meok-eu-cra-mcp

io.github.CSOAI-ORG由 GitHub 帳號 CSOAI-ORG 發布v0.1.2更新於 Oct 30, 2026

EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) compliance MCP server. 4 tools, 11 tests. A

已驗證STDIO僅桌面開發者工具安全與監控

概覽

AI 產生的概覽

歐盟《網路韌性法案》合規輔助伺服器，讓助理解讀 CRA 義務、判定產品分類、稽核流程缺口並對照 NIS2。

可以做什麼
  • 概述 CRA 架構：適用範圍、關鍵日期、罰則、排除項目，以及與 NIS2、歐盟 AI 法案、GDPR 和產品責任規則的關係
  • 依一組是／否特徵把產品對應到四項 CRA 義務、Class I 自我評估或 Class II 公告機構、ENISA 通報要求及 2027 年全面適用日期
  • 稽核產品流程缺口，例如缺少 SBOM、security.txt、漏洞揭露政策、簽章發行、自動更新、威脅模型或安全開發生命週期，並標記 SBOM 中的已知易受攻擊元件
  • 產生帶雜湊鏈的合規證明，回傳憑證編號、簽章與驗證連結
  • 依十個要求領域並列比較 CRA 與 NIS2
適用情境
適合需要快速、有結構地判斷歐盟《網路韌性法案》是否以及如何適用於在歐盟銷售含軟體產品的情況，或準備 SBOM、漏洞處理與符合性評鑑證據時使用。它僅提供諮詢性資訊，適合早期範圍界定與落差檢查，而非正式認證。
執行需求
以 Python 套件形式在本機透過 stdio 執行（pip 安裝或 uvx）；基本工具未宣告驗證或環境變數。證明工具需要 MEOK_API_KEY 環境變數，並需連網存取提供方的簽章端點。
安裝前請注意
證明工具會把實體、產品與聯絡信箱等資料傳送給第三方簽章服務，並需要 MEOK_API_KEY；免費額度為每天一張憑證，另有付費方案。輸出僅為指引，不構成法律意見，也不等於實際符合性評鑑、SBOM 產生或 ENISA 申報。採用任何證明前請自行複核。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 meok-eu-cra-mcp，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

meok-eu-cra-mcp

EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) compliance MCP server by MEOK AI Labs.

[MEOK AI Labs] [License: MIT] [PyPI]

The MCP for CRA — the EU Cyber Resilience Act (Reg (EU) 2024/2847). Applies to every product with software sold in the EU, including AI systems, IoT devices, and standalone software.

DateWhat
10 Dec 2024CRA entered into force
11 Sep 2026Vulnerability reporting obligations start (Art 11, Art 14)
11 Dec 2027Full applicability — every product must comply

CRA co-exists with NIS2 (for the organisation operating the product) and EU AI Act (for the AI capabilities of the product). Most regulated entities need to comply with both.

4 obligations covered

ObligationWhatWhy it bites
Art 6 + Annex I — Essential cybersecurity requirementsRisk-based security at design, no known vulns at placement, secure-by-default config, encryption, integrity, DoS resilience, attack surface reduction, security update mechanismEvery product on the EU market. Penalty: €15M or 2.5% of global turnover
Art 10 — Vulnerability handlingIdentify, document, test, fix, disseminate, free, throughout product lifetime or 5 years (shorter)Every product. ENISA 24h reporting for actively exploited vulns starts 11 Sep 2026
Art 13 — Conformity assessmentSelf-assessment (Class I) or Notified Body (Class II) before placing on marketEvery product. Class II is required for the 5 critical categories in Annex III (password managers, identity/auth, VPN, network management, SIEM, PKI issuers)
Annex I §2 — SBOM + secure-by-defaultSoftware Bill of Materials (CycloneDX or SPDX), auto-update enabled, factory-reset procedure for end-of-lifeEvery product. SBOM is the de facto machine-readable compliance evidence

Install

bash
pip install meok-eu-cra-mcpmeok-eu-cra-mcp

Tools (5)

cra_overview()

CRA framework summary: scope, key dates, penalty structure, exclusions (medical devices, motor vehicles, aviation, FOSS-no-commercial), and how it co-exists with NIS2, EU AI Act, GDPR, and the Product Liability Directive 2024/2853.

