chron-mcp 0.1.14 → 0.1.17

package/dashboards/splunk/README.md

@@ -0,0 +1,138 @@
+# Chron → Splunk
+
+Stream AI session telemetry from developer machines into Splunk via HTTP Event Collector (HEC). Works with Splunk Enterprise, Splunk Cloud, and a local Docker instance for testing.
+
+## Quickest way to see it working — Splunk Docker
+
+The fastest path to visually verify the integration with no accounts or licenses:
+
+```bash
+docker run -d \
+  --name splunk-chron \
+  --platform linux/amd64 \
+  -p 8000:8000 \
+  -p 8088:8088 \
+  -e SPLUNK_START_ARGS=--accept-license \
+  -e SPLUNK_PASSWORD=Admin1234! \
+  -e SPLUNK_HEC_TOKEN=chron-test-token \
+  splunk/splunk:latest
+```
+
+> **Apple Silicon (M1/M2/M3):** The `--platform linux/amd64` flag is required — the Splunk image has no ARM64 manifest. Docker Desktop uses Rosetta 2 to emulate it automatically.
+
+Wait ~2 minutes for Splunk to start, then:
+
+```bash
+chron connect splunk
+# URL:   https://localhost:8088   ← HTTPS (Splunk 9.x uses SSL by default)
+# Token: chron-test-token
+```
+
+> Certificate verification is automatically skipped for localhost URLs — no extra flags needed.
+
+Add to your MCP config and use your AI tool. Open [http://localhost:8000](http://localhost:8000) (admin / Admin1234!) and search:
+
+```
+sourcetype="chron:event"
+```
+
+Events appear in real time as you have AI conversations.
+
+> Note: The default Docker image auto-creates a HEC token with the value you set in `SPLUNK_HEC_TOKEN`. If events aren't arriving, verify HEC is enabled under **Settings → Data Inputs → HTTP Event Collector**.
+
+---
+
+## Production setup — Splunk Enterprise or Cloud
+
+### Step 1 — Enable HTTP Event Collector
+
+**Splunk Enterprise:** Settings → Data Inputs → HTTP Event Collector → Global Settings → Enable
+
+**Splunk Cloud:** Settings → Data Inputs → HTTP Event Collector → New Token
+
+### Step 2 — Create a HEC token
+
+1. Settings → Data Inputs → HTTP Event Collector → New Token
+2. Name: `chron-ingest`
+3. Source type: `chron:event` (create new if prompted)
+4. Index: `main` (or a dedicated `chron` index)
+5. Copy the token value
+
+### Step 3 — Connect from the developer machine
+
+```bash
+chron connect splunk
+```
+
+Enter the HEC base URL and token when prompted. The command sends a test event and confirms before saving.
+
+### Step 4 — Add env vars to your MCP client
+
+The `connect` command prints the exact block to paste. For Claude Code, add to the `chron` entry in `~/.claude.json`:
+
+```json
+{
+  "mcpServers": {
+    "chron": {
+      "type": "stdio",
+      "command": "node",
+      "args": ["/path/to/dist/index.js"],
+      "env": {
+        "CHRON_SPLUNK_URL": "https://your-splunk-host:8088",
+        "CHRON_SPLUNK_TOKEN": "<your-hec-token>"
+      }
+    }
+  }
+}
+```
+
+### Step 5 — Run SPL queries
+
+In Splunk → Search & Reporting, run queries from this directory:
+
+| File | Use |
+|---|---|
+| `events-by-type.spl` | Time-series — event volume by type |
+| `sessions-by-developer.spl` | Table — sessions per host and AI tool |
+| `secrets-detected.spl` | Table — credential exposures for SOC review |
+| `ai-tool-usage.spl` | Summary — tool adoption breakdown |
+| `daily-active-developers.spl` | Time-series — distinct active machines per day |
+| `secrets-alert.spl` | Alert search — credential exposures (last 1h) |
+
+### Step 6 — Set up the credential alert (recommended)
+
+1. Search & Reporting → paste `secrets-alert.spl` → Save As → Alert
+2. Schedule: Run every hour
+3. Trigger: Number of results is greater than 0
+4. Action: Send email or create a notable event
+
+---
+
+## Event schema
+
+All events arrive with `sourcetype=chron:event` and these fields:
+
+| Field | Present on |
+|---|---|
+| `host` | All events: developer's machine hostname |
+| `source` | All events: `chron-mcp` |
+| `event_type` | All: `session_started`, `message_logged`, `secret_detected` |
+| `session_id_prefix` | All events |
+| `ai_tool` | All events: `claude`, `cursor`, `windsurf`, etc. |
+| `os` | All events: `darwin`, `linux`, `win32` |
+| `chron_version` | All events |
+| `role` | `message_logged` only: `user` or `assistant` |
+| `detection_type` | `secret_detected` only: `api_key`, `aws_key`, `jwt`, etc. |
+| `masked_value` | `secret_detected` only: e.g. `AKIA****F3K2` |
+
+**What is never transmitted:** message content, actual secret values, file paths, or any user-typed text.
+
+## Env vars
+
+| Env var | Description |
+|---|---|
+| `CHRON_SPLUNK_URL` | Splunk HEC base URL, e.g. `https://localhost:8088` or `https://your-host:8088` |
+| `CHRON_SPLUNK_TOKEN` | HEC ingest token |
+| `CHRON_SPLUNK_INSECURE` | Set to `1` to skip TLS certificate verification (local Docker with self-signed cert) |
+
+`CHRON_SPLUNK_URL` and `CHRON_SPLUNK_TOKEN` must both be set for events to flow. If unset, the integration is silently disabled.

