meok-eu-cra-mcp

io.github.CSOAI-ORGPublished by GitHub account CSOAI-ORGv0.1.2Updated Oct 30, 2026

EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) compliance MCP server. 4 tools, 11 tests. A

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

EU Cyber Resilience Act compliance helper that lets an assistant explain CRA obligations, classify a product, audit pipeline gaps and crosswalk CRA to NIS2.

What you can do
  • Summarize the CRA framework: scope, key dates, penalties, exclusions and how it relates to NIS2, the EU AI Act, GDPR and product liability rules
  • Classify a product from yes/no characteristics into the four CRA obligations, Class I vs Class II criticality, ENISA reporting duties and the 2027 applicability date
  • Audit a product pipeline for gaps such as missing SBOM, security.txt, vulnerability disclosure policy, signed releases, auto-update, threat model or secure SDLC, and flag known-vulnerable SBOM components
  • Generate a hash-chained compliance attestation with certificate ID, signature and verification links
  • Compare CRA and NIS2 side by side across ten requirement areas
When to use it
Useful when you need quick, structured guidance on whether and how the EU Cyber Resilience Act applies to a product with software sold in the EU, or when preparing SBOM, vulnerability-handling and conformity-assessment evidence. It is advisory only, so it suits early scoping and gap checks rather than formal certification.
Requirements
Runs locally as a Python package (pip install, or uvx) over stdio; no authentication or environment variables are declared for the basic tools. The attestation tool requires a MEOK_API_KEY environment variable and network access to the provider's signing endpoint.
Before you install
The attestation tool sends entity, product and contact details to a third-party signing service and needs a MEOK_API_KEY; the free tier is limited to one certificate per day and a paid tier is offered. Output is guidance, not legal advice or an actual conformity assessment, SBOM generation or ENISA filing. Review any attestation before relying on it.

Installation

In SourceWeft

  1. Open meok-eu-cra-mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

meok-eu-cra-mcp

EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) compliance MCP server by MEOK AI Labs.

[MEOK AI Labs] [License: MIT] [PyPI]

The MCP for CRA — the EU Cyber Resilience Act (Reg (EU) 2024/2847). Applies to every product with software sold in the EU, including AI systems, IoT devices, and standalone software.

DateWhat
10 Dec 2024CRA entered into force
11 Sep 2026Vulnerability reporting obligations start (Art 11, Art 14)
11 Dec 2027Full applicability — every product must comply

CRA co-exists with NIS2 (for the organisation operating the product) and EU AI Act (for the AI capabilities of the product). Most regulated entities need to comply with both.

4 obligations covered

ObligationWhatWhy it bites
Art 6 + Annex I — Essential cybersecurity requirementsRisk-based security at design, no known vulns at placement, secure-by-default config, encryption, integrity, DoS resilience, attack surface reduction, security update mechanismEvery product on the EU market. Penalty: €15M or 2.5% of global turnover
Art 10 — Vulnerability handlingIdentify, document, test, fix, disseminate, free, throughout product lifetime or 5 years (shorter)Every product. ENISA 24h reporting for actively exploited vulns starts 11 Sep 2026
Art 13 — Conformity assessmentSelf-assessment (Class I) or Notified Body (Class II) before placing on marketEvery product. Class II is required for the 5 critical categories in Annex III (password managers, identity/auth, VPN, network management, SIEM, PKI issuers)
Annex I §2 — SBOM + secure-by-defaultSoftware Bill of Materials (CycloneDX or SPDX), auto-update enabled, factory-reset procedure for end-of-lifeEvery product. SBOM is the de facto machine-readable compliance evidence

Install

bash
pip install meok-eu-cra-mcpmeok-eu-cra-mcp

Tools (5)

cra_overview()

CRA framework summary: scope, key dates, penalty structure, exclusions (medical devices, motor vehicles, aviation, FOSS-no-commercial), and how it co-exists with NIS2, EU AI Act, GDPR, and the Product Liability Directive 2024/2853.

classify_cra_obligations(places_product_on_eu_market, has_internet_connectivity, handles_personal_data, is_critical_infrastructure, is_iot_or_connected_device, is_ai_system_under_ai_act, is_free_and_open_source_no_commercial, is_medical_device, is_motor_vehicle, is_aviation_product)

