CRA-AGENT — Cyber Resilience Act Compliance Agent
An autonomous agent that scans every commit for vulnerabilities, files triaged Jira tickets, and reacts to Jira updates by suppressing known issues or opening a fix pull request, mapped to Cyber Resilience Act requirements.
CRA-AGENT is a Python system for continuous compliance monitoring against the EU Cyber Resilience Act. It watches commits, runs scanners such as semgrep, pip-audit and gitleaks on the changed files, filters out already-known issues, classifies the rest by severity and exploitability with a language model, and opens Jira tickets with triage recommendations.
It also listens for Jira webhook updates: marking an issue as a known issue adds a suppression rule, while marking it as requiring a fix triggers an agent that generates a patch and opens a pull request. Findings are mapped to specific CRA Annex I and Annex II requirements and Article 13 reporting obligations. It is built with LangGraph and LangChain, FastAPI for its webhook server, and supports OpenAI or Anthropic models.