Skip to main content
Glama
MEOK CRA Annex Iv Classifier MCP

MEOK CRA Annex Iv Classifier MCP

meok-cra-annex-iv-classifier-mcp MCP 서버 MCP 레지스트리 PyPI

meok-cra-annex-iv-classifier-mcp MCP 서버

PyPI 다운로드 PyPI 버전 라이선스: MIT

meok-cra-annex-iv-classifier-mcp

이 도구가 존재하는 이유

EU 사이버 복원력 법(CRA, Reg 2024/2847) 부속서 IV는 AI 임베디드 제품을 포함하여 EU에서 판매되는 디지털 요소가 포함된 모든 제품이 충족해야 하는 9가지 범주의 필수 보안 요구 사항을 정의합니다. 대부분의 팀은 CRA를 '보안 팀이 내년에 처리할 일'로 취급합니다. 이는 실수입니다. 적합성 자기 평가 및 기술 문서 요구 사항은 결코 간단하지 않으며, 벌금(최대 1,500만 유로 또는 전 세계 매출의 2.5%)은 현실적이기 때문입니다.

제품의 아키텍처를 9가지 부속서 IV 범주에 매핑하고, 격차를 식별하며, 서명된 자기 평가 팩을 생성하는 실용적인 AI 호출 가능 분류기는 인프라가 부족한 실정입니다. 이 MCP가 그 격차를 메워줍니다.

Related MCP server: Dataprivacy AI MCP

실제 사용 예시

EU에서 제품을 판매하는 한 IoT 제조업체는 2027년 12월 적용일을 앞두고 CRA 적합성 자기 평가를 준비했습니다. 그들은 다음을 설치했습니다:

pip install meok-cra-annex-iv-classifier-mcp

Claude에게 다음과 같이 프롬프트를 입력했습니다:

'우리의 스마트 온도 조절기 제품(C 언어 펌웨어, Go 언어 클라우드 백엔드, Swift/Kotlin 모바일 앱)을 9가지 CRA 부속서 IV 필수 보안 요구 사항에 따라 분류해 줘. 격차를 식별하고, 인증 기관에 제출할 준비가 된 서명된 자기 평가 팩을 생성해 줘.'

결과물: 범주별 제어 매핑, 3가지 식별된 격차(보안 업데이트 메커니즘, 취약점 공개 정책, 데이터 최소화) 및 HMAC 서명된 최종 팩이 포함된 27페이지 분량의 평가서. 동일한 결과물을 위해 외부 컨설팅에 지불했을 약 1만 8천 파운드의 비용을 절감했습니다.


meok-cra-annex-iv-classifier-mcp

EU 사이버 복원력 법 제품 분류기 — 부속서 III + 부속서 IV 지정 + 부속서 I 요구 사항 감사 + 서명된 인증서.

디지털 요소가 포함된 제품(PDE)을 CRA 계층 구조로 분류합니다. 2027년 12월 11일 전면 적용 기한(취약점 및 심각한 사고 보고는 2026년 9월부터 이미 시행 중)을 위해 구축되었습니다.

MEOK AI Labs 제공.

이 MCP를 사용하는 이유

(2025년 11월 말 채택된) 시행 규정 (EU) 2025/2392는 클래스 I, 클래스 II 및 부속서 IV 제품 범주의 첫 번째 세트를 지정했습니다. IoT 공급업체, 칩 제조업체, 스마트 미터 제조업체, OT 팀은 지금 당장 방어 가능한 분류가 필요합니다. 분류를 미룰수록 나중에 소급하여 지불해야 할 적합성 작업 비용이 늘어납니다.

분류 대상

  • 기본 클래스 — 대부분의 소비자/비즈니스 소프트웨어(자기 평가, 벌금 최대 500만 유로 / 1%)

  • 중요 클래스 I (부속서 III(1)) — IAM, 비밀번호 관리자, 브라우저, VPN, OS, 라우터, 스마트 홈 — 자기 평가 또는 인증 기관(1,000만 유로 / 2%)

  • 중요 클래스 II (부속서 III(2)) — 하이퍼바이저, 방화벽, IDS/IPS, 변조 방지 µC/µP — 필수 인증 기관 평가(1,500만 유로 / 2.5%)

  • 중요(부속서 IV) — 스마트 카드 보안 요소, 스마트 미터 게이트웨이, 하드웨어 보안 박스 — 필수 유럽 사이버 보안 인증(1,500만 유로 / 2.5%)

도구

  • classify_product — 설명 및 특성에 따른 휴리스틱 분류

  • audit_essential_requirements — 15가지 부속서 I 사이버 보안 요구 사항에 대한 점수 산정

  • generate_doc_template — 부속서 VIII 기술 문서 뼈대 생성

  • sign_classification_cert — Pro: 공개 검증 URL이 포함된 HMAC-SHA256 서명 분류 인증서

설치

pip install meok-cra-annex-iv-classifier-mcp

요금제

  • 무료 — 일일 10회 분류

  • Pro 월 199파운드 — 무제한 + 서명된 인증서 + 월간 부속서 III/IV 업데이트 알림 — 구독하기

  • Enterprise 월 1,499파운드 — 다중 제품 + 사용자 지정 지정 규칙

  • 제품당 199파운드 인증서 — 1회성 서명된 분류

코드 **MEOKEAT**를 사용하여 첫 3개월간 25% 할인을 받으세요.

출처

  • 규정 (EU) 2024/2847 (CRA)

  • 시행 규정 (EU) 2025/2392 (첫 부속서 III/IV 지정)

  • ENISA CRA 구현 지침

관련 MEOK MCP

라이선스

MIT — MEOK AI Labs, 2026.


