From lockfile to Cyber Resilience Act evidence pack

Paste a lockfile or SBOM and get every component checked against the OSV vulnerability database, the smallest fixed version per flaw, licence risk, and a mapping to CRA Annex I and Article 14.

Audit your dependencies on the Apify Store · Version 1.0.2, updated 2026-10-24

Who it is for

CTOs, engineering leads and compliance owners at software and connected-device makers selling into the EU, who must show their dependency tree is under control before the Cyber Resilience Act applies in full on 11 December 2027.

What you get

Every flaw once

One finding per distinct flaw with CVE and GHSA aliases merged, a CVSS v3 score computed from the published vector, and the smallest fixed version above yours or no fix published.

VEX-style triage

Affected, or proposed not affected for dev-only packages, which you confirm.

Licence risk

Licences from your file or the npm and PyPI registries, classified for copyleft or restricted terms. Ambiguous or missing ones are flagged unresolved, never guessed.

Remediation plan and CRA mapping

Fix now, schedule, no fix or licence review, and each CRA requirement marked evidence provided, action needed or not assessed.

How it works

Choose audit_inventory and paste your file into content, with its filename.
Optionally name the product and set include_dev.
Run it in Apify Console, through the API or from your AI assistant. Use cra_requirements to read the requirements themselves.

Also runs from AI assistants through Apify's MCP server.

Use cases

Preparing evidence for a CRA conformity assessment.
A vulnerability and licence review before a release or a due diligence.
Prioritising which dependencies to upgrade first.

Pricing

CRA evidence pack for one lockfile or SBOM One audit of a lockfile or SBOM: OSV vulnerabilities with fixes, licence review, VEX-style triage and the CRA Annex I map. Unreadable or unsupported files are free.	$1.76
Component assessed (first 1,000) Each unique package checked against OSV, up to 1,000 per audit. Components OSV could not answer are free.	$0.006
Component assessed (1,001 to 2,000) Each unique package beyond the first 1,000 in one audit, at a lower rate. Components OSV could not answer are free.	$0.003

You pay per event listed above; there is no monthly fee.

Inputs

`tool` required	What to do `cra_requirements` · `audit_inventory` default: `audit_inventory`
`content`	Content
`filename`	Filename
`product`	Product
`include_dev`	Include dev default: `True`

Output fields

tool rules_version disclaimer sources requirements supported_inputs licence_classes headline snapshot input_format product counts max_cvss coverage buckets findings findings_listed findings_total licences licences_listed licences_flagged_total cra_dates billable_components partial

Limits

Process duties such as disclosure policy, update distribution and Article 14 reporting cannot be shown by an inventory and are marked not assessed.
Exploitation status is not checked. Not legal advice.
Up to 2,000 unique components; yarn berry, Pipfile.lock and XML SBOMs are refused for free.

Questions

Which files does it read?

package-lock.