package/dashboards/splunk/ai-tool-usage.spl

@@ -0,0 +1,3 @@
+sourcetype="chron:event" event_type="session_started" earliest=-30d
+| stats count AS Sessions BY ai_tool
+| sort -Sessions

package/dashboards/splunk/daily-active-developers.spl

@@ -0,0 +1,2 @@
+sourcetype="chron:event" event_type="session_started" earliest=-30d
+| timechart span=1d dc(host) AS ActiveDevelopers

package/dashboards/splunk/events-by-type.spl

@@ -0,0 +1,2 @@
+| tstats count WHERE index=* sourcetype="chron:event" BY event_type _time span=1d
+| timechart span=1d count BY event_type

package/dashboards/splunk/secrets-alert.spl

@@ -0,0 +1,3 @@
+sourcetype="chron:event" event_type="secret_detected" earliest=-1h
+| where detection_type IN ("api_key","aws_key","gcp_key","azure_key","private_key","jwt")
+| table _time, host, ai_tool, detection_type, masked_value, session_id_prefix

package/dashboards/splunk/secrets-detected.spl

@@ -0,0 +1,4 @@
+sourcetype="chron:event" event_type="secret_detected" earliest=-30d
+| where detection_type IN ("api_key","aws_key","gcp_key","azure_key","private_key","jwt")
+| table _time, host, ai_tool, detection_type, masked_value, session_id_prefix
+| sort -_time

package/dashboards/splunk/sessions-by-developer.spl

@@ -0,0 +1,3 @@
+sourcetype="chron:event" event_type="session_started" earliest=-30d
+| stats count AS Sessions BY host, ai_tool
+| sort -Sessions

package/dist/cli/index.js

@@ -17031,7 +17031,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "chron-mcp",
-      version: "0.1.14",
+      version: "0.1.17",
       mcpName: "io.github.sirinivask/chron",
       description: "Audit-grade timestamped logs for every AI conversation",
       repository: {
@@ -17122,6 +17122,24 @@ function saveConfig(data) {
   (0, import_fs2.mkdirSync)(dir, { recursive: true });
   (0, import_fs2.writeFileSync)(configPath(), JSON.stringify(data, null, 2), "utf8");
 }
+function patchClaudeJson(vars) {
+  const path = (0, import_path3.join)((0, import_os3.homedir)(), ".claude.json");
+  if (!(0, import_fs2.existsSync)(path))
+    return false;
+  try {
+    const raw = (0, import_fs2.readFileSync)(path, "utf8");
+    const doc = JSON.parse(raw);
+    const servers = doc.mcpServers ?? {};
+    const chron = servers.chron ?? {};
+    chron.env = { ...chron.env ?? {}, ...vars };
+    servers.chron = chron;
+    doc.mcpServers = servers;
+    (0, import_fs2.writeFileSync)(path, JSON.stringify(doc, null, 2), "utf8");
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function connectCrowdStrike() {
   process.stdout.write(`
 ${BOLD5}Connect Chron \u2192 CrowdStrike LogScale${RESET5}
@@ -17230,6 +17248,276 @@ ${DIM4}Sending test event...${RESET5} `);
 `);
   process.stdout.write(`${DIM4}Connection saved to ~/.chron/config.json${RESET5}
 