배포 채널

Available Tools

4 tools
audit_essential_requirementsA

Audit a product against the 15 Annex I + II essential requirements. Pass comma-separated requirement IDs that are satisfied (e.g. "1.1,1.2,2.1").

NameRequiredDescriptionDefault
api_keyNo
product_nameYes
requirements_satisfied_csvYes

Output Schema

NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It states the action (audit) and input format but omits side effects, idempotency, or whether it modifies state. 'Audit' suggests read-only, but not explicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero waste. Front-loaded with purpose, followed by parameter format hint. Each sentence serves a clear function.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists but unseen. Description covers purpose and key parameter format. Missing usage context, prerequisites, or error scenarios. Adequate for a straightforward audit but not rich.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% coverage (only titles). Description adds meaning to 'requirements_satisfied_csv' by specifying format (comma-separated IDs) and example. However, 'api_key' and 'product_name' remain minimally described. Compensates significantly but not fully.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Verb 'audit' combined with specific resource '15 Annex I + II essential requirements' clearly states what the tool does. Differentiates from siblings (classify, generate doc, sign cert) which have distinct purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies usage for auditing compliance against essential requirements, but no explicit when-to-use, when-not-to-use, or alternatives. The examples suggest typical input format but no contextual guidance relative to sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

classify_productC

Classify a product with digital elements (PDE) into the CRA class hierarchy.

Returns: suggested class, conformity path, fines exposure, next steps.

NameRequiredDescriptionDefault
api_keyNo
product_nameYes
product_descriptionYes
intended_for_consumer_useNo
has_remote_data_processingNo
intended_for_critical_infrastructureNo

Output Schema

NameRequiredDescription
resultYes

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must fully disclose behavioral traits. It mentions return values (suggested class, conformity path, fines exposure, next steps) but does not state whether the tool is read-only, whether it requires authentication, or any side effects. The lack of detail on behavior limits transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very short (two sentences) and front-loads the purpose. It is efficient, but the returns section could be more structured. Overall, it is concise without unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 6 parameters, 0% schema descriptions, no annotations, and an output schema exists, the description is incomplete. It does not explain what 'CRA class hierarchy' is, how the parameters influence classification, or any usage context. The output schema existence slightly reduces the burden, but the description still lacks crucial information for proper invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, meaning no parameter descriptions are provided. The tool description also does not explain the meaning of any parameters beyond their names. For example, 'api_key' and 'product_description' are self-explanatory, but 'intended_for_consumer_use' and similar booleans lack context. The description fails to add value over the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Classify' and the resource 'product with digital elements (PDE)' into 'CRA class hierarchy'. It is distinct from sibling tools like audit_essential_requirements, generate_doc_template, and sign_classification_cert, which focus on auditing, document generation, and certification.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives, no prerequisites, and no exclusions. It only states what it does, leaving the agent to infer usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

generate_doc_templateC

Generate the Annex VIII technical documentation skeleton for a given class.

NameRequiredDescriptionDefault
api_keyNo
class_keyNodefault

Output Schema

NameRequiredDescription
resultYes

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so description carries full burden. It does not disclose authentication needs (api_key), output format, or whether the operation is safe or destructive. Minimal behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with 10 words, no redundancy. However, it is too brief for a 2-parameter tool with no schema descriptions, sacrificing completeness for brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists but is not referenced. Parameters lack explanation, and usage context (e.g., what 'skeleton' implies) is missing. Incomplete for an agent to use effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%; description only explains 'class' indirectly via 'for a given class'. The api_key parameter is entirely unexplained. Defaults exist but no semantic cues.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses specific verb 'generate' and resource 'Annex VIII technical documentation skeleton', clearly distinguishing from sibling tools like audit, classify, or sign.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. While siblings differ in actions, the description does not provide context or exclusion criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sign_classification_certC

Generate a HMAC-SHA256 signed CRA classification certificate (Pro/Enterprise).

NameRequiredDescriptionDefault
emailNo
api_keyNo
entity_nameYes
findings_csvNo
product_nameYes
annex_i_scoreYes
classification_class_keyYes

Output Schema

NameRequiredDescription
resultYes

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It adds minimal behavioral insight beyond the tool name, only noting the signing algorithm and edition. It fails to disclose side effects, authorization requirements, or idempotency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no wasted words. It is concise and direct, though it sacrifices completeness for brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite the existence of an output schema, the description leaves many gaps: parameter meanings, prerequisites, usage context, and behavioral details. It is insufficient for an agent to fully understand and correctly invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% (no descriptions), and the description does not explain any of the 7 parameters (e.g., entity_name, annex_i_score). The agent has no semantic understanding of what each parameter represents from the description alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Generate' and the specific resource 'CRA classification certificate', including the signing algorithm (HMAC-SHA256) and edition (Pro/Enterprise). This differentiates it from sibling tools like classify_product and generate_doc_template.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool over siblings or in what context. There is no mention of prerequisites, conditions, or exclusions, leaving the agent without direction on appropriate usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updatesv1.1.7
    • First observedaudit_essential_requirements
    • First observedclassify_product
    • First observedgenerate_doc_template
    • First observedsign_classification_cert

TDQS

A3.6/5.0

Scored across 4 tools

Disambiguation5/5

Each tool has a distinct purpose: auditing requirements, classifying products, generating documentation templates, and signing certificates. No overlap or ambiguity.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern using snake_case, making them predictable and easy to understand.

Tool Count5/5

With 4 tools, the server is tightly scoped to the CRA classification domain without unnecessary extras, perfectly matching its purpose.

Completeness5/5

The tool set covers the entire classification workflow: auditing requirements, classifying, generating docs, and signing certificates, with no obvious gaps.

Maintenance

ActivityInactive
ResponsivenessSyncing

Related MCP Connectors

Related MCP Servers