embtrace-check

Free CRA Readiness Check collector — one command in your project folder, and within 24 hours you receive a report showing where your product stands with the EU Cyber Resilience Act: traffic-light readiness status, your full component inventory, and known vulnerabilities with severity.

This collector is open source for one reason: so you can verify exactly what leaves your machine.

What it transmits — and what it never does

Transmitted (JSON, ~a few kB):

names, versions and package ecosystems of your dependencies (from lockfiles and build files: Conan, vcpkg, CMake, Cargo, npm/yarn/pnpm, Python incl. uv, Go, Maven/Gradle, Meson, and more),
names and versions of FPGA IP cores (AMD/Xilinx Vivado .hwh/.xci, Microchip Libero Tcl/.cxf, Intel/Altera Quartus *_hw.tcl),
the project folder name (hash it with --anonymize),
scan statistics (number of build files, tool version).

Never transmitted: source code, file paths, file contents, configuration, credentials. The supplier of an FPGA IP core is known locally but deliberately not transmitted — names, versions and ecosystems only. See for yourself before sending anything:

embtrace-check . --dry-run     # prints the exact payload, uploads nothing

Build outputs (dist/, build/, node_modules/, …) and hidden directories are never scanned. Project-specific excludes go into a committed .embtraceignore at the project root — one glob pattern per line, # comments.

Usage

Get your free one-time code at https://embtrace.dev/check (the report goes to the e-mail address you register there).
Run the collector in your project folder:

pipx install embtrace-check         # or: pip install embtrace-check,
                                    #     or download the standalone binary
embtrace-check . --code CHK-XXXX-YYYY

Your report arrives within 24 hours. The code is valid for one check.

More options: embtrace-check --help — including --output payload.json for air-gapped environments (send the file by mail) and --with-tools to additionally use native package-manager CLIs for higher-fidelity results.

Exit codes

Code	Meaning
0	success
1	error (network, invalid code, …)
2	no components found — declare dependencies manually in `embtrace-deps.yaml`

Privacy

Data is processed exclusively on Innomatica's own servers in Germany and is never shared or sold. Full notes: https://embtrace.dev/check-privacy.

About

embtrace-check is the free entry point to embtrace — the CRA/NIS2 compliance toolchain for embedded software teams by Innomatica GmbH. The server side (enrichment, vulnerability monitoring, reports) is a commercial product; this repository contains the complete client.

Maintained by Innomatica; the roadmap follows the product. Issues and PRs are welcome — please report security topics per SECURITY.md.

License

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

embtrace_check-0.4.0.tar.gz (62.2 kB view details)

Uploaded Aug 28, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

embtrace_check-0.4.0-py3-none-any.whl (69.1 kB view details)

Uploaded Aug 28, 2026 Python 3

File details

Details for the file embtrace_check-0.4.0.tar.gz.

File metadata

Download URL: embtrace_check-0.4.0.tar.gz
Upload date: Aug 28, 2026
Size: 62.2 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for embtrace_check-0.4.0.tar.gz
Algorithm	Hash digest
SHA256	`794ed3ba533cdf2fdb8c97ba434d9e1afe143f4a9dfa0c42c5080ae5a26fb767`
MD5	`79b61a18a5f734640c89a4fe58864670`
BLAKE2b-256	`88539b04481c672613216d3fdb8213325a2d138bd900973ac47806c518b3624d`

See more details on using hashes here.

Provenance

The following attestation bundles were made for embtrace_check-0.4.0.tar.gz:

Publisher: publish.yml on Innomatica-GmbH/embtrace-check

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: embtrace_check-0.4.0.tar.gz
- Subject digest: 794ed3ba533cdf2fdb8c97ba434d9e1afe143f4a9dfa0c42c5080ae5a26fb767
- Sigstore transparency entry: 2624057807
- Sigstore integration time: Aug 28, 2026
Source repository:
- Permalink: Innomatica-GmbH/embtrace-check@d5048505923ddf06e6bb5275351ab5937bf70c7e
- Branch / Tag: refs/tags/v0.4.0
- Owner: https://github.com/Innomatica-GmbH
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: publish.yml@d5048505923ddf06e6bb5275351ab5937bf70c7e
- Trigger Event: push