+`);
+}
+function isLocalhost(url) {
+  return url.includes("localhost") || url.includes("127.0.0.1") || url.includes("::1");
+}
+async function connectSplunk() {
+  process.stdout.write(`
+${BOLD5}Connect Chron \u2192 Splunk${RESET5}
+
+`);
+  process.stdout.write(`${DIM4}Chron will send session telemetry to your Splunk instance via HTTP Event
+`);
+  process.stdout.write(`Collector (HEC). Message content is never transmitted.${RESET5}
+
+`);
+  process.stdout.write(`${DIM4}Works with Splunk Enterprise, Splunk Cloud, and local Docker instances.
+`);
+  process.stdout.write(`See dashboards/splunk/README.md for setup steps.${RESET5}
+
+`);
+  process.stdout.write(`${DIM4}Note: Splunk 9.x Docker uses HTTPS on port 8088 with a self-signed cert.
+`);
+  process.stdout.write(`Use https://localhost:8088 \u2014 certificate verification is skipped for localhost.${RESET5}
+
+`);
+  const rl = (0, import_readline.createInterface)({ input: process.stdin, output: process.stdout });
+  let url, token;
+  try {
+    url = (await prompt(rl, `  Splunk HEC base URL  ${DIM4}(e.g. https://localhost:8088 or https://your.splunkcloud.com:8088)${RESET5}
+  ${CYAN4}>${RESET5} `)).trim();
+    token = (await prompt(rl, `
+  HEC token
+  ${CYAN4}>${RESET5} `)).trim();
+  } finally {
+    rl.close();
+  }
+  if (!url.startsWith("http")) {
+    process.stdout.write(`
+${RED}URL must start with http:// or https://${RESET5}
+`);
+    process.exit(1);
+  }
+  if (!token) {
+    process.stdout.write(`
+${RED}HEC token cannot be empty${RESET5}
+`);
+    process.exit(1);
+  }
+  if (isLocalhost(url)) {
+    process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+  }
+  process.stdout.write(`
+${DIM4}Sending test event...${RESET5} `);
+  const hecUrl = `${url.replace(/\/$/, "")}/services/collector/event`;
+  const testPayload = JSON.stringify({
+    time: Date.now() / 1e3,
+    host: require("os").hostname(),
+    source: "chron-mcp",
+    sourcetype: "chron:event",
+    event: {
+      event_type: "connection_test",
+      chron_version: require_package().version,
+      os: process.platform,
+      message: "chron connect splunk \u2014 test event"
+    }
+  });
+  try {
+    const res = await fetch(hecUrl, {
+      method: "POST",
+      headers: {
+        "Authorization": `Splunk ${token}`,
+        "Content-Type": "application/json"
+      },
+      body: testPayload
+    });
+    if (!res.ok) {
+      const err = await res.text();
+      process.stdout.write(`${RED}failed (HTTP ${res.status})${RESET5}
+`);
+      process.stderr.write(`  ${RED}${err}${RESET5}
+
+`);
+      process.exit(1);
+    }
+    process.stdout.write(`${GREEN}OK${RESET5}
+
+`);
+  } catch (e) {
+    process.stdout.write(`${RED}failed${RESET5}
+`);
+    process.stderr.write(`  ${RED}Error: ${e.message}${RESET5}
+
+`);
+    process.exit(1);
+  }
+  const config = loadConfig();
+  config.splunk = { url, token, insecure: isLocalhost(url), connected_at: (/* @__PURE__ */ new Date()).toISOString() };
+  saveConfig(config);
+  const splunkVars = { CHRON_SPLUNK_URL: url, CHRON_SPLUNK_TOKEN: token };
+  if (isLocalhost(url))
+    splunkVars.CHRON_SPLUNK_INSECURE = "1";
+  patchClaudeJson(splunkVars);
+  process.stdout.write(`${GREEN}${BOLD5}Connected!${RESET5} Splunk is receiving chron events.
+
+`);
+  process.stdout.write(`${DIM4}Config saved to ~/.chron/config.json \u2014 events will flow immediately in all running sessions.${RESET5}
+
+`);
+}
+async function connectSentinel() {
+  process.stdout.write(`
+${BOLD5}Connect Chron \u2192 Microsoft Sentinel${RESET5}
+
+`);
+  process.stdout.write(`${DIM4}Chron will send session telemetry to your Sentinel workspace via the
+`);
+  process.stdout.write(`Azure Monitor Logs Ingestion API. Message content is never transmitted.${RESET5}
+
+`);
+  process.stdout.write(`${DIM4}Prerequisites: Azure App Registration, Data Collection Endpoint (DCE),
+`);
+  process.stdout.write(`and a Data Collection Rule (DCR) pointing to a ChronEvents_CL custom table.
+`);
+  process.stdout.write(`See dashboards/sentinel/README.md for full setup steps.${RESET5}
+
+`);
+  const rl = (0, import_readline.createInterface)({ input: process.stdin, output: process.stdout });
+  let tenantId, clientId, clientSecret, dce, dcrId, stream;
+  try {
+    tenantId = (await prompt(rl, `  Azure Tenant ID  ${DIM4}(xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)${RESET5}
+  ${CYAN4}>${RESET5} `)).trim();
+    clientId = (await prompt(rl, `
+  App Registration Client ID
+  ${CYAN4}>${RESET5} `)).trim();
+    clientSecret = (await prompt(rl, `
+  Client Secret
