meok-eu-cra-mcp

io.github.CSOAI-ORG由 GitHub 账号 CSOAI-ORG 发布v0.1.2更新于 Oct 30, 2026

EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) compliance MCP server. 4 tools, 11 tests. A

已验证STDIO仅桌面开发者工具安全与监控

概览

AI 生成的概览

欧盟《网络韧性法案》合规辅助服务器，让助手解读 CRA 义务、判定产品分类、审计流水线缺口并对照 NIS2。

可以做什么
  • 概述 CRA 框架：适用范围、关键日期、罚则、排除项，以及与 NIS2、欧盟 AI 法案、GDPR 和产品责任规则的关系
  • 根据一组是/否特征把产品映射到四项 CRA 义务、Class I 自评或 Class II 公告机构、ENISA 报告要求及 2027 年全面适用日期
  • 审计产品流水线缺口，如缺少 SBOM、security.txt、漏洞披露政策、签名发布、自动更新、威胁模型或安全开发生命周期，并标记 SBOM 中的已知易受攻击组件
  • 生成带哈希链的合规证明，返回证书编号、签名与验证链接
  • 按十个要求领域并列比较 CRA 与 NIS2
适用场景
适合需要快速、结构化地判断欧盟《网络韧性法案》是否以及如何适用于在欧盟销售含软件产品的情形，或准备 SBOM、漏洞处理与合格评定证据时使用。它只提供咨询性信息，适合早期范围界定和差距检查，而非正式认证。
运行要求
以 Python 包形式在本地通过 stdio 运行（pip 安装或 uvx）；基础工具未声明认证或环境变量。证明工具需要 MEOK_API_KEY 环境变量，并需联网访问提供方的签名接口。
安装前请注意
证明工具会把实体、产品和联系邮箱等资料发送给第三方签名服务，并需要 MEOK_API_KEY；免费额度为每天一张证书，另有付费档。输出只是指引，不构成法律意见，也不等于实际合格评定、SBOM 生成或 ENISA 申报。依赖任何证明前请自行复核。

安装

在 SourceWeft 中

  1. 打开 控制台中的 meok-eu-cra-mcp，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

meok-eu-cra-mcp

EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) compliance MCP server by MEOK AI Labs.

[MEOK AI Labs] [License: MIT] [PyPI]

The MCP for CRA — the EU Cyber Resilience Act (Reg (EU) 2024/2847). Applies to every product with software sold in the EU, including AI systems, IoT devices, and standalone software.

DateWhat
10 Dec 2024CRA entered into force
11 Sep 2026Vulnerability reporting obligations start (Art 11, Art 14)
11 Dec 2027Full applicability — every product must comply

CRA co-exists with NIS2 (for the organisation operating the product) and EU AI Act (for the AI capabilities of the product). Most regulated entities need to comply with both.

4 obligations covered

ObligationWhatWhy it bites
Art 6 + Annex I — Essential cybersecurity requirementsRisk-based security at design, no known vulns at placement, secure-by-default config, encryption, integrity, DoS resilience, attack surface reduction, security update mechanismEvery product on the EU market. Penalty: €15M or 2.5% of global turnover
Art 10 — Vulnerability handlingIdentify, document, test, fix, disseminate, free, throughout product lifetime or 5 years (shorter)Every product. ENISA 24h reporting for actively exploited vulns starts 11 Sep 2026
Art 13 — Conformity assessmentSelf-assessment (Class I) or Notified Body (Class II) before placing on marketEvery product. Class II is required for the 5 critical categories in Annex III (password managers, identity/auth, VPN, network management, SIEM, PKI issuers)
Annex I §2 — SBOM + secure-by-defaultSoftware Bill of Materials (CycloneDX or SPDX), auto-update enabled, factory-reset procedure for end-of-lifeEvery product. SBOM is the de facto machine-readable compliance evidence

Install

bash
pip install meok-eu-cra-mcpmeok-eu-cra-mcp

Tools (5)

cra_overview()

CRA framework summary: scope, key dates, penalty structure, exclusions (medical devices, motor vehicles, aviation, FOSS-no-commercial), and how it co-exists with NIS2, EU AI Act, GDPR, and the Product Liability Directive 2024/2853.

