We crossed 6,000 downloads. Here's what we shipped to get there.

Chron, an MCP server that logs and audits AI-assisted coding sessions, has surpassed 6,000 downloads. The tool, built by a developer to address compliance gaps such as SOC 2 evidence requirements, records every message, code change, and detected secret locally in a SQLite database, with hash-chaining and tamper evidence. It generates risk scores and audit-ready HTML reports for frameworks like SOC 2 and ISO 27001, and supports MCP-compatible tools including Claude Code, Cursor, and Windsurf.

Tuesday morning. Your SOC 2 auditor emails you. https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fap2blzp2unap9fz5gmd9.png "Can you provide evidence of human review for all AI-assisted code changes in the last 90 days — which files were modified, what prompts were used, and whether any credentials were visible in context?" You open your IDE. Git log? Commits are there. PR history? Reviews too. But the AI session itself — the conversation, the code it proposed, whether it saw your .env file, which compliance controls it touched — gone. That gap is why I built Chron. Chron is an MCP server that runs alongside your AI coding tool. Every message, every code change, every detected secret — locally timestamped, hash-chained, and stored in a SQLite database you own. No cloud. No data sharing. Works offline. Install once npm install -g chron-mcp Check setup chron doctor Works with Claude Code, Cursor, Windsurf, Continue.dev — any MCP-compatible tool. bash $ chron risk --since=30d SESSION SCORE BAND SIGNALS a1b2c3d4 87 critical secrets·auth·infra e5f6g7h8 52 high auth·findings 2 i9j0k1l2 28 review code changes The attention score: deterministic 0–100 per session. No ML, no API calls. Pure signal from what actually happened: secrets detected +25 , auth code changed +15 , infra modified +12 , open compliance findings +8 each . A security lead can triage 90 days of AI sessions in under a minute. bash $ chron dashboard --since=30d --output=q3-audit.html ✓ Written: q3-audit.html 8 sessions · 4 open findings · 1 critical · 2 high Coverage: 6 controls covered · 3 needs evidence Five sections in a single static HTML file — no server, no login, no port: executive summary, sessions ranked by risk score, findings grouped by framework SOC 2 / ISO 27001 / EU AI Act / NIST AI RMF , a control coverage map, and contextual next actions. Open in a browser. Print to PDF. Attach to the audit package. bash $ chron dashboard --session=a1b2c3d4 ✓ Written: chron-session-a1b2c3d.html Score: 87/100 critical · 3 findings · tamper: ✓ ok The session detail report: attention score breakdown, full timeline with code diffs, secrets with masked values, compliance finding cards with pre-built accept/dismiss CLI commands, which controls the session touches, and a tamper evidence bar hash chain + NTP clock + Ed25519 signature . An auditor can open one file and understand what happened, why it matters, which policies it touched, and what action remains — without accessing any internal system. bash $ chron patterns --since=30d Chron Patterns last 30d · 8 sessions ●●●● HIGH Repeated auth/access-control code modified 4 sessions touched these paths · auth, login, rbac, permission… Sessions: a1b2c3d4 e5f6g7h8 +2 more ●●●○ MEDIUM Recurring SOC 2 finding unresolved soc2.cc6 1.ai access control change in 2 sessions ●●●○ MEDIUM Findings unresolved for 28+ days 3 open findings across 2 sessions 4 patterns detected 2 high 2 medium Six pattern types: repeated secret exposure, repeated code-signal category changes auth, infra, AI governance, monitoring , recurring unresolved findings, high-attention recurring sessions, stale findings configurable: --stale=21 . --json outputs { patterns, session count } — already shaped for SIEM ingestion in the next release. Pattern IDs are stable keys repeated auth access control code modified , recurring finding:soc2.cc6 1. so SIEM rules can match without parsing titles. One-off findings are noise. Patterns are risk. This command tells you which is which. We crossed 6,000 downloads this week. As of publishing: 6,139 . No fundraise. No acquisition. No VC backing. Just a CLI that answers a question nobody had an answer for, installed by 6,000+ developers who needed an audit trail for their AI coding sessions. pattern detected , high attention session , attention score computed events into your pipeline chron evidence import to link policy documents to coverage gaps npm install -g chron-mcp chron doctor After a few AI sessions: chron risk chron patterns --since=30d chron dashboard --output=report.html