Labsco
MCP SERVER

CRA Compliance MCP

by CSOAI-ORG

Work through EU Cyber Resilience Act obligations — product classification, Annex I, and an SBOM skeleton — from inside a chat.

Regulatory Compliance & AI Governance
Summary
Reads the regulation so you can ask about your product.

The CRA is a long document whose obligations depend on what your product is, which is exactly the shape of question a classifier plus an audit tool handles well. Metered billing is built into the server itself rather than bolted on at the gateway, so the same token works across the publisher's other compliance servers.

What it is

A Python server for the EU Cyber Resilience Act, Regulation 2024/2847, aimed at products with digital elements. It covers CE marking, vulnerability disclosure and SBOM, so an assistant can take a product description and work out what the regulation asks of it rather than reading the text yourself.

What you get

Three tools, named in the repository's own examples: `classify_product`, `audit_annex_i`, and `sbom_skeleton` — classify the product, audit it against Annex I, and start the software bill of materials the regulation expects.

Requirements

`pip install cra_compliance_mcp`, or point your client at `uvx` with the argument `cra-compliance-mcp` (package version 1.3.14, stdio transport). The free tier is 50 calls a day. For pay-per-call, set `MEOK_PAYG_KEY` to a top-up token — each call then deducts £0.05 by default, and `MEOK_PAYG_RATE_GBP` changes the rate. With `MEOK_PAYG_KEY` unset the behaviour is the same as before.

Setup effort

One command — pip install cra-compliance-mcp