LabscoMCP early access ↗
CSOAI-ORGMCP SERVER

CRA Compliance MCP

Work through EU Cyber Resilience Act obligations — product classification, Annex I, and an SBOM skeleton — from inside a chat.

by CSOAI-ORG ↗Regulatory Compliance & AI GovernanceCommunity

LABSCO SUMMARY

Reads the regulation so you can ask about your product.

The CRA is a long document whose obligations depend on what your product is, which is exactly the shape of question a classifier plus an audit tool handles well. Metered billing is built into the server itself rather than bolted on at the gateway, so the same token works across the publisher's other compliance servers.

What it is

A Python server for the EU Cyber Resilience Act, Regulation 2024/2847, aimed at products with digital elements. It covers CE marking, vulnerability disclosure and SBOM, so an assistant can take a product description and work out what the regulation asks of it rather than reading the text yourself.

What you get

Three tools, named in the repository's own examples: classify_product, audit_annex_i, and sbom_skeleton — classify the product, audit it against Annex I, and start the software bill of materials the regulation expects.

Requirements

pip install cra_compliance_mcp, or point your client at uvx with the argument cra-compliance-mcp (package version 1.3.14, stdio transport). The free tier is 50 calls a day. For pay-per-call, set MEOK_PAYG_KEY to a top-up token — each call then deducts £0.05 by default, and MEOK_PAYG_RATE_GBP changes the rate. With MEOK_PAYG_KEY unset the behaviour is the same as before.

Setup effort

One command — pip install cra-compliance-mcp