Meok Eu Cra MCP README
The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the Meok Eu Cra MCP listing page.
meok-eu-cra-mcp
EU Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) compliance MCP server by MEOK AI Labs.
The MCP for CRA — the EU Cyber Resilience Act (Reg (EU) 2024/2847). Applies to every product with software sold in the EU, including AI systems, IoT devices, and standalone software.
| Date | What |
|---|---|
| 10 Dec 2024 | CRA entered into force |
| 11 Sep 2026 | Vulnerability reporting obligations start (Art 11, Art 14) |
| 11 Dec 2027 | Full applicability — every product must comply |
CRA co-exists with NIS2 (for the organisation operating the product) and EU AI Act (for the AI capabilities of the product). Most regulated entities need to comply with both.
4 obligations covered
| Obligation | What | Why it bites |
|---|---|---|
| Art 6 + Annex I — Essential cybersecurity requirements | Risk-based security at design, no known vulns at placement, secure-by-default config, encryption, integrity, DoS resilience, attack surface reduction, security update mechanism | Every product on the EU market. Penalty: €15M or 2.5% of global turnover |
| Art 10 — Vulnerability handling | Identify, document, test, fix, disseminate, free, throughout product lifetime or 5 years (shorter) | Every product. ENISA 24h reporting for actively exploited vulns starts 11 Sep 2026 |
| Art 13 — Conformity assessment | Self-assessment (Class I) or Notified Body (Class II) before placing on market | Every product. Class II is required for the 5 critical categories in Annex III (password managers, identity/auth, VPN, network management, SIEM, PKI issuers) |
| Annex I §2 — SBOM + secure-by-default | Software Bill of Materials (CycloneDX or SPDX), auto-update enabled, factory-reset procedure for end-of-life | Every product. SBOM is the de facto machine-readable compliance evidence |
Install
Tools (5)
cra_overview()
CRA framework summary: scope, key dates, penalty structure, exclusions (medical devices, motor vehicles, aviation, FOSS-no-commercial), and how it co-exists with NIS2, EU AI Act, GDPR, and the Product Liability Directive 2024/2853.
classify_cra_obligations(places_product_on_eu_market, has_internet_connectivity, handles_personal_data, is_critical_infrastructure, is_iot_or_connected_device, is_ai_system_under_ai_act, is_free_and_open_source_no_commercial, is_medical_device, is_motor_vehicle, is_aviation_product)
Map product characteristics to the 4 CRA obligations + criticality class (Class I self-assessment vs Class II Notified Body) + ENISA reporting requirement + 24h reporting window + 2027-12-11 full applicability date. Exclusions handled first: medical devices, motor vehicles, aviation, FOSS-no-commercial.
audit_cra_pipeline(tenant_id, has_sbom, sbom_format, has_security_txt, has_vulnerability_disclosure_policy, has_signed_releases, has_auto_update_mechanism, has_data_removal_procedure, has_threat_model, has_ssa_or_penetration_test, has_secure_sdlc_documented, sample_sbom_components)
Audit an existing product pipeline for CRA compliance gaps. Checks for missing SBOM, security.txt, VDP, signed releases, auto-update, data-removal procedure, threat model, security testing, Secure SDLC. Also scans sample SBOM components for known-vulnerable packages (log4j 1.x, openssl 1.0.1, etc.) and flags critical if found.
sign_cra_attestation(entity_name, product_name, criticality_class, compliance_score, has_sbom, has_vdp, has_signed_releases, contact_email)
Generate a hash-chained CRA compliance attestation via the canonical meok-attestation-api /sign endpoint. Returns cert_id, signature, verify_url, audit_url, issued_at, expires_at, kid. Requires MEOK_API_KEY env var (free tier: 1 cert/day; Pro tier £199/mo: unlimited).
crosswalk_cra_to_nis2()
Side-by-side CRA ↔ NIS2 crosswalk: 10 rows (scope, effective date, authority, reporting, vulnerability handling, secure-by-default, SBOM, penalty, conformity assessment, pen-test cadence). Practical note: CRA is product-side; NIS2 is org-side. A cloud-hosted AI product is CRA-regulated (as a product) AND the cloud provider is NIS2-regulated (as an essential entity). One assessment, both regimes, different deliverables.
Honest limits
- No actual SBOM generation: you bring the SBOM (or run Syft/cdxgen first). The MCP tells you the format + standards
- No ENISA reporting submission: the ENISA single reporting platform is a separate portal (URL TBD by ENISA, available from 11 Sep 2026)
- No Notified Body contact: Notified Bodies are designated by member states; you need to find one in your category
- No actual conformity assessment: the MCP tells you the procedure (self-assessment vs Notified Body) and the deliverables (DoC, CE marking, technical documentation per Annex VII)
- No Cybersecurity Act integration: the MCP doesn't pull from the EU Cybersecurity Act certification database; you bring your own cert
Tests
11 tests across all 5 tools + exclusions, no live API required.
Cross-region
- NIS2 —
crosswalk_cra_to_nis2()covers the 10 most divergent requirements - EU AI Act — high-risk AI must satisfy both CRA (product cyber) + EU AI Act (AI risk management)
- GDPR — CRA Art 6(g) data minimisation overlaps with GDPR Art 5(1)(c)
- Product Liability Directive 2024/2853 — CRA violation is evidence of defect
- UK — UK Product Security and Telecommunications Infrastructure Act 2022 (PSTI) covers similar ground; UK NCSC is the authority
- US — no federal equivalent; California SB-327 (IoT security) + NY DFS Part 500 (financial services) are the closest
See also
meok-pipl-mcp— China PIPL (data side; this one covers the product side)meok-fda-samd-mcp— US FDA SaMD (healthcare-specific, similar structure)meok-eu-ai-act-mcp— EU AI Act (companion to CRA for AI products)meok-owasp-agentic-mcp— OWASP Agentic Top 10 (security testing patterns)meok-compliance-gateway— 13-framework crosswalkmeok-attestation-api— canonical SIGIL signer (Ed25519, kid d4cb0eaa)
License
MIT — MEOK AI Labs, UK Companies House 16939677.