cyber-resilience-act

Semantic SBOM/CBOM/AI-BOM diff, quality scoring, and compliance validation for CycloneDX/SPDX — component, license, and vulnerability change analysis, cryptographic inventory grading, PQC readiness (CNSA 2.0, NIST IR 8547), and regulatory gates for NTIA, FDA, EU CRA, BSI TR-03183, EUCC, SSDF, EO 14028, and the EU AI Act.

Static security scanner for ML model files — detects pickle bombs, Keras Lambda RCE and GGUF template injection, and generates CycloneDX / SPDX AI-BOMs (AIBOM) as EU AI Act, CRA and FDA §524B evidence.

Curated resources for the EU Cyber Resilience Act (Regulation 2024/2847): regulation, harmonised standards, EUCC, SBOM, vulnerability management, conformity assessment

AI-ready knowledge base of security & compliance regulations for hardware and connected-device manufacturers - structured, indexed, and machine-readable for LLMs and agents.

AI coding agent for embedded IoT firmware in VS Code: Espressif ESP32 (ESP-IDF) and Nordic nRF52/53/54/91 (nRF Connect SDK, Zephyr). Builds, flashes and debugs on real hardware (RTT, UART, BLE sniffer), cellular LTE-M/NB-IoT/NB-NTN, Fanstel gateway firmware, and one-click EU Cyber Resilience Act readiness: SBOM (SPDX), CVE scan, secure-by-design.

Last Mile EU CRA Compliance Tooling. Bring your own build SBOMs to generate product level SBOM and VEX based on CSAF 2.0

SBOM generator written in Go. Create EU-CRA compliant SBOMs for every ecosystem

Catch EU regulatory violations at PR time — GDPR, EU AI Act, NIS2, DORA, CRA, DSA, DMA and the Data Act. Runs entirely on your machine or CI runner, with zero data egress. Apache-2.0.

C5-DEC: Common Criteria for Cybersecurity, Cryptography, Clouds – Design, Evaluation and Certification. LLM-enabled toolkit for secure system design, development and evaluation via Common Criteria, SSDLC, SpecEngine/DocEngine, CRA, SBOM, threat modelling + risk assessment, and cryptography (incl. post-quantum), CLI/TUI/GUI

Cyberismo module for EU Cyber Resilience Act

Browser-based Yocto CVE dashboard for analyzing cve-summary.json, reviewing embedded Linux vulnerabilities, and exporting HTML/PDF security reports.

Resources related to EU's Cyber Resilience Act

Self-hosted threat modeling & risk assessment (TARA) for IEC 62443, EU CRA & NIS-2 - visual canvas, STRIDE, SBOM/CVE triage.

Self-hosted open-source cybersecurity governance platform for ISO 27001, NIS2, DORA, CRA, product security and AI governance.

GitHub Action for ForgeVault CRA product-security readiness checks

Risk-based release gate for CRA (Article 14), NIS2 and DORA compliance with SBOM, KEV correlation, and auditable evidence.

SBOM and CVE reports for a Linux root filesystem — a directory, a tarball or a squashfs image. Debian, Ubuntu and Alpine, scoped to the release. Writes Cyber Resilience Act evidence, and tells you whether the release still gets security updates.

Verifiable audit substrate for AI agents — EU AI Act Article 12 ready. Apache 2.0.

EU Cyber Resilience Act knowledge base as an OKF bundle for Meerkat and MCP

Public CRA Direct documentation for SBOM evidence, Article 14 workflows, HITL review, and audit trails.