> ## Documentation Index > Fetch the complete documentation index at: https://docs.mnemom.ai/llms.txt > Use this file to discover all available pages before exploring further. # Mnemom Gateway Overview > Transparent AI agent tracing gateway with AAP and AIP compliance # Mnemom Gateway overview Mnemom is a transparent AI agent tracing gateway. It observes your AI agent's API calls and builds verifiable alignment traces — what decisions were made, what alternatives were considered, and whether behavior matches declared values. Your prompts and responses are never stored. Mnemom is [AAP](/protocols/aap/specification)-compliant and [AIP](/protocols/aip/specification)-compliant. It produces structured [AP-Traces](https://github.com/mnemom/aap) and runs per-turn [AIP](https://github.com/mnemom/aip) integrity checks on every agent interaction. ## Architecture ``` gateway/ ├── cli/ # CLI tool (npm package) ├── gateway/ # Cloudflare Worker — API proxy + tracing ├── observer/ # Cloudflare Worker — trace builder + AAP verification ├── api/ # Cloudflare Worker — REST API ├── dashboard/ # React frontend (legacy, see mnemom-website) └── database/ # Supabase schema (Postgres) ``` ### Request flow ``` ┌─── /anthropic/* ──→ Anthropic (Claude) Your App → mnemom ├─── /openai/* ──→ OpenAI (GPT-5) gateway └─── /gemini/* ──→ Google (Gemini) ↓ ↑ CF AI Gateway ← SSE stream ↓ | Response split | / \ | to client to background analysis (immediate) (async) | Parse SSE → extract thinking | AIP analysis (Haiku, ~3s) | checkpoint + attestation → Supabase | Policy evaluation (if policy active) | Observer (cron) → AP-Trace → Supabase | Dashboard (mnemom.ai) ``` Named agents use the `x-mnemom-agent` header to specify an agent name (e.g., `x-mnemom-agent: my-coder`). The provider path stays unchanged (`/anthropic/v1/messages`). When the gateway first encounters an API key, it registers a new agent with a server-assigned `mnm-{uuid_v4}` identifier. The API key hash is used to recognize the same agent on subsequent requests, so multiple named agents can share an API key while maintaining distinct trace histories. See [Agent Identity](/concepts/agent-identity) for details. The system consists of five components: 1. **Gateway** — A Cloudflare Worker that intercepts API requests to Anthropic, OpenAI, and Gemini. It identifies your agent via API key hash (zero-config), attaches tracing metadata, and injects thinking/reasoning per provider. What the gateway does with the analysis depends on the integrity mode. In **observe** and **nudge** modes, streaming responses (99%+ of traffic) are returned to the client immediately (zero added latency) while AIP analysis runs in the background — extracting thinking blocks, running integrity analysis with Claude Haiku (\~3s), creating cryptographically attested checkpoints (Ed25519 + hash chain + Merkle tree), and — in nudge mode — recording the verdict for carryover into the agent's next turn. Non-streaming responses in these modes are analyzed post-hoc after the response returns. In **enforce** mode the guarantee is stronger: the gateway gates the same turn on both streaming and non-streaming, evaluating the response before it is delivered so a violating response is blocked rather than delivered — on streaming this adds latency. 2. **Observer** — A scheduled Cloudflare Worker (1-minute cron) that processes AI Gateway logs to build AAP-compliant AP-Traces. It extracts thinking blocks from logged responses, analyzes decisions with Claude Haiku, builds AP-Traces, and verifies them against alignment cards using the AAP SDK. The observer links its traces to gateway-created AIP checkpoints via `linkCheckpointToTrace()`. AIP integrity analysis is handled entirely by the gateway. 3. **API** — Serves agent data, traces, integrity scores, drift alerts, enforcement status, and a unified conscience timeline. Powers both the CLI and the web dashboard. 4. **CLI** — The `mnemom` command. Configures your local environment and queries your agent's transparency data. See the [CLI Reference](/gateway/cli) for details. 