cra-scanner 0.2.0

Open-source CRA Readiness Scanner CLI for assessing EU Cyber Resilience Act readiness from SBOMs and project signals.

cra-scanner

Open source CLI tool for assessing EU Cyber Resilience Act (CRA) compliance readiness from SBOMs and project signals.

Installation

pip install cra-scanner

Quick Start

Scan a project directory:

cra-scanner scan .

Scan with an explicit SBOM:

cra-scanner scan . --sbom path/to/bom.json

Output as JSON:

cra-scanner scan . --format json --output report.json

Fail if score is below a threshold (useful in CI/CD):

cra-scanner scan . --min-score 50

CRA Readiness Score

The scanner returns a score from 0-100 based on:

Dimension	Points	What it checks
SBOM	40	Presence, coverage, version completeness
Vulnerabilities	30	Known vulnerability exposure (placeholder in v0.1)
Practices	30	SECURITY.md, Dependabot, documentation

The score is a directional indicator, not legal advice.

SBOM Format Support

• CycloneDX JSON and XML
• SPDX JSON and tag-value

SBOMs are auto-discovered in your project directory, or you can specify one with --sbom.

GitHub Action

Use cra-scanner in your CI/CD pipeline:

name: CRA Compliance Check
on: [push, pull_request]

jobs:
  cra-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run CRA Scanner
        uses: complaro/cra-scanner/action@main
        with:
          min-score: 40

See action/README.md for full documentation.

Roadmap

• Vulnerability matching against NVD, OSV.dev, and CISA KEV
• Version range comparison (semver, PEP 440, CPE)
• SARIF output for GitHub/GitLab code scanning
• CycloneDX VEX output
• Auto-SBOM generation from package managers

License

MIT - see LICENSE

Links

• PyPI
• Complaro
• EU Cyber Resilience Act