cra-readiness
EU CRA Readiness Check — Repository or manifests in, EU Cyber Resilience Act Art. 14 position out: dependency-advisor resolves every declared package to its locked version (deterministic, no model), those versions go to cra-exploit-clock as package URLs (OSV, CISA KEV, EPSS, EUVD), and each actively exploited component is joined back to the manifest that declares it with the fixed versions and the advisor's findings. Repo
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "cra-readiness"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ref | No | Branch, tag or commit; defaults to the default branch. | |
| repo | No | Public GitHub repository: owner/repo, https://github.com/owner/repo[/tree/ref], a commit URL, or a pull request URL (analyzed at the PR head). | |
| files | No | Alternative to repo: manifests (package.json, lockfile, pyproject.toml, requirements.txt, Cargo.toml) and source files with repository-relative paths. | |
| product | No | Your product with digital elements; used only to fill the draft fields (defaults to the SBOM's own product name). | |
| ecosystems | No | Restrict the analysis; default all detected. | |
| repoLicense | No | SPDX id of the repository's license, for alternative ranking; detected from manifests or LICENSE when absent. | |
| awareness_time | No | When the manufacturer became aware, ISO 8601 with UTC offset (e.g. 2026-11-04T09:30:00Z). Defaults to now. Taken as given; this agent cannot verify it. | |
| fix_available_at | No | When a corrective or mitigating measure became available, ISO 8601 with UTC offset; sets the Art. 14(2)(c) final-report date. |