Regulation (EU) 2024/2847

The Cyber Resilience Act, worked out where your code is.

Skarp CRA is an MCP server your coding agent connects to. It works out whether the CRA applies to what you ship and what it demands, then holds the record: the risk assessment, the Annex I requirements with their evidence, the statutory reporting clocks, and the Annex VII technical file.

The answers the regulation wants are already in your repository — the components you ship, what changed this release, how it is deployed. An agent sitting there can draft from the real thing rather than from memory, and you decide every answer it proposes.

It will never tell you that you are compliant. Conformity is your declaration to make, and for some product classes a notified body's. This records what you have decided and evidenced, and shows what is missing.

Connect your agent Read a sample report

Free for one product, with your whole team, until you place it on the market. No card, and no account to create first.

What is due, and when
11 Sept 2026	Reporting obligations apply. An actively exploited vulnerability or a severe incident means a 24 h early warning, a 72 h notification and a 14 day final report, filed to your CSIRT via ENISA's Single Reporting Platform. The clock starts when you become aware — not when someone gets round to filing.
11 Dec 2027	Full application. Products with digital elements may not be placed on the EU market without secure-by-design and vulnerability handling, technical documentation, conformity assessment, an EU Declaration of Conformity, CE marking, and a support period of at least five years.
Article 64 sets administrative fines reaching €15M or 2.5% of worldwide annual turnover.

The first of those windows is 24 hours long, and EU Login enrolment and Single Reporting Platform registration cannot be arranged inside it.

What it covers

Each obligation, and the tools that carry it

Annex III & IVScope and product class

Works the classification question through with you and records the answer with its reasoning — important, default, critical, or out of scope. That decision is what determines whether you need a notified body, so it is indicative and never guessed from a product name.

classify_product

Article 13(2)–(4)Risk assessment

Your agent drafts risks from the codebase it is sitting in; you accept, amend or reject each one, and nothing counts until you decide. Confirming freezes a hashed version, and it goes stale when the product moves — a reclassification, a lifecycle change.

start_risk_assessment · propose_risks · decide_risk · confirm_risk_assessment

Annex IThe 22 essential requirements

The assessment decides which requirements apply and why — nothing is ever auto-ruled-out. Evidence is stored by value and hashed with its provenance: a git SHA, a CI run, a tool and version. This tracks whether the engineering happened; it does not do the engineering.

list_requirements · update_requirement · attach_evidence

Annex I I(2)(a), II(1)Components and SBOM

Your bill of materials, checked daily against the OSV advisory database and CISA's Known Exploited Vulnerabilities catalogue: which components carry known advisories, and which of those are actively exploited. A match is a candidate for you to work, never a record — so a scan cannot put a spurious notification in front of a CSIRT.

record_sbom · scan_advisories · confirm_advisory · dismiss_advisory

Article 14Reporting clocks

24 hour early warning, 72 hour notification, 14 day final report — anchored on when you became aware, not when the tool was called, with escalating reminders to everyone on the product. Drafts come out in ENISA's own field layout. You file them yourself, on the Single Reporting Platform under your own EU Login.

record_vulnerability · report_incident · get_reporting_deadlines · draft_report

Annex VII & Annex VTechnical file and DoC

All eight Annex VII sections as a gap report first, because what is missing matters more than the prose. Freezing computes a content hash; a signature binds to that hash, so a later edit shows as stale rather than silently still valid.

assemble_technical_file · generate_declaration_of_conformity · sign_off

Article 13(13)Ten-year retention

Every change to a product's compliance record writes an audit row naming the agent that acted and the person accountable. Evidence is kept by value rather than as a link that rots, and the statutory record is copied to a locked archive with per-object retention never shorter than ten years. Under the CRA the trail is the deliverable, so a failed audit write fails the operation it was recording.

That is the shape of it. The full coverage page goes through every obligation in Articles 13 and 14, all 22 Annex I requirements and all eight Annex VII sections — what the law requires, and what we do about each one, including the ones where the answer is that we do nothing yet.

What is free, and what is not

Free until you place it on the market. Pay to sign.

Free — one product, your whole team

Scope and Annex III/IV classification, recorded with its reasoning
The Article 13(2) risk assessment, and every revision of it as the product changes
All 22 Annex I requirements and the Annex II user information, with your evidence recorded against them
Your SBOM scanned daily against OSV and CISA KEV, with EPSS on what it finds
The Article 14 clocks and ENISA drafts, if something happens
The Annex VII technical file as a gap report — every section, with what is missing named

Not a trial. It is the whole job of getting ready, for as long as getting ready takes — and we do not charge per person, so everyone who makes a decision is in the audit trail under their own name.

Paid — placing it on the market

Freezing the Annex VII technical file to a content hash
Drawing up the EU Declaration of Conformity, and the Article 13(20) simplified form
Sign-off, with segregation of duties if you want it
Recording a release, through the Annex I Pt I(2)(a) gate
The Article 13(8) support period, and alerts as it ends
More than one product

The legal act, in other words — the things that turn a working record into something you would hand a market surveillance authority. See pricing.

Being refused a paid tool is never a statement about your product. It means this service is not tracking that for you, which is a different sentence.

Getting started

Add the server to any MCP client. It asks for your email, sends a six-digit code, and you are connected. You never handle a credential, and there is no account to create first.

Click a command to select it, then copy.

Server URL · any MCP client

https://cra.skarp.app/mcp

Claude Code

claude mcp add --transport http skarp-cra https://cra.skarp.app/mcp

Codex

codex mcp add skarp-cra --url https://cra.skarp.app/mcp

Or just tell it: “connect https://cra.skarp.app/mcp as skarp-cra”.

Claude.ai · ChatGPT · Codex web

Settings → Connectors → Add custom connector, then paste the server URL above.

Then ask it

“Does the Cyber Resilience Act apply to this product, and what does it require?”

It starts with orientation, not paperwork: what you ship, where it runs, which class you fall in. Your agent reads your code locally and sends only what you record — the server never connects to your repository.