Three review findings on the Mem0 n8n node:
- Memory IDs and event IDs were interpolated raw into request paths, so a
value containing / or .. could reach a different endpoint than intended.
Wrap all four sites in encodeURIComponent.
- Search and Get Many could only filter by user_id, leaving agent- and
run-scoped memories unreachable from the node. Both now accept User ID,
Agent ID, and Run ID. Multiple ids combine with OR because Mem0 indexes
entities separately and an AND across them matches nothing. User ID is
no longer marked required; the node still fails with a clear message
when all three are empty, rather than letting the API return a raw 400.
- n8n-nodes-mem0-checks.yml ran lint and build but never the jest suite,
so the tests could rot unnoticed. Add a test job matching the layout of
pi-agent-plugin-checks.yml.
Tests cover flat single-entity filters, the OR combination, agent-only
listing, the empty-entity guard on both operations, and id escaping in
the get/delete/poll URLs. Docs and README document the new fields and the
OR semantics.
The Add operation exposed app_id, includes, and excludes in Additional
Fields and forwarded them to POST /v3/memories/add/. None of the three
are declared on that endpoint's schema (they belong to MemoryInput, used
by POST /v1/memories/), so they were silently dropped by the server.
app_id was worse than a no-op: the entity-id guard accepted it as
satisfying "at least one entity id", so filling only App ID passed local
validation and then sent a v3 request carrying no scope v3 recognises.
The guard now requires User ID, Agent ID, or Run ID.
Docs corrections alongside it:
- Add: document Custom Instructions and Custom Categories, which the
node has always supported but the docs never mentioned
- Get Many: document Return All, which the docs omitted entirely
- README: Infer and Wait for Completion are independent controls; the
README claimed infer=false returns synchronously, contradicting the
node's own field description and its actual behaviour
The unscoped `n8n-nodes-mem0` name is already taken on npm by an
unrelated publisher, so the CD workflow could never publish it. Move to
the `@mem0` scope, matching `@mem0/pi-agent-plugin` and
`@mem0/openclaw-mem0`, and add `publishConfig.access: public` since
scoped packages default to restricted.
n8n accepts scoped community packages: it strips the scope before
enforcing the `n8n-nodes-` prefix, the same shape as n8n's own
`@n8n/n8n-nodes-langchain`. Verified end to end on n8n 2.22.6 by
installing the packed tarball into the community-packages directory and
executing a workflow against node type `@mem0/n8n-nodes-mem0.mem0`.
The directory, workflow filenames, and the `n8n-nodes-mem0-v*` tag
prefix are unchanged. pnpm-lock.yaml needs no update: the pnpm v9 root
importer is anonymous and never recorded the package name.
kartik-mem0