Three review findings on the Mem0 n8n node:
- Memory IDs and event IDs were interpolated raw into request paths, so a
value containing / or .. could reach a different endpoint than intended.
Wrap all four sites in encodeURIComponent.
- Search and Get Many could only filter by user_id, leaving agent- and
run-scoped memories unreachable from the node. Both now accept User ID,
Agent ID, and Run ID. Multiple ids combine with OR because Mem0 indexes
entities separately and an AND across them matches nothing. User ID is
no longer marked required; the node still fails with a clear message
when all three are empty, rather than letting the API return a raw 400.
- n8n-nodes-mem0-checks.yml ran lint and build but never the jest suite,
so the tests could rot unnoticed. Add a test job matching the layout of
pi-agent-plugin-checks.yml.
Tests cover flat single-entity filters, the OR combination, agent-only
listing, the empty-entity guard on both operations, and id escaping in
the get/delete/poll URLs. Docs and README document the new fields and the
OR semantics.
The unscoped `n8n-nodes-mem0` name is already taken on npm by an
unrelated publisher, so the CD workflow could never publish it. Move to
the `@mem0` scope, matching `@mem0/pi-agent-plugin` and
`@mem0/openclaw-mem0`, and add `publishConfig.access: public` since
scoped packages default to restricted.
n8n accepts scoped community packages: it strips the scope before
enforcing the `n8n-nodes-` prefix, the same shape as n8n's own
`@n8n/n8n-nodes-langchain`. Verified end to end on n8n 2.22.6 by
installing the packed tarball into the community-packages directory and
executing a workflow against node type `@mem0/n8n-nodes-mem0.mem0`.
The directory, workflow filenames, and the `n8n-nodes-mem0-v*` tag
prefix are unchanged. pnpm-lock.yaml needs no update: the pnpm v9 root
importer is anonymous and never recorded the package name.
- Telemetry: replace client-side PostHog (which read process.env, banned in
verified nodes) with first-party `source: "N8N"` attribution on API requests,
mirroring OpenClaw. Removes the undisclosed-collection concern entirely.
- Verification-scanner fixes: add credential icon, use NodeConnectionTypes.Main
instead of the 'main' literal, wrap error paths in NodeApiError, stop shipping
.d.ts / tsbuildinfo, and align the local eslint config with the scanner.
- Add offline unit tests (jest): entity-id guard, JSON-parse errors, poll-timeout
loop, source attribution, and Return All pagination.
- Get Many: add a Return All option that pages through all memories.
- Docs: README telemetry note and an AGENTS.md Key Directories row.
Verified: build + tsc + eslint + 5 unit tests + live E2E against api.mem0.ai, and
the packed tarball passes @n8n/scan-community-package with zero violations.
kartik-mem0