+  ${CYAN4}>${RESET5} `)).trim();
+    dce = (await prompt(rl, `
+  Data Collection Endpoint URL  ${DIM4}(https://...)${RESET5}
+  ${CYAN4}>${RESET5} `)).trim();
+    dcrId = (await prompt(rl, `
+  DCR Immutable ID  ${DIM4}(dcr-xxxx)${RESET5}
+  ${CYAN4}>${RESET5} `)).trim();
+    stream = (await prompt(rl, `
+  Stream name  ${DIM4}(press Enter for Custom-ChronEvents_CL)${RESET5}
+  ${CYAN4}>${RESET5} `)).trim() || "Custom-ChronEvents_CL";
+  } finally {
+    rl.close();
+  }
+  if (!tenantId || !clientId || !clientSecret) {
+    process.stdout.write(`
+${RED}Tenant ID, Client ID, and Client Secret are all required.${RESET5}
+`);
+    process.exit(1);
+  }
+  if (!dce.startsWith("https://")) {
+    process.stdout.write(`
+${RED}DCE URL must start with https://${RESET5}
+`);
+    process.exit(1);
+  }
+  if (dcrId && !dcrId.startsWith("dcr-")) {
+    process.stdout.write(`
+${YELLOW3}Warning: DCR Immutable ID usually starts with "dcr-"${RESET5}
+`);
+  }
+  process.stdout.write(`
+${DIM4}Authenticating with Azure AD...${RESET5} `);
+  let accessToken;
+  try {
+    const tokenRes = await fetch(`https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "client_credentials",
+        client_id: clientId,
+        client_secret: clientSecret,
+        scope: "https://monitor.azure.com/.default"
+      }).toString()
+    });
+    if (!tokenRes.ok) {
+      const err = await tokenRes.text();
+      process.stdout.write(`${RED}failed (HTTP ${tokenRes.status})${RESET5}
+`);
+      process.stderr.write(`  ${RED}${err}${RESET5}
+
+`);
+      process.exit(1);
+    }
+    const tokenData = await tokenRes.json();
+    accessToken = tokenData.access_token;
+    process.stdout.write(`${GREEN}OK${RESET5}
+`);
+  } catch (e) {
+    process.stdout.write(`${RED}failed${RESET5}
+`);
+    process.stderr.write(`  ${RED}Error: ${e.message}${RESET5}
+
+`);
+    process.exit(1);
+  }
+  process.stdout.write(`${DIM4}Sending test event...${RESET5} `);
+  const ingestUrl = `${dce}/dataCollectionRules/${dcrId}/streams/${stream}?api-version=2023-01-01`;
+  const testRecord = {
+    TimeGenerated: (/* @__PURE__ */ new Date()).toISOString(),
+    EventType: "connection_test",
+    SessionIdPrefix: "test",
+    AiTool: "",
+    OS: process.platform,
+    ChronVersion: require_package().version,
+    Computer: require("os").hostname(),
+    Role: "",
+    DetectionType: "",
+    MaskedValue: ""
+  };
+  try {
+    const res = await fetch(ingestUrl, {
+      method: "POST",
+      headers: {
+        "Authorization": `Bearer ${accessToken}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify([testRecord])
+    });
+    if (!res.ok) {
+      const err = await res.text();
+      process.stdout.write(`${RED}failed (HTTP ${res.status})${RESET5}
+`);
+      process.stderr.write(`  ${RED}${err}${RESET5}
+
+`);
+      process.exit(1);
+    }
+    process.stdout.write(`${GREEN}OK${RESET5}
+
+`);
+  } catch (e) {
+    process.stdout.write(`${RED}failed${RESET5}
+`);
+    process.stderr.write(`  ${RED}Error: ${e.message}${RESET5}
+
+`);
+    process.exit(1);
+  }
+  const config = loadConfig();
+  config.sentinel = { dce, dcrId, stream, tenantId, clientId, connected_at: (/* @__PURE__ */ new Date()).toISOString() };
+  saveConfig(config);
+  process.stdout.write(`${GREEN}${BOLD5}Connected!${RESET5} Test event sent to Sentinel workspace.
+
+`);
+  process.stdout.write(`${BOLD5}Add these env vars to your MCP client config:${RESET5}
+
+`);
+  process.stdout.write(`  ${CYAN4}CHRON_SENTINEL_TENANT_ID${RESET5}     ${tenantId}
+`);
+  process.stdout.write(`  ${CYAN4}CHRON_SENTINEL_CLIENT_ID${RESET5}     ${clientId}
+`);
+  process.stdout.write(`  ${CYAN4}CHRON_SENTINEL_CLIENT_SECRET${RESET5} ${DIM4}<your-client-secret>${RESET5}
+`);
+  process.stdout.write(`  ${CYAN4}CHRON_SENTINEL_DCE${RESET5}           ${dce}
+`);
+  process.stdout.write(`  ${CYAN4}CHRON_SENTINEL_DCR_ID${RESET5}        ${dcrId}
+`);
+  process.stdout.write(`  ${CYAN4}CHRON_SENTINEL_STREAM${RESET5}        ${stream}
+
+`);
+  process.stdout.write(`${DIM4}For Claude Code \u2014 add to the "env" block of the chron entry in ~/.claude.json.
+`);
+  process.stdout.write(`Connection saved to ~/.chron/config.json${RESET5}
+
 `);
 }
 async function runConnect(args2) {
@@ -17238,6 +17526,12 @@ async function runConnect(args2) {
     case "crowdstrike":
       await connectCrowdStrike();
       break;
+    case "sentinel":
+      await connectSentinel();
+      break;
+    case "splunk":
+      await connectSplunk();
+      break;
     default: {
       const name = subcommand ? `Unknown integration: ${subcommand}
 
