From Audit Log to AI Governance Platform. How Chron Is Closing the Gap

The Problem Nobody Talked About

When teams started adopting AI coding tools — Claude, Cursor, Codex, GitHub Copilot, they got productivity. What they didn't get was visibility.

No one could answer: What did the AI actually do? What prompts were sent? What code was changed? Were any secrets exposed?

For developers, this didn't matter much. For a CISO or a compliance officer trying to prepare a SOC 2 audit or respond to an incident? It was a blindspot the size of a barn door.

That's the gap Chron was built to close.

What Chron Does

Chron is an MCP server that sits alongside your AI tool and creates a tamper-evident, locally-stored audit trail of every session.

Every message, every tool call, every code change — logged to a SQLite database on your machine. No cloud. No vendor. Your data stays with you.

npm install -g chron-mcp

Once installed, it plugs into Claude, Cursor, Windsurf, Codex, or any MCP-compatible tool and starts recording immediately.

Maturing Into AI Actions Recording

Chron started as a session logger. It's now becoming something more: a full AI actions recorder.

What that means in practice:

Message logging — every user prompt and AI response, timestamped and hashed
Tool call recording — when the AI reads a file, runs a command, or calls an API, it's logged
Code change tracking — diffs of what was written or modified
Secret detection (DLP) — Luhn, IBAN, API keys, email, phone, internal IPs detected in real time before they leave your terminal
Ed25519 signing — each session gets a cryptographic keypair; the log is tamper-evident by construction
NTP clock attestation — timestamps are anchored to a real time source, not the local clock alone

The result: a chain of custody for every AI interaction in your organisation.

Making CISOs and Teams Aware

The honest reality is: most developers don't think about audit trails. They shouldn't have to.

But when something goes wrong — a leaked credential, an unexpected code change, a compliance question from a regulator — the CISO needs answers fast.

Chron's report command generates evidence packages mapped to frameworks:

# SOC 2 evidence package
chron report --format=soc2

# Activity summary
chron report --since=30d

The SOC 2 report maps Chron's controls to CC6, CC7, and CC8 — the access, change management, and risk mitigation criteria auditors look for. ISO 27001, ISO 42001, EU AI Act, and NIST AI RMF mappings are also included.

SIEM integrations mean the logs can flow to Splunk, CrowdStrike LogScale, or Azure Sentinel, so the security team sees AI activity alongside everything else.

What's Still on the Roadmap

We're not done. The direction is clear: move from individual developer tool to organisational AI auditor platform.

What's coming:

Centralised org dashboard — a CIO/CISO-facing view across all team members' AI activity
Centralised database mode — teams push audit logs to a shared store, not just local SQLite
Policy enforcement integration — tie into CLAIIM, our companion governance layer, for approval tokens and human-in-the-loop gates
Anomaly alerting — flag unusual patterns: after-hours sessions, mass file reads, credential-adjacent prompts
Audit report scheduler — automated weekly/monthly evidence packages for compliance teams

The goal: the moment a regulator or external auditor asks "show me what your AI tools did last quarter," you hit one command and hand them a signed, timestamped, tamper-evident package.

Where We Are

Chron has crossed 8,000 downloads — organic, without a launch campaign. The teams installing it are doing so because they recognise the gap.

Big compliance platforms are now moving in the same direction. We shipped months ahead of them. And the local-first, data-sovereignty-first architecture is something a SaaS compliance cloud simply can't match for regulated industries.

If you're running AI tools in your organisation and don't yet have an audit trail — Chron is the fastest way to get one.