5. **Dashboard** — Web UI at [mnemom.ai](https://mnemom.ai) where you can view the conscience timeline, claim your agent, and monitor alignment. ## Supported providers | Provider | Models | Thinking/AIP | Auth | | --------- | ------------------------------------- | ----------------------- | ----------------------- | | Anthropic | Claude Opus 4.6, Opus 4.5, Sonnet 4.5 | Full (thinking blocks) | `x-api-key` | | OpenAI | GPT-5.2, GPT-5.2 Pro, GPT-5 | Via reasoning summaries | `Authorization: Bearer` | | Gemini | Gemini 2.5 Pro, Gemini 3 Pro | Full (thought parts) | `x-goog-api-key` | ## What gets traced Mnemom Gateway builds AP-Traces that record: * **Action** — What the agent did (type, name, category) * **Decision** — What alternatives were considered and why one was selected * **Escalation** — Whether the agent escalated to a human and why * **Verification** — Whether the trace is consistent with the agent's declared alignment card * **Integrity** — Per-turn AIP analysis of thinking blocks, with verdict (clear/review\_needed/boundary\_violation) * **Policy** — [Policy evaluation](/concepts/policy-engine) results including verdict (pass/warn/fail), violations, warnings, and coverage report. The `X-Policy-Verdict` response header indicates the result. ### What is NOT stored Your prompts, responses, and API keys are never stored. Only SHA-256 hashes of API keys are used for agent identification. ## AIP compatibility matrix | Provider/Model | AIP Support | Method | | ----------------------------------------- | ------------ | ---------------------------------------- | | Anthropic reasoning models (Opus, Sonnet) | Full | Thinking blocks analyzed directly | | OpenAI GPT-5 Thinking series | Partial | Reasoning summaries (reduced confidence) | | Gemini 2.5/3 with thinking | Full | Thought parts analyzed directly | | Non-reasoning models | Tracing only | Synthetic clear verdict | | Legacy OpenAI (o3/o4-mini) | Unsupported | Reasoning encrypted | ## Claiming your agent After you run `mnemom login` and route your first request through the gateway, your agent is registered automatically. To link it to your Mnemom account: 1. Run `mnemom status` to get your agent ID 2. Go to [mnemom.ai/claim](https://mnemom.ai/claim) 3. Paste your agent ID and prove ownership with your API key hash Claiming gives you a private dashboard with full trace history, integrity scores, and drift detection. ## Current limitations * **API key auth only** — Agent identification uses API key hashing (SHA-256, works identically across all providers). OAuth and other auth methods are not supported. * **Multi-agent support** — Multiple named agents can share a single API key with distinct identities using the `x-mnemom-agent` header. See the [Multi-Agent Setup](/guides/multi-agent-setup) guide and the [Agent CRUD API](/api-reference/endpoint/post-agents) for programmatic registration. * **AIP requires reasoning models** — AIP integrity checking requires models with exposed thinking (Anthropic, Gemini, GPT-5 Thinking). Models without thinking get synthetic clear verdicts. * **Hosted gateway** — The default gateway runs on Mnemom infrastructure. Self-hosting is possible but requires manual setup. ## Dependencies * [Agent Alignment Protocol (AAP)](/protocols/aap/specification) — `@mnemom/agent-alignment-protocol@0.1.8` on npm * [Agent Integrity Protocol (AIP)](/protocols/aip/specification) — `@mnemom/agent-integrity-protocol@0.1.4` on npm * [Cloudflare Workers](https://workers.cloudflare.com/) — Gateway, observer, and API hosting * [Cloudflare AI Gateway](https://developers.cloudflare.com/ai-gateway/) — Request logging and analytics * [Supabase](https://supabase.com/) — Postgres database with row-level security * API keys: Anthropic (required for AIP analysis), OpenAI and Gemini (optional, for multi-provider tracing) ## Next steps Learn about all CLI commands and usage Configure how the gateway responds to violations Export traces to your observability platform via OpenTelemetry Map AAP/AIP to EU AI Act Article 50 obligations