Map product characteristics to the 4 CRA obligations + criticality class (Class I self-assessment vs Class II Notified Body) + ENISA reporting requirement + 24h reporting window + 2027-12-11 full applicability date. Exclusions handled first: medical devices, motor vehicles, aviation, FOSS-no-commercial.

audit_cra_pipeline(tenant_id, has_sbom, sbom_format, has_security_txt, has_vulnerability_disclosure_policy, has_signed_releases, has_auto_update_mechanism, has_data_removal_procedure, has_threat_model, has_ssa_or_penetration_test, has_secure_sdlc_documented, sample_sbom_components)

Audit an existing product pipeline for CRA compliance gaps. Checks for missing SBOM, security.txt, VDP, signed releases, auto-update, data-removal procedure, threat model, security testing, Secure SDLC. Also scans sample SBOM components for known-vulnerable packages (log4j 1.x, openssl 1.0.1, etc.) and flags critical if found.

sign_cra_attestation(entity_name, product_name, criticality_class, compliance_score, has_sbom, has_vdp, has_signed_releases, contact_email)

Generate a hash-chained CRA compliance attestation via the canonical meok-attestation-api /sign endpoint. Returns cert_id, signature, verify_url, audit_url, issued_at, expires_at, kid. Requires MEOK_API_KEY env var (free tier: 1 cert/day; Pro tier £199/mo: unlimited).

crosswalk_cra_to_nis2()

Side-by-side CRA ↔ NIS2 crosswalk: 10 rows (scope, effective date, authority, reporting, vulnerability handling, secure-by-default, SBOM, penalty, conformity assessment, pen-test cadence). Practical note: CRA is product-side; NIS2 is org-side. A cloud-hosted AI product is CRA-regulated (as a product) AND the cloud provider is NIS2-regulated (as an essential entity). One assessment, both regimes, different deliverables.

Honest limits

  • No actual SBOM generation: you bring the SBOM (or run Syft/cdxgen first). The MCP tells you the format + standards
  • No ENISA reporting submission: the ENISA single reporting platform is a separate portal (URL TBD by ENISA, available from 11 Sep 2026)
  • No Notified Body contact: Notified Bodies are designated by member states; you need to find one in your category
  • No actual conformity assessment: the MCP tells you the procedure (self-assessment vs Notified Body) and the deliverables (DoC, CE marking, technical documentation per Annex VII)
  • No Cybersecurity Act integration: the MCP doesn't pull from the EU Cybersecurity Act certification database; you bring your own cert

Tests

bash
cd eu-cra-mcppip install mcp httpx pytestpytest tests/test_eu_cra_mcp.py -v

11 tests across all 5 tools + exclusions, no live API required.

Cross-region

  • NIS2 — crosswalk_cra_to_nis2() covers the 10 most divergent requirements
  • EU AI Act — high-risk AI must satisfy both CRA (product cyber) + EU AI Act (AI risk management)
  • GDPR — CRA Art 6(g) data minimisation overlaps with GDPR Art 5(1)(c)
  • Product Liability Directive 2024/2853 — CRA violation is evidence of defect
  • UK — UK Product Security and Telecommunications Infrastructure Act 2022 (PSTI) covers similar ground; UK NCSC is the authority
  • US — no federal equivalent; California SB-327 (IoT security) + NY DFS Part 500 (financial services) are the closest

See also

  • meok-pipl-mcp — China PIPL (data side; this one covers the product side)
  • meok-fda-samd-mcp — US FDA SaMD (healthcare-specific, similar structure)
  • meok-eu-ai-act-mcp — EU AI Act (companion to CRA for AI products)
  • meok-owasp-agentic-mcp — OWASP Agentic Top 10 (security testing patterns)
  • meok-compliance-gateway — 13-framework crosswalk
  • meok-attestation-api — canonical SIGIL signer (Ed25519, kid d4cb0eaa)

License

MIT — MEOK AI Labs, UK Companies House 16939677.

Source: README.md at commit 3d9eeca

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts