# We crossed 6,000 downloads. Here's what we shipped to get there. > Source: > Published: 2026-08-03 09:39:55+00:00 [Tuesday morning. Your SOC 2 auditor emails you.](https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fap2blzp2unap9fz5gmd9.png) "Can you provide evidence of human review for all AI-assisted code changes in the last 90 days — which files were modified, what prompts were used, and whether any credentials were visible in context?" You open your IDE. Git log? Commits are there. PR history? Reviews too. But the AI session itself — the conversation, the code it proposed, whether it saw your `.env` file, which compliance controls it touched — gone. That gap is why I built Chron. Chron is an MCP server that runs alongside your AI coding tool. Every message, every code change, every detected secret — locally timestamped, hash-chained, and stored in a SQLite database you own. No cloud. No data sharing. Works offline. ``` # Install once npm install -g chron-mcp # Check setup chron doctor ``` Works with Claude Code, Cursor, Windsurf, Continue.dev — any MCP-compatible tool. ``` bash $ chron risk --since=30d SESSION SCORE BAND SIGNALS a1b2c3d4 87 critical secrets·auth·infra e5f6g7h8 52 high auth·findings(2) i9j0k1l2 28 review code_changes ``` The attention score: deterministic 0–100 per session. No ML, no API calls. Pure signal from what actually happened: secrets detected (+25), auth code changed (+15), infra modified (+12), open compliance findings (+8 each). A security lead can triage 90 days of AI sessions in under a minute. ``` bash $ chron dashboard --since=30d --output=q3-audit.html ✓ Written: q3-audit.html 8 sessions · 4 open findings · 1 critical · 2 high Coverage: 6 controls covered · 3 needs evidence ``` Five sections in a single static HTML file — no server, no login, no port: executive summary, sessions ranked by risk score, findings grouped by framework (SOC 2 / ISO 27001 / EU AI Act / NIST AI RMF), a control coverage map, and contextual next actions. Open in a browser. Print to PDF. Attach to the audit package. ``` bash $ chron dashboard --session=a1b2c3d4 ✓ Written: chron-session-a1b2c3d.html Score: 87/100 (critical) · 3 findings · tamper: ✓ ok ``` The session detail report: attention score breakdown, full timeline with code diffs, secrets with masked values, compliance finding cards with pre-built accept/dismiss CLI commands, which controls the session touches, and a tamper evidence bar (hash chain + NTP clock + Ed25519 signature). An auditor can open one file and understand what happened, why it matters, which policies it touched, and what action remains — without accessing any internal system. ``` bash $ chron patterns --since=30d Chron Patterns last 30d · 8 sessions ●●●● HIGH Repeated auth/access-control code modified 4 sessions touched these paths · auth, login, rbac, permission… Sessions: a1b2c3d4 e5f6g7h8 +2 more ●●●○ MEDIUM Recurring SOC 2 finding unresolved soc2.cc6_1.ai_access_control_change in 2 sessions ●●●○ MEDIUM Findings unresolved for 28+ days 3 open findings across 2 sessions 4 patterns detected 2 high 2 medium ``` Six pattern types: repeated secret exposure, repeated code-signal category changes (auth, infra, AI governance, monitoring), recurring unresolved findings, high-attention recurring sessions, stale findings (configurable: `--stale=21` ). `--json` outputs `{ patterns, session_count }` — already shaped for SIEM ingestion in the next release. Pattern IDs are stable keys (`repeated_auth_access_control_code_modified` , `recurring_finding:soc2.cc6_1.*` ) so SIEM rules can match without parsing titles. **One-off findings are noise. Patterns are risk.** This command tells you which is which. We crossed **6,000 downloads** this week. As of publishing: **6,139**. No fundraise. No acquisition. No VC backing. Just a CLI that answers a question nobody had an answer for, installed by 6,000+ developers who needed an audit trail for their AI coding sessions. `pattern_detected` , `high_attention_session` , `attention_score_computed` events into your pipeline`chron evidence import` to link policy documents to coverage gaps ``` npm install -g chron-mcp chron doctor # After a few AI sessions: chron risk chron patterns --since=30d chron dashboard --output=report.html ```