CRA Readiness Audit for EU Cyber Resilience Act

Runs the same checker as our npm package on a Node.js runtime that pip installs for you (nodejs-wheel-binaries) - no system Node.js needed. Your files are checked locally.

Flags the lines in your repo that break the EU Cyber Resilience Act - default passwords, disabled TLS checks, floating base images, an expired security.txt - naming the Annex each one fails.

Install

cra-readiness-audit file

Node 18+. The same 28 rules as the VS Code extension, from a terminal or CI.

Free

• Check the open file against all 28 rules; Check only the lines you select; Reopen the last findings, with line numbers and severity; Read every rule that ships inside, with its Annex reference
• --rules lists every rule

With a licence ($29 once)

• Check every file in the repository; Findings report as CSV, JSON or HTML; JSON output a build step can fail on

cra-readiness-audit --dir ./templates --report html --out report.html

Blended EU engineering-and-consulting effort on CRA work is estimated at EUR 45 an hour, and the cheapest tooled route published runs EUR 4,000 per project per year.

Use from an AI agent (MCP)

Claude Code · Cursor · Windsurf · any MCP client - add to your MCP config:

{ "mcpServers": { "cra-readiness-audit": { "command": "cra-readiness-audit", "args": ["--mcp"] } } }

Tools: check_text and check_file (free) · check_dir (licence). The agent gets every finding with the line number.

Use in CI

- name: CRA Readiness Audit for EU Cyber Resilience Act
  run: pip install rulestamp-cra-readiness-audit && cra-readiness-audit --dir . --ci

The folder sweep, reports and CI mode need one licence — one payment, no subscription. Set READYSTACK_LICENSE=<key> or run --license <key> once.

Get a licence

Install (PyPI)

pip install rulestamp-cra-readiness-audit
cra-readiness-audit --help