ChronoMCP

┌─ chapter 01 · the problem

AI stopped just talking. It started acting.

You've used an AI chatbot. You ask, it answers. If it gets something wrong, no big deal — it's just text on a screen. Nobody gets hurt.

But AI has evolved. Now there are agents: AIs that don't stop at text — they carry out tasks in the real world. You say "organize my calendar and notify the guests," and the agent actually creates events, actually fires off emails. You say "clean up the system," and it actually deletes things.

To be able to act, the agent uses "tools." Think of a tool as a button the AI can press: a "send email" button, a "delete file" button, a "charge payment" button. There's even an industry standard for this — it's called MCP (Model Context Protocol), the universal way to hand buttons to an AI.

The problem isn't the AI thinking wrong. It's the AI pressing the wrong button — fast, alone, and with no way back.

┌─ chapter 02 · the real pain

The day an AI wiped the production database

This really happened. In 2025, an AI agent that was helping write code got confused and wiped a company's production database — the "real" one, with real customer data, not the test one.

Why? Because to an agent, deleting the test one (staging) and deleting the production one (prod) look almost identical. One wrong name, and that's it: hours (or days) of damage, data that may never come back.

Now imagine that multiplied: thousands of companies putting agents to work on payments, emails, servers. Three uncomfortable truths about agents:

There's a missing layer between "the AI wanted to do it" and "the AI did it." That gap is exactly what ChronoMCP fills.

┌─ chapter 03 · the idea

What ChronoMCP is

Picture a bouncer at a club door. Nobody gets in without going past them. They size up each person, decide who gets in, turn away anyone dangerous — and write it all down in a little notebook.

ChronoMCP is that bouncer, but between the AI and the tools. Every time the agent goes to press a button, the request passes through ChronoMCP first. It sits right in the middle of the wire:

The word "Chrono" comes from time — because one of its tricks is being able to "go back in time" and undo steps when something fails. And it's transparent: to the AI and the tools, it's as if it weren't even there… until the moment it needs to act. It has five core capabilities. Let's take them one by one.

┌─ chapter 04 · capability 1

Reading intent before the action

Before letting any button be pressed, ChronoMCP classifies the risk of that action — like a traffic light. There are three colors:

How does it know the color? In order: first it asks the tool's own author (who can declare "this one is dangerous"); if there's nothing, it uses clues from the name (a button called "delete" or "charge" already lights up red). And here's the golden rule:

┌─ chapter 05 · capability 2

The "are you sure?" screen

You know when an app asks "Are you sure you want to delete? This can't be undone"? ChronoMCP does that for the AI — only much better. It shows an impact summary in plain human language, before anything happens:

┌─ ChronoMCP · proposed action ────────────────
│ ⚠⚠  ENVIRONMENT: PRODUCTION — REAL PRODUCTION  ⚠⚠
├──────────────────────────────────────────────
│ [DANGER] banco-mcp → drop_table
│ arguments:
│   table: customers_prod   ← a human catches this instantly
│ reversible: NO — IRREVERSIBLE effect
└──────────────────────────────────────────────
Approve? [y/N] 

In the blink of an eye, a human reads "customers_prod" and "REAL PRODUCTION," understands this is about to wipe the actual customer table, and types N. Disaster avoided in one second. Notice the giant PRODUCTION highlight: confusing test with production is exactly the mistake that wiped that database in chapter 2 — so this warning is impossible to miss.

┌─ chapter 06 · capability 3

The human in control

You choose how strict the guardian is. There are three modes, from lightest to toughest:

1. Journal mode · log

Blocks nothing, just records everything the AI does. Good for watching and building confidence before tightening the belt.

2. Gatekeeper mode · gate

Every action that changes something stops and asks a human for authorization. Nothing happens without a "yes." It's the middle mode, the most used.

3. Vault mode · block

Dangerous actions are blocked on the spot, without even asking. Maximum protection for critical environments.

This is where ChronoMCP stops being a "developer tool" and becomes a "company tool" — a distinction we'll come back to.

┌─ chapter 07 · capability 4

The time machine (and the honesty)

Here's the heart of the name "Chrono." Imagine an agent running a 5-step task — like processing a product return: (1) create the label, (2) put the item back in stock, (3) notify the customer, (4) refund the card. And on step 4… it fails.

Without a guardian, you're left with a Frankenstein: label created, stock touched, customer told that "the money is on its way back" — except the money did not come back. A nightmare to undo by hand.

ChronoMCP does what in a video game would be loading the last "save": it undoes the steps in reverse (the last one first), automatically, before the AI even knows it failed. It cancels the label, pulls the item back out of stock. This even has an old name in computing: a saga.

