The
--email and --share analytics options described here need a CLI release that includes the share choices. Check with mnemom scan --help: if the --share line lists full, analytics and none, you have it. Update with npm install -g @mnemom/mnemom@latest.What you need
- Node.js 18 or newer and the CLI:
npm install -g @mnemom/mnemom. The package installs amnemomcommand. - A GitHub login that can read the repos. The scan runs
gh auth tokento get a token, so the GitHub CLI (gh) must be installed and signed in. The scan only reads pull-request metadata. - A Mnemom login as an owner or admin of your org, with Org Scan switched on for that org. Mnemom refuses members who are not owners or admins.
Run it from the command line
Sign in once, then scan:--repo is required and the share choice defaults to none.
Options
Who gets the report
The full report, including the counts for each repo, is emailed to you, to every admin of your org, and to anyone you add with--email. This happens at every share level. The share choice changes only what Mnemom keeps on file.
Choose what Mnemom keeps
After each scan, the CLI prints what Mnemom kept. To have Mnemom delete anything it holds about a scan, email
[email protected].
If Org Scan is not switched on for your org, the CLI prints Report email is not available for this org yet; nothing was sent. If your Mnemom environment is in dry-run mode, it prints Report email is in dry-run on this environment; nothing was sent.
Run it in GitHub Actions
mnemom login cannot run unattended: it opens a browser or asks you to approve a code. A workflow signs in with a Mnemom API key instead, which the CLI reads from MNEMOM_API_KEY.
1
Create an organization API key
An owner or admin of the org creates an organization API key and stores it as the repository secret
MNEMOM_API_KEY. The owner or admin role is checked on every call, so the key must belong to someone who has it. The report email goes to the person who owns the key, as well as the org admins.2
Give the scan a GitHub token
Store a read-only GitHub token as the secret
ORG_SCAN_GITHUB_TOKEN. It must be able to read the repos you list. The workflow’s built-in GITHUB_TOKEN can read only the repository the workflow runs in, so use a fine-grained token with read access to metadata, contents and pull requests for any other repo. The CLI reads the token through gh auth token, which returns the GH_TOKEN environment variable when it is set.3
Add the workflow
Save the file below as
.github/workflows/org-scan.yml, and set your org id and repos.- There is no terminal in a workflow, so the file passes
--repoand--orgexplicitly. It also sets--shareso the choice is yours and not the default. Usefulloranalyticsto let Mnemom keep totals; add--email [email protected]to send the report to more people. - The job fails when the report is refused or cannot be sent. If Org Scan is not on for your org, the CLI prints that nothing was sent and the job still passes, so read the log the first time.
- Pin
actions/setup-nodeto a commit SHA if your organization requires pinned actions. - To read Anthropic usage without a key, add the WIF settings from the next section to the same step.
Read Anthropic usage without a key (WIF)
Org Scan can read your Anthropic usage and cost reports to show measured spend. With workload identity federation (WIF) you do not paste an Admin key. Mnemom issues a short-lived identity token for your org, the CLI exchanges it directly at Anthropic for a short-lived access token, and the CLI uses that token only for the two usage reports. Mnemom never sees the Anthropic token, and nothing in this flow is stored, logged or printed. Your Anthropic Console holds all the trust settings. Mnemom holds no secret of yours.1. Register Mnemom as a federation issuer
In your Anthropic Console’s workload identity federation settings, add an issuer with:2. Create a service account and a federation rule
Create a service account, then a federation rule on the issuer that:- matches the subject
mnemom:org:<org_id>, with your own org id in place of<org_id>(an exact match, or a prefix match with a trailing*). Because the subject names your org, an identity token minted for another org cannot satisfy your rule; - grants the scope
org:admin, which is what Anthropic requires to read the usage and cost reports; - targets the service account you created.
scope = "org-scan", if you want the rule to match on it.
A rule written for the command-line scan does not match tokens that Mnemom issues for its own server-side checks. Those use the subject
mnemom:org-server:<org_id>, so they work only if you add a separate rule for it. Deleting that rule withdraws it at any time.3. Give the CLI the ids
Set these environment variables before the scan. They are ids, not secrets.
With all three required ids set,
mnemom scan tries WIF first and prints Read Anthropic usage through workload identity federation. With none set, WIF is skipped without a message. With only some set, or any malformed, it prints The Anthropic workload identity settings are incomplete or malformed (federation rule, organization and service account ids).
In a workflow, add the variables to the scan step. Store the ids as repository variables:
If WIF does not work
The CLI prints one fixed sentence and carries on, so the scan still runs.Fall back to a pasted key
If WIF is not set up or fails, the scan falls back to an Anthropic Admin key. SetANTHROPIC_ADMIN_KEY in the environment, or pass --anthropic-admin-key on a terminal to be asked for it (masked; never typed on the command line). When WIF fails and a key is set, the CLI prints Falling back to the pasted Anthropic Admin key. The key is kept in memory only and sent only to api.anthropic.com. Passing --anthropic-admin-key skips WIF and uses the key.
If there is no key either, the scan continues without a measured figure: the next choice is your own monthly figure (--monthly-spend), then a modelled range.