Every Claude Code session ends and takes its memory with it. DevLog turns your work into a living history: every feature built, every task opened, every vulnerability closed — on a local dashboard, without you writing a single line of it yourself.
The session ends and the context evaporates with it. You open the project days later and neither you nor Claude remembers where you stopped.
"We'll get back to it later" gets said in one session and forgotten in the next. Nothing holds anyone accountable.
A discovered bug left unfixed, a plan step never finished — and the release went out because nothing stood in its way.
No commands to memorize, no files to write, nothing added to your repo. You work with Claude exactly as you always do.
The protocol reaches Claude automatically at the start of every session, so it closes its work with lines like -(built), -(todo) and -(bug fix) #7.
At the end of every response, DevLog reads the tags and posts them to the local server. Zero noise in your conversation context, zero files in your repo.
Open 127.0.0.1:7777 and watch all your projects: activity, plans, releases, vulnerabilities — moving in real time over WebSocket.
Ordinary trackers record and watch. DevLog enforces discipline on Claude itself — and that's what you won't find anywhere else.
Claude finished work that matches an open task and didn't close it? The response is rejected until it does. Someone tries to ship a release with items still open? The command is intercepted before it runs. Claude tries to install a dependency blind? The command is blocked with the safe version to pin — the newest stable at least 7 days old and clean in OSV. Nothing slips through — not because someone was paying attention, but because the system doesn't allow it.
Every project Claude touches appears automatically: what was built, opened, closed — updating in real time, no refresh.
Plans with phases and checkboxes that persist across sessions: Claude says "step done" and the ☑ flips on your dashboard.
Built-in scanning against the OSV.dev database — no API key, no external service — including transitive dependencies.
npm, crates.io, PyPI, Go and Packagist — compares your versions against the latest official release and flags anything newer than 7 days.
On every release: a report grouping what was built, fixed and security-closed — the version field in your project manifest bumps automatically, and a release that went out wrong can be rolled back.
Each session starts with a compact injected context: what was done before and what's still open — so Claude never reinvents what it built yesterday.
Every edit Claude makes is recorded with its full diff — per file, per session, reviewable from the dashboard.
Reports, analyses and plans written as Markdown and served as styled HTML — without Claude hand-writing a web page.
Every user-visible capability is recorded as one plain-language line, and a polished client report is generated from the inventory whenever you need it.
Claude asks "have we solved this before?" and gets stored decisions and fixes back in the same turn — and a new bug resembling a closed one automatically surfaces its old fix.
"What keeps breaking?" — a retrospective of every bug and vulnerability ever, with ages and files, plus a full-history study saved as a document that measures progress since the last one.
Rules captured from your corrections and pulled on demand by language or app type — so Claude never repeats the same mistake in another project.
All your data stays on your machine. The server listens on 127.0.0.1 only — nothing leaves for the internet.
Bun and Node built-ins only. No supply chain to worry about, no unknown package to audit.
No sign-up, no tracking, no cloud. The only external calls: asking the official registries about vulnerabilities — if you want to.
Built-in defenses against DNS rebinding, XSS and path traversal — covered by 1,300+ automated tests.
/plugin marketplace add fmaaakcode/devlog
/plugin install devlog
That's everything: the hooks, the protocol and the server all ship inside the plugin,
and the server starts on its own with your first session.
Open http://127.0.0.1:7777 and watch your dashboard.
The only requirement: Bun on your machine.
No. Tags are captured straight from Claude's responses, and all data is stored in DevLog's own directory outside your projects. Your repo stays untouched.
The session-start injection is compact and conditional (it only appears when needed), and tag capture adds a fraction of a second at the end of a response — a small price for real enforcement.
No, except in one case: the security-scan button queries the OSV.dev database and the official registries for vulnerabilities and versions. Everything else works offline.
The release guard can be bypassed consciously with an environment variable (DEVLOG_RELEASE_GUARD=0) — the decision stays yours, but nothing ever slips through by accident.