But now comes the most important part — and the rarest in a tech product: honesty.

"Compensating" is not "undoing." An email that's already out doesn't come back. A payment that's already settled doesn't un-settle.

ChronoMCP never pretends it undid what it can't. If step 3 were "send an email to the customer," it would tell you straight: "the email has already been delivered — this is irreversible, handle it by hand." That little red dot on the cover is exactly this: the symbol of what has no way back. Most tools promise an "undo" that secretly doesn't undo. Ours promises only what it delivers. That's what builds trust.

┌─ chapter 08 · capability 5

The journal no one can forge

Every action, decision, and result ends up in a record (the "audit log"). So far, nothing new — every system has logs. The trick is: ChronoMCP's is impossible to tamper with without leaving a trace.

It works like a magic journal where each page carries a "seal" computed from the previous page. If someone tries to tear out or rewrite one page in the middle, every seal after it breaks — and anyone notices instantly. It's the technology behind this (called a hash) that gives it this "chain":

Why is this worth gold? Because one day an auditor, a boss, or a regulator will ask: "who authorized this $40,000 payment, and how do I know the record wasn't edited afterward?" With ChronoMCP, the answer is: it's all here, and you can prove no one touched it — without having to take our word for it. The proof is mathematical.

┌─ chapter 09 · the secret

Why it's safe on the inside

Three engineering decisions that look like details, but are what make ChronoMCP trustworthy:

No AI in the "undo"

When ChronoMCP walks the steps back, there's no AI making any decisions — it's all prearranged, mechanical. Why? Because the "undo" moment is exactly where an attacker would try to trick the AI ("hey, while you're at it, delete this too"). With no AI at that point, there's nothing to trick. It's armor against sabotage.

Small part, small surface

The free tool is built without relying on dozens of other third-party libraries. Fewer parts = fewer places to go wrong or for malicious code to slip in. In a product that sells trust, every line fewer is one worry fewer.

Honesty is a rule, not an option

"Never say you can reverse what you can't" isn't a courtesy — it's a hard rule of the product. It's what separates ChronoMCP from a fake "undo."

┌─ chapter 10 · in practice

Real stories

Where this saves the day, concretely:

🛒 The store that nearly issued a phantom refund

A 5-step return, the refund fails at the end. ChronoMCP undoes the label and stock on its own, and flags that the email to the customer already went out (irreversible) — the team sends a "sorry, one more little step" and no one is left quietly out of pocket.

🗑 The server janitor

An agent cleaning up the test environment. A drop table classifies as danger. In vault mode, it's blocked; in gatekeeper mode, the human sees "customers_prod" and says no. The chapter-2 mistake does not happen.

👤 The signup that spans three systems

Create the customer in the CRM, grant access, send a welcome, start billing. Billing fails on step 5 — and ChronoMCP revokes access, removes the record, all in reverse, before the agent sees the error. The systems never end up out of sync.

💳 The finance agent under audit

Payments require 2 different approvers. The first "yes" holds at "1 of 2" — the money only moves with the second. And the auditor checks the journal's chain independently, without trusting the company.

📣 The marketing red button

Update 2,000 contacts and fire off a campaign. The updates can be reversed; the send is irreversible. The policy can require the marketing lead's "yes" just for the send, letting the rest flow. And the summary shows the segment and the count before the button even exists.

🧱 The database migration with an undo that works

A 6-step migration, step 5 breaks. Each step declared its inverse, so the guardian walks it back, undoing — no all-nighter of manual archaeology, and no AI improvising in the middle.

┌─ chapter 11 · the business

Two editions — open and managed

The model is called open-core: the base is free and open — anyone can use it, audit it, and trust it. On top of it, a managed layer serves teams and companies with what a serious operation needs beyond the essentials. Open base on principle; managed layer for anyone operating at scale.

┌─ chapter 12 · the market

Who buys, and why now

Why now: the world is putting AI agents to work at an absurd pace. Everyone's racing to give AI more power. Almost no one is building the brake. That's the gap — and the moment. Agent governance is the next obvious wave, the same way antivirus became mandatory once everyone got on the internet.

Who buys: any company that lets an AI touch something that hurts if it goes wrong.

Notice the angle: the question is never "the AI is smarter." It's "the AI is going to act in your system either way — so have a seatbelt". Avoiding a disaster weighs far more than gaining a novelty.

┌─ chapter 13 · the vision

How far this goes

ChronoMCP starts as a brake. But that same spot — right in the middle between the AI and the world — is one of the most valuable places there is. Whoever sits in that middle can become:

While everyone builds more powerful AIs, we build the place where those AIs are held accountable.

┌─ appendix · glossary

Plain-talk dictionary