@@ -17247,13 +17541,15 @@ async function runConnect(args2) {
 
 Integrations:
   crowdstrike    Connect to CrowdStrike LogScale (direct ingest)
+  sentinel       Connect to Microsoft Sentinel (Azure Monitor Logs Ingestion API)
+  splunk         Connect to Splunk via HTTP Event Collector (HEC)
 `
       );
       process.exit(subcommand ? 1 : 0);
     }
   }
 }
-var import_readline, import_os3, import_path3, import_fs2, RESET5, BOLD5, DIM4, CYAN4, GREEN, RED;
+var import_readline, import_os3, import_path3, import_fs2, RESET5, BOLD5, DIM4, CYAN4, GREEN, RED, YELLOW3;
 var init_connect = __esm({
   "src/cli/connect.ts"() {
     "use strict";
@@ -17267,6 +17563,7 @@ var init_connect = __esm({
     CYAN4 = "\x1B[36m";
     GREEN = "\x1B[32m";
     RED = "\x1B[31m";
+    YELLOW3 = "\x1B[33m";
   }
 });
 
@@ -17317,7 +17614,7 @@ Commands:
   export          Export a session as markdown
   secrets         List detected secrets across sessions
   settings        View current configuration
-  connect         Connect to a SIEM integration (crowdstrike)
+  connect         Connect to a SIEM integration (crowdstrike, sentinel, splunk)
 
 Options (history):
   --limit=<n>     Max sessions to show (default: 20)