classify_cra_obligations(places_product_on_eu_market, has_internet_connectivity, handles_personal_data, is_critical_infrastructure, is_iot_or_connected_device, is_ai_system_under_ai_act, is_free_and_open_source_no_commercial, is_medical_device, is_motor_vehicle, is_aviation_product)

Map product characteristics to the 4 CRA obligations + criticality class (Class I self-assessment vs Class II Notified Body) + ENISA reporting requirement + 24h reporting window + 2027-12-11 full applicability date. Exclusions handled first: medical devices, motor vehicles, aviation, FOSS-no-commercial.

audit_cra_pipeline(tenant_id, has_sbom, sbom_format, has_security_txt, has_vulnerability_disclosure_policy, has_signed_releases, has_auto_update_mechanism, has_data_removal_procedure, has_threat_model, has_ssa_or_penetration_test, has_secure_sdlc_documented, sample_sbom_components)

Audit an existing product pipeline for CRA compliance gaps. Checks for missing SBOM, security.txt, VDP, signed releases, auto-update, data-removal procedure, threat model, security testing, Secure SDLC. Also scans sample SBOM components for known-vulnerable packages (log4j 1.x, openssl 1.0.1, etc.) and flags critical if found.

sign_cra_attestation(entity_name, product_name, criticality_class, compliance_score, has_sbom, has_vdp, has_signed_releases, contact_email)

Generate a hash-chained CRA compliance attestation via the canonical meok-attestation-api /sign endpoint. Returns cert_id, signature, verify_url, audit_url, issued_at, expires_at, kid. Requires MEOK_API_KEY env var (free tier: 1 cert/day; Pro tier £199/mo: unlimited).

crosswalk_cra_to_nis2()

Side-by-side CRA ↔ NIS2 crosswalk: 10 rows (scope, effective date, authority, reporting, vulnerability handling, secure-by-default, SBOM, penalty, conformity assessment, pen-test cadence). Practical note: CRA is product-side; NIS2 is org-side. A cloud-hosted AI product is CRA-regulated (as a product) AND the cloud provider is NIS2-regulated (as an essential entity). One assessment, both regimes, different deliverables.

Honest limits

  • No actual SBOM generation: you bring the SBOM (or run Syft/cdxgen first). The MCP tells you the format + standards
  • No ENISA reporting submission: the ENISA single reporting platform is a separate portal (URL TBD by ENISA, available from 11 Sep 2026)
  • No Notified Body contact: Notified Bodies are designated by member states; you need to find one in your category
  • No actual conformity assessment: the MCP tells you the procedure (self-assessment vs Notified Body) and the deliverables (DoC, CE marking, technical documentation per Annex VII)
  • No Cybersecurity Act integration: the MCP doesn't pull from the EU Cybersecurity Act certification database; you bring your own cert

Tests

bash
cd eu-cra-mcppip install mcp httpx pytestpytest tests/test_eu_cra_mcp.py -v

11 tests across all 5 tools + exclusions, no live API required.

Cross-region

  • NIS2 — crosswalk_cra_to_nis2() covers the 10 most divergent requirements
  • EU AI Act — high-risk AI must satisfy both CRA (product cyber) + EU AI Act (AI risk management)
  • GDPR — CRA Art 6(g) data minimisation overlaps with GDPR Art 5(1)(c)
  • Product Liability Directive 2024/2853 — CRA violation is evidence of defect
  • UK — UK Product Security and Telecommunications Infrastructure Act 2022 (PSTI) covers similar ground; UK NCSC is the authority
  • US — no federal equivalent; California SB-327 (IoT security) + NY DFS Part 500 (financial services) are the closest

See also

  • meok-pipl-mcp — China PIPL (data side; this one covers the product side)
  • meok-fda-samd-mcp — US FDA SaMD (healthcare-specific, similar structure)
  • meok-eu-ai-act-mcp — EU AI Act (companion to CRA for AI products)
  • meok-owasp-agentic-mcp — OWASP Agentic Top 10 (security testing patterns)
  • meok-compliance-gateway — 13-framework crosswalk
  • meok-attestation-api — canonical SIGIL signer (Ed25519, kid d4cb0eaa)

License

MIT — MEOK AI Labs, UK Companies House 16939677.

来源：README.md，提交 3d9eeca

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

1
  1. v0.1.2最新Sep 16, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分