classify_cra_obligations(places_product_on_eu_market, has_internet_connectivity, handles_personal_data, is_critical_infrastructure, is_iot_or_connected_device, is_ai_system_under_ai_act, is_free_and_open_source_no_commercial, is_medical_device, is_motor_vehicle, is_aviation_product)

Map product characteristics to the 4 CRA obligations + criticality class (Class I self-assessment vs Class II Notified Body) + ENISA reporting requirement + 24h reporting window + 2027-12-11 full applicability date. Exclusions handled first: medical devices, motor vehicles, aviation, FOSS-no-commercial.

audit_cra_pipeline(tenant_id, has_sbom, sbom_format, has_security_txt, has_vulnerability_disclosure_policy, has_signed_releases, has_auto_update_mechanism, has_data_removal_procedure, has_threat_model, has_ssa_or_penetration_test, has_secure_sdlc_documented, sample_sbom_components)

Audit an existing product pipeline for CRA compliance gaps. Checks for missing SBOM, security.txt, VDP, signed releases, auto-update, data-removal procedure, threat model, security testing, Secure SDLC. Also scans sample SBOM components for known-vulnerable packages (log4j 1.x, openssl 1.0.1, etc.) and flags critical if found.

sign_cra_attestation(entity_name, product_name, criticality_class, compliance_score, has_sbom, has_vdp, has_signed_releases, contact_email)

Generate a hash-chained CRA compliance attestation via the canonical meok-attestation-api /sign endpoint. Returns cert_id, signature, verify_url, audit_url, issued_at, expires_at, kid. Requires MEOK_API_KEY env var (free tier: 1 cert/day; Pro tier £199/mo: unlimited).

crosswalk_cra_to_nis2()

Side-by-side CRA ↔ NIS2 crosswalk: 10 rows (scope, effective date, authority, reporting, vulnerability handling, secure-by-default, SBOM, penalty, conformity assessment, pen-test cadence). Practical note: CRA is product-side; NIS2 is org-side. A cloud-hosted AI product is CRA-regulated (as a product) AND the cloud provider is NIS2-regulated (as an essential entity). One assessment, both regimes, different deliverables.

Honest limits

  • No actual SBOM generation: you bring the SBOM (or run Syft/cdxgen first). The MCP tells you the format + standards
  • No ENISA reporting submission: the ENISA single reporting platform is a separate portal (URL TBD by ENISA, available from 11 Sep 2026)
  • No Notified Body contact: Notified Bodies are designated by member states; you need to find one in your category
  • No actual conformity assessment: the MCP tells you the procedure (self-assessment vs Notified Body) and the deliverables (DoC, CE marking, technical documentation per Annex VII)
  • No Cybersecurity Act integration: the MCP doesn't pull from the EU Cybersecurity Act certification database; you bring your own cert

Tests

bash
cd eu-cra-mcppip install mcp httpx pytestpytest tests/test_eu_cra_mcp.py -v

11 tests across all 5 tools + exclusions, no live API required.

Cross-region

  • NIS2 — crosswalk_cra_to_nis2() covers the 10 most divergent requirements
  • EU AI Act — high-risk AI must satisfy both CRA (product cyber) + EU AI Act (AI risk management)
  • GDPR — CRA Art 6(g) data minimisation overlaps with GDPR Art 5(1)(c)
  • Product Liability Directive 2024/2853 — CRA violation is evidence of defect
  • UK — UK Product Security and Telecommunications Infrastructure Act 2022 (PSTI) covers similar ground; UK NCSC is the authority
  • US — no federal equivalent; California SB-327 (IoT security) + NY DFS Part 500 (financial services) are the closest

See also

  • meok-pipl-mcp — China PIPL (data side; this one covers the product side)
  • meok-fda-samd-mcp — US FDA SaMD (healthcare-specific, similar structure)
  • meok-eu-ai-act-mcp — EU AI Act (companion to CRA for AI products)
  • meok-owasp-agentic-mcp — OWASP Agentic Top 10 (security testing patterns)
  • meok-compliance-gateway — 13-framework crosswalk
  • meok-attestation-api — canonical SIGIL signer (Ed25519, kid d4cb0eaa)

License

MIT — MEOK AI Labs, UK Companies House 16939677.

來源：README.md，提交 3d9eeca

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v0.1.2最新Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分