{"id":"cra-readiness","title":"EU CRA Readiness Check","description":"Repository or manifests in, EU Cyber Resilience Act Art. 14 position out: dependency-advisor resolves every declared package to its locked version (deterministic, no model), those versions go to cra-exploit-clock as package URLs (OSV, CISA KEV, EPSS, EUVD), and each actively exploited component is joined back to the manifest that declares it with the fixed versions and the advisor's findings. Reports the 24 h / 72 h / 14 day reporting deadlines from the awareness time. Charged once, dependency-advisor + cra-exploit-clock at 20% below their combined list price; not charged when a required step fails.","roi":"One call tells a manufacturer whether an exploited vulnerability in its own dependency tree starts the CRA reporting clock, and which manifest line to change.","audience":"developer","channels":["x402","mcp","rapidapi","apify"],"endpoint":{"method":"POST","url":"https://agents.writerslogic.com/api/v1/pipelines/cra-readiness","path":"/api/v1/pipelines/cra-readiness","contentType":"application/json"},"price":{"amount":"2.40","currency":"USDC","network":"base","perCall":true,"failedCallsCharged":false},"inputSchema":{"type":"object","additionalProperties":false,"properties":{"repo":{"type":"string","minLength":3,"maxLength":200,"description":"Public GitHub repository: owner/repo, https://github.com/owner/repo[/tree/ref], a commit URL, or a pull request URL (analyzed at the PR head)."},"ref":{"type":"string","maxLength":200,"description":"Branch, tag or commit; defaults to the default branch."},"files":{"type":"array","maxItems":600,"description":"Alternative to repo: manifests (package.json, lockfile, pyproject.toml, requirements.txt, Cargo.toml) and source files with repository-relative paths.","items":{"type":"object","additionalProperties":false,"required":["path","content"],"properties":{"path":{"type":"string","minLength":1,"maxLength":300},"content":{"type":"string","maxLength":400000}}}},"ecosystems":{"type":"array","maxItems":3,"items":{"type":"string","enum":["npm","pypi","cargo"]},"description":"Restrict the analysis; default all detected."},"repoLicense":{"type":"string","maxLength":100,"description":"SPDX id of the repository's license, for alternative ranking; detected from manifests or LICENSE when absent."},"product":{"type":"object","additionalProperties":false,"required":["name"],"description":"Your product with digital elements; used only to fill the draft fields (defaults to the SBOM's own product name).","properties":{"name":{"type":"string","minLength":1,"maxLength":200},"version":{"type":"string","maxLength":100}}},"awareness_time":{"type":"string","maxLength":40,"description":"When the manufacturer became aware, ISO 8601 with UTC offset (e.g. 2026-11-04T09:30:00Z). Defaults to now. Taken as given; this agent cannot verify it."},"fix_available_at":{"type":"string","maxLength":40,"description":"When a corrective or mitigating measure became available, ISO 8601 with UTC offset; sets the Art. 14(2)(c) final-report date."}}},"resultSchema":{"type":"object","properties":{"readiness":{"type":"string","enum":["REPORTABLE_CANDIDATES","NO_EXPLOITED_EVIDENCE","INSUFFICIENT_EVIDENCE","NO_RESOLVED_VERSIONS"],"description":"REPORTABLE_CANDIDATES when an exploited vulnerability affects a resolved dependency; NO_EXPLOITED_EVIDENCE only when every resolved dependency was fully checked and none was unresolved."},"fixPlan":{"type":"array","items":{"type":"object","description":"Per exploited component: purl, package, manifest, range, usageFiles, kevDateAdded, cves, fixedVersions, advisorFindings."}},"deadlines":{"anyOf":[{"type":"object","description":"cra-exploit-clock's Art. 14(2) deadlines, or null when it did not run."},{"type":"null"}]},"nextStep":{"description":"cra-exploit-clock's next_step, or null."},"unresolved":{"type":"array","items":{"type":"object","description":"Declared packages with no resolved version (no lockfile entry); not checked for exploitation."}},"results":{"type":"object","description":"Each executed member step's full result, keyed by step id (forEach steps: one entry per item)."},"steps":{"type":"object","description":"Per step: status (ok | skipped | failed), reason, attempts, ms, inputSha256, outputSha256, and the output hashes of the upstream steps its input was derived from."},"partial":{"type":"boolean","description":"True when an optional step was missing or a member returned its own partial result."},"missing":{"type":"array","items":{"type":"object","description":"{step, reason, impact}"}},"deterministic":{"type":"boolean","description":"True only when every executed member answered without a model."}},"required":["results","steps","partial","missing","deterministic"]},"outputSchema":{"type":"object","properties":{"data":{"type":"object","properties":{"readiness":{"type":"string","enum":["REPORTABLE_CANDIDATES","NO_EXPLOITED_EVIDENCE","INSUFFICIENT_EVIDENCE","NO_RESOLVED_VERSIONS"],"description":"REPORTABLE_CANDIDATES when an exploited vulnerability affects a resolved dependency; NO_EXPLOITED_EVIDENCE only when every resolved dependency was fully checked and none was unresolved."},"fixPlan":{"type":"array","items":{"type":"object","description":"Per exploited component: purl, package, manifest, range, usageFiles, kevDateAdded, cves, fixedVersions, advisorFindings."}},"deadlines":{"anyOf":[{"type":"object","description":"cra-exploit-clock's Art. 14(2) deadlines, or null when it did not run."},{"type":"null"}]},"nextStep":{"description":"cra-exploit-clock's next_step, or null."},"unresolved":{"type":"array","items":{"type":"object","description":"Declared packages with no resolved version (no lockfile entry); not checked for exploitation."}},"results":{"type":"object","description":"Each executed member step's full result, keyed by step id (forEach steps: one entry per item)."},"steps":{"type":"object","description":"Per step: status (ok | skipped | failed), reason, attempts, ms, inputSha256, outputSha256, and the output hashes of the upstream steps its input was derived from."},"partial":{"type":"boolean","description":"True when an optional step was missing or a member returned its own partial result."},"missing":{"type":"array","items":{"type":"object","description":"{step, reason, impact}"}},"deterministic":{"type":"boolean","description":"True only when every executed member answered without a model."}},"required":["results","steps","partial","missing","deterministic"]},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]},"example":{"repo":"star7th/htq","product":{"name":"htq"}},"openapiOperation":{"operationId":"cra_readiness","summary":"EU CRA Readiness Check","description":"Repository or manifests in, EU Cyber Resilience Act Art. 14 position out: dependency-advisor resolves every declared package to its locked version (deterministic, no model), those versions go to cra-exploit-clock as package URLs (OSV, CISA KEV, EPSS, EUVD), and each actively exploited component is joined back to the manifest that declares it with the fixed versions and the advisor's findings. Reports the 24 h / 72 h / 14 day reporting deadlines from the awareness time. Charged once, dependency-advisor + cra-exploit-clock at 20% below their combined list price; not charged when a required step fails.\n\nPrice: 2.40 USDC on Base (x402).","x-x402-price-usdc":"2.40","x-x402-amount":"2400000","x-audience":"developer","x-sample-url":"https://agents.writerslogic.com/api/v1/samples/cra-readiness","security":[{"x402":[]},{"apiKey":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"properties":{"repo":{"type":"string","minLength":3,"maxLength":200,"description":"Public GitHub repository: owner/repo, https://github.com/owner/repo[/tree/ref], a commit URL, or a pull request URL (analyzed at the PR head)."},"ref":{"type":"string","maxLength":200,"description":"Branch, tag or commit; defaults to the default branch."},"files":{"type":"array","maxItems":600,"description":"Alternative to repo: manifests (package.json, lockfile, pyproject.toml, requirements.txt, Cargo.toml) and source files with repository-relative paths.","items":{"type":"object","additionalProperties":false,"required":["path","content"],"properties":{"path":{"type":"string","minLength":1,"maxLength":300},"content":{"type":"string","maxLength":400000}}}},"ecosystems":{"type":"array","maxItems":3,"items":{"type":"string","enum":["npm","pypi","cargo"]},"description":"Restrict the analysis; default all detected."},"repoLicense":{"type":"string","maxLength":100,"description":"SPDX id of the repository's license, for alternative ranking; detected from manifests or LICENSE when absent."},"product":{"type":"object","additionalProperties":false,"required":["name"],"description":"Your product with digital elements; used only to fill the draft fields (defaults to the SBOM's own product name).","properties":{"name":{"type":"string","minLength":1,"maxLength":200},"version":{"type":"string","maxLength":100}}},"awareness_time":{"type":"string","maxLength":40,"description":"When the manufacturer became aware, ISO 8601 with UTC offset (e.g. 2026-11-04T09:30:00Z). Defaults to now. Taken as given; this agent cannot verify it."},"fix_available_at":{"type":"string","maxLength":40,"description":"When a corrective or mitigating measure became available, ISO 8601 with UTC offset; sets the Art. 14(2)(c) final-report date."}}},"example":{"repo":"star7th/htq","product":{"name":"htq"}}}}},"responses":{"200":{"description":"Paid result with provenance","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"readiness":{"type":"string","enum":["REPORTABLE_CANDIDATES","NO_EXPLOITED_EVIDENCE","INSUFFICIENT_EVIDENCE","NO_RESOLVED_VERSIONS"],"description":"REPORTABLE_CANDIDATES when an exploited vulnerability affects a resolved dependency; NO_EXPLOITED_EVIDENCE only when every resolved dependency was fully checked and none was unresolved."},"fixPlan":{"type":"array","items":{"type":"object","description":"Per exploited component: purl, package, manifest, range, usageFiles, kevDateAdded, cves, fixedVersions, advisorFindings."}},"deadlines":{"anyOf":[{"type":"object","description":"cra-exploit-clock's Art. 14(2) deadlines, or null when it did not run."},{"type":"null"}]},"nextStep":{"description":"cra-exploit-clock's next_step, or null."},"unresolved":{"type":"array","items":{"type":"object","description":"Declared packages with no resolved version (no lockfile entry); not checked for exploitation."}},"results":{"type":"object","description":"Each executed member step's full result, keyed by step id (forEach steps: one entry per item)."},"steps":{"type":"object","description":"Per step: status (ok | skipped | failed), reason, attempts, ms, inputSha256, outputSha256, and the output hashes of the upstream steps its input was derived from."},"partial":{"type":"boolean","description":"True when an optional step was missing or a member returned its own partial result."},"missing":{"type":"array","items":{"type":"object","description":"{step, reason, impact}"}},"deterministic":{"type":"boolean","description":"True only when every executed member answered without a model."}},"required":["results","steps","partial","missing","deterministic"]},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]}}}},"400":{"description":"Invalid request (no payment consumed)","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"401":{"description":"Invalid X-API-KEY","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"402":{"description":"Payment required or invalid","content":{"application/json":{"schema":{"type":"object","description":"x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)","properties":{"x402Version":{"type":"integer"},"error":{"type":"string"},"code":{"type":"string"},"resource":{"type":"object"},"accepts":{"type":"array","items":{"type":"object"}},"extensions":{"type":"object"}}}}}},"502":{"description":"Upstream failure; the payment is released or not settled","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}}}},"links":{"docs":"https://writerslogic.com/agents/cra-readiness/","docsJson":"https://writerslogic.com/agents/cra-readiness.json","sample":"https://agents.writerslogic.com/api/v1/samples/cra-readiness","openapi":"https://agents.writerslogic.com/openapi.json","catalog":"https://agents.writerslogic.com/api/v1/catalog","verifyProvenance":"https://agents.writerslogic.com/api/v1/verify-provenance","index":"https://writerslogic.com/agents/index.json"}}