Connected tools & data

Agents are far more useful when they can reach the right tools and data — an internal documentation source, an issue tracker, a knowledge base. Chronos lets agents use these safely, and its most important guarantee is simple:

Your credentials are never exposed to the agent.

How it works

Connected tools reach a session as governed MCP connections. Which ones exist is decided centrally: the enterprise panel publishes a signed catalog of authorized connections, cascaded globally and per team. A catalog whose signature doesn’t verify is rejected outright — and connections can’t be added locally, so nothing outside the catalog ever reaches a session.

At runtime, the agent never talks to a real endpoint. Every connection goes through the Chronos broker, a local proxy: the agent only ever sees a 127.0.0.1 address plus a per-session token, while the broker injects the real credential and forwards the call upstream. The secret never passes through the agent’s hands, its prompts, or its output — and it is never written into your project or your logs.

The guarantees

• Approved connections only. Agents can use only the tools and data sources your organization has approved — nothing else, and nothing added locally.
• Credentials stay protected. Secrets are held securely by Chronos, never given to the agent, never written into your repository, and never shown in logs.
• Everything is recorded. The audit trail notes which tool was used — never the secret behind it.

Included by default

Chronos seeds four builtin connections. Like any catalog entry, an administrator can scope or revoke them from the panel.

• Playwright browser. A real browser the agent can drive to verify web changes. Chronos runs it for the session — headless, isolated, and restricted to the session’s own dev server — so the agent can click through what it just built without gaining a general browsing capability. It uses the system’s Chrome when installed, with a one-time managed download as fallback.
• GitMCP docs. Up-to-date library and framework documentation, served from https://gitmcp.io/docs so agents work against current APIs instead of stale training data. Administrators can repoint it at a self-hosted instance.
• Figma. Reads a Figma design — layout, styles, components and exportable assets — so agents can implement real designs instead of guessing at them. It activates once an administrator sets the company’s Figma access token in the panel (“set token” on the entry); until then it stays dormant. Chronos runs the server per session and keys it itself — the token, like every credential, never reaches the agent. It also powers the Replicar diseño de Figma workflow in the palette, which turns a Figma URL into an implemented screen or component with optional visual verification.
• Skills. Serves the governed skills index and fetches skill bodies on demand — the retrieval half of progressive disclosure. See Memory & retrieval.

All four are reached through the same local broker connection — the agent never talks to anything but Chronos.

Why this matters

Connecting AI agents to real systems is exactly where things go wrong if credentials leak. Chronos is designed so that simply can’t happen: the agent gets the capability without ever getting the secret. You extend what agents can do while keeping your sensitive access firmly under your organization’s control.

One issue tracker connector — Jira or Linear — also powers Execute issue, which starts a session straight from a ticket. See Issue trackers (Jira & Linear).

Next: Context & knowledge.