cra-scanner 0.1.0

Open-source CRA Readiness Scanner CLI for assessing EU Cyber Resilience Act readiness from SBOMs and project signals.

CRA Readiness Scanner (MVP)

The CRA Readiness Scanner is an open-source CLI tool that helps engineering teams quickly assess their readiness for the EU Cyber Resilience Act (CRA) from a single SBOM or project directory.

It focuses on three things:

• SBOM presence and basic quality
• Basic vulnerability exposure (stubbed for MVP)
• Signals of good vulnerability-handling practices

Installation

Once published to PyPI:

pip install cra-scanner

For local development from this repository:

cd cli
pip install -e .
cra-scanner --help

Quick start

Scan a project directory (auto-discover SBOMs and signals):

cra-scanner scan .

Scan using an explicit SBOM and emit JSON to a file:

cra-scanner scan . --sbom path/to/bom.json --format json --output report.json

What the CRA Readiness Score means

The scanner returns a score from 0–100 based on:

• SBOM (40 pts) – existence, coverage, presence of versions.
• Vulnerabilities (30 pts) – placeholder in MVP.
• Practices (30 pts) – presence of SECURITY.md, Dependabot, and basic documentation signals.

The score is a directional indicator, not legal advice. It is intended to highlight gaps and next steps, not certify compliance.