-run          # print the launch plan; no sign-in, no key read, no launch
mnemom agent help config        # help for one sub-verb; never launches

`mnemom agent list`

List the agents in your active org (set with mnemom org use). With no active org set, it lists every org you belong to.

mnemom agent list                      # your active org
mnemom agent list --org <slug-or-id>   # one org, by slug or id
mnemom agent list --all                # every org you belong to

An --org value that is not one of your orgs fails before any API call and lists the orgs you can use. Example output:

  my-coder
    Agent ID:  mnm-0b3f2a1c-d4e5-4f60-b7a8-9c0d1e2f3a4b
    Created:   2/23/2026
    Last seen: 2 minutes ago

  my-researcher
    Agent ID:  mnm-550e8400-e29b-41d4-a716-446655440000
    Created:   2/7/2026
    Last seen: 1 hour ago

  Total: 2 agent(s)

Requires authentication via mnemom login. Agents are auto-created by the gateway on first API call — there is no registration step.

`mnemom agent claim <id-or-name>`

Claim a gateway-provisioned agent into an org by proving you hold its provider key. See the Agent Claim Flow guide for the full lifecycle.

mnemom agent claim mnm-... --key "$AGENT_PROVIDER_KEY" --org mnemom

--org <slug|id> — destination org. Defaults to your active org (set with mnemom org use), else your personal org, with a loud notice.
--key <key> — the agent’s provider API key; the CLI derives the hash_proof locally. Alternatively pass --hash-proof <64-hex> directly.
--name <name> — the provisioned agent name used in proof derivation. It is auto-resolved from the agent id when possible; pass it only to override.
--json — machine-readable output.

To re-home an agent you hold the key for, re-claim it with a new --org. The destination org’s template can floor/cap the agent’s composed card, so its effective posture may change. See Idempotency and re-homing.

`mnemom agent move <id-or-name> --to <slug|id>`

Move an agent to another org without its key. This is role-based: you must be an owner or admin in both the current and the destination org. --to is required and never defaults to your active org.

mnemom agent move mnm-... --to acme
mnemom agent move my-coder --to acme --json

`mnemom agent sessions`

List your Mnemom Agent launches from the local ledger (~/.mnemom/sessions.jsonl), newest first — the last 20 unless --all. Launches older than sessions.retention_days (default 30) are removed at the next launch; see CLI preferences.

mnemom agent sessions
mnemom agent sessions --all --json

Options: --all, --json

`mnemom agent show [ref]`

Show one session: the local launch record merged with the gateway’s live goal state (sealed contract, latest verdict, guardrail gauges). ref is a session name (newest match wins) or a unique conversation-id prefix; omitted shows the newest session.

mnemom agent show
mnemom agent show fix-auth --json

Options: --json

`mnemom agent goal show|pin|reset [ref]`

Experimental and opt-in (mnemom experimental enable implicit). Read and steer the goal the gateway built for an implicit-mode session: show prints it, pin freezes the stored goal (record-only, not a steering lock), and reset clears it or replaces it with your own statement. ref picks the session the same way show does. See Implicit goal mode.

mnemom agent goal show --history
mnemom agent goal pin
mnemom agent goal reset --statement "Ship the CSV export" --yes

Options: --thread <id>, --json; show: --all-threads, --history; pin: --off; reset: --statement <s>, --requirement <r> (repeatable), --yes

Updates: `mnemom update`

The CLI updates itself in the background: at most once a day it checks for a newer release and installs it after the running command exits, never under a live session. Only a plain npm install -g install self-updates; other package managers get the right manual command instead. Background updates are off in CI and when output is not a terminal.

mnemom update            # check and install now
mnemom update --check    # only report whether an update is available
mnemom update --json

Options: --check, --channel <latest|next> (this run only), --force (allow installing an older version, e.g. moving from next back to latest), --json Updates never downgrade on their own. Set MNEMOM_DISABLE_AUTOUPDATE=1 to turn background updates off entirely, or use the update.mode preference below.

Minimum version

The Mnemom API tells the CLI the oldest version it still supports, on every response. A CLI older than that stops instead of running the command, because an old CLI can leave out request fields a newer server expects. When auto-update is on (update.mode is auto), the CLI was installed with npm install -g, and it runs in an interactive terminal (not in CI, not with output piped, and not with MNEMOM_DISABLE_AUTOUPDATE set), it installs the newest stable release that meets the minimum, prints Updated the Mnemom CLI … Re-run your command. and exits; run your command again. Otherwise it prints the command to upgrade by hand:

npm i -g @mnemom/mnemom@latest

CLI preferences: `mnemom config`

CLI-wide preferences live in ~/.mnemom/config.json. (Settings for mnemom agent live separately in mnemom agent config.)

mnemom config list                         # every setting, its value, and where it came from
mnemom config get update.channel
mnemom config set update.mode notify
mnemom config unset update.mode            # back to the default

Key	Values	Default	Environment override
`update.channel`	`latest` \| `next`	`latest` (`next` when you run a `next` build; `next` requires an invitation)	`MNEMOM_UPDATE_CHANNEL`
`update.mode`	`auto` \| `notify` \| `off`	`auto`	`MNEMOM_UPDATE_MODE`
`sessions.retention_days`	positive whole number	`30`	`MNEMOM_SESSIONS_RETENTION_DAYS`

Experimental features: `mnemom experimental`

Some features ship as experimental: off until you turn them on, hidden from --help while off, and liable to change or be removed in any release with no deprecation period. Using an experimental flag or command while its feature is off fails with a pointer to the command that turns it on.

mnemom experimental list             # every experimental feature and whether it is on
mnemom experimental enable <id>
mnemom experimental disable <id>

The setting is stored in ~/.mnemom/config.json. MNEMOM_EXPERIMENTAL=<id>,<id> (or all / none) overrides it for one shell. The current features, all for mnemom agent:

Feature	What it turns on
`implicit`	Implicit goal alignment: `--implicit`, `goal_mode = implicit` and `mnemom agent goal`. See Implicit goal mode
`compaction-intercept`	`--compaction-intercept`, the `compaction_intercept` setting, and a `--compact-at` target below 1M
`context-handoff`	`--context-handoff` and the `context_handoff` setting
`slack`	`--slack`, the `slack_*` settings and `mnemom agent slack`

mnemom experimental list shows the same list with what each one gates.

Diagnostics

License

Team commands

Manage teams and their scope-cascade templates (mnemom team ...).

Command	Description	Key options
`team list`	List every team across all orgs you belong to	`--json`
`team show <team_id>`	Show details of a single team	`--json`
`team alignment-template <team_id>`	Read, or write with `--set <file>`, the team’s alignment template	`--set <file>`, `--clear`, `--json`
`team protection-template <team_id>`	Read, or write with `--set <file>`, the team’s protection template	`--set <file>`, `--clear`, `--json`
`team preview-compose <team_id>`	Dry-run the composer with a draft template (alignment by default)	`--protection`, `--from <file>`, `--json`
`team admin grant <team_id>`	Grant `team_admin` role to a user on this team	`--user <user_id>`, `--json`
`team admin revoke <team_id>`	Revoke a `team_admin` grant (admin or self)	`--user <user_id>`, `--json`
`team admin list <team_id>`	List active `team_admin` grants on a team	`--json`
`team coverage <team_id>`	Show last-30-day sideband sweep coverage for a team	`--rows`, `--json`

Advisories & governance

mnemom advisories ... lists and inspects the sideband advisories postures write:

Command	Description	Key options
`advisories list`	List recent advisories scoped to one agent or one team	`--agent <id>`, `--team <id>`, `--source <s>`, `--limit <n>`, `--since <iso>`, `--json`
`advisories show <advisory_id>`	Show one advisory’s full content	`--agent <id>`, `--team <id>`, `--json`

mnemom governance ... is the operator workflow for governance_signals:

Command	Description	Key options
`governance signals list`	List signals at platform/org/team/agent scope	`--org`, `--team`, `--agent`, `--source`, `--severity`, `--status`, `--scope`, `--pattern-type`, `--since`, `--limit`, `--json`
`governance signals show <signal_id>`	Show one signal in detail	`--json`
`governance signals ack <signal_id>`	Acknowledge an open signal (org admin/owner)	`--action <text>`, `--json`
`governance signals resolve <signal_id>`	Resolve with a resolution status (`action_taken`\|`wont_fix`\|`duplicate`\|`false_positive`\|`self_resolved`)	`--status <s>`, `--action <text>`, `--json`
`governance signals dismiss <signal_id>`	Dismiss a signal as not actionable	`--reason <text>`, `--json`
`governance destinations list` \| `add` \| `remove <id>` \| `test <id>`	Manage notification destinations (webhook/slack/email/pagerduty)	`--org`, `--channel`, `--config`, `--name`, `--filter`, `--json`
`governance rules list` \| `add` \| `remove <id>`	Manage escalation rules (predicate → destinations)	`--org`, `--name`, `--predicate`, `--destinations`, `--json`

API keys & webhooks

mnemom api-key ... manages capability-scoped personal API keys:

Command	Description	Key options
`api-key list`	List your active keys with their scope sets	`--json`
`api-key create`	Mint a new key. Default scopes: `gateway`, `api:read`, `api:write`; admin scopes are role-gated	`--name <name>`, `--scopes <list>`, `--json`
`api-key rotate <key_id>`	Atomic mint-new + revoke-old; returns the new secret once	`--json`
`api-key revoke <key_id>`	Soft-revoke an active key immediately and irreversibly	—

mnemom webhooks ... manages org webhook endpoints, deliveries, and replay; mnemom listen <org_id> streams live events:

Command	Description	Key options
`webhooks list <org_id>` / `get <org_id> <endpoint_id>`	List or inspect endpoints	`--json`
`webhooks create <org_id>`	Create an endpoint (signing secret shown once)	`--url`, `--events`, `--description`, `--json`
`webhooks update <org_id> <endpoint_id>`	Update url/events/description/active state	`--url`, `--events`, `--description`, `--active`, `--json`
`webhooks delete <org_id> <endpoint_id>`	Permanently delete an endpoint	—
`webhooks rotate-secret <org_id> <endpoint_id>`	Mint a new signing secret (shown once)	`--json`
`webhooks trigger <org_id> <endpoint_id>`	Fire a synthetic test event through the full pipeline	`--json`
`webhooks list-deliveries <org_id>`	List recent deliveries, optionally scoped to one endpoint	`--endpoint`, `--limit`, `--offset`, `--json`
`webhooks redeliver <org_id> <delivery_id>`	Retry one previous delivery	`--json`
`webhooks replay <org_id> <event_id>`	Re-fan-out a historical event to current (or specified) endpoints	`--endpoint` (repeatable), `--json`
`listen <org_id>`	Stream live webhook events for an org	`--forward-to`, `--secret`, `--filter`, `--since`, `--json`

Other commands

Command	Description	Key options
`recipes report-fn <recipe-id>`	File a false-negative report against a recipe (it should have caught something and didn’t)	`--summary`, `--evidence`, `--agent`, `--checkpoint`, `--json`
`recipes report-fp <recipe-id>`	File a false-positive report (a recipe fired on legitimate behavior)	`--summary`, `--evidence`, `--agent`, `--checkpoint`, `--json`
`verify-card <agent_id>`	Verify a published canonical card’s AAP attestation + Merkle inclusion proof offline	`--at`, `--card-kind`, `--api`, `--strict`, `--jwks-cache`, `--no-cache`
`usage`	Show per-person token/request consumption for an org	`--org`, `--days <7\|30\|90>`, `--person`, `--provider`, `--model`, `--limit`, `--cursor`, `--json`
`validate safe-house`	Render Safe House harness state per lane — a promotion-readiness signal, mainly used in CI	`--against`, `--max-age`, `--lane`, `--strict`, `--json`
`try-me <token>`	Run the guided Dojo onboarding for a `/try-me` token (born → claim → declare → spar)	`--dry-run`, `--json`, `--yes`, `--name`, `--resume`, `--api`, `--no-open`, `--poll-timeout`
`wrap`	Instrument an existing agent through the gateway (born → cards → integration snippet)	`--provider`, `--framework`, `--name`, `--provider-key`, `--yes`, `--json`
`onboard`	Self-onboard the calling agent (scan → claim → declare → rating → badge)	`--json`, `--yes`, `--key`, `--hash-proof`, `--no-open`
`skills list` / `skills describe <name>`	List or describe the Mnemom CLI’s own skills	`--json`

Global options

Option	Description
`--agent <name>`	Select which agent to use for the command
`-V, --version`	Show CLI version
`--help`	Show help text

Agent selection

Commands that operate on an agent use this priority to determine which agent:

--agent <name> flag (highest priority)
MNEMOM_AGENT environment variable

There is no default agent concept. If neither --agent nor MNEMOM_AGENT is set, the command stops with Agent required. Use --agent <name> or set MNEMOM_AGENT. (mnemom agent is different: it uses its own default agent, see Your governed agent.) Example:

# Use --agent flag
mnemom status --agent my-coder

# Use environment variable
MNEMOM_AGENT=my-coder mnemom logs

Workflow

A typical workflow with the mnemom CLI:

Supported providers

The gateway routes and traces Anthropic, OpenAI, and Gemini. See Provider Support for the current supported-model list and the per-provider feature-coverage matrix (thinking-trace inspection, prompt caching, and more vary by provider).

​Installation

​Authentication

​Organizations

​Card commands

​Policy commands (removed)

​Posture commands

​Protection commands

​Agent commands

​mnemom agent

​mnemom agent list

​mnemom agent claim <id-or-name>

​mnemom agent move <id-or-name> --to <slug|id>

​mnemom agent sessions

​mnemom agent show [ref]

​mnemom agent goal show|pin|reset [ref]

​Updates: mnemom update

​Minimum version

​CLI preferences: mnemom config

​Experimental features: mnemom experimental

​Diagnostics

​License

​Team commands

​Advisories & governance

​API keys & webhooks

​Other commands

​Global options

​Agent selection

​Workflow

​Supported providers

​See also

Installation

Authentication

Organizations

Card commands

Policy commands (removed)

Posture commands

Protection commands

Agent commands

`mnemom agent`

`mnemom agent list`

`mnemom agent claim <id-or-name>`

`mnemom agent move <id-or-name> --to <slug|id>`

`mnemom agent sessions`

`mnemom agent show [ref]`

`mnemom agent goal show|pin|reset [ref]`

Updates: `mnemom update`

Minimum version

CLI preferences: `mnemom config`

Experimental features: `mnemom experimental`

Diagnostics

License

Team commands

Advisories & governance

API keys & webhooks

Other commands

Global options

Agent selection

Workflow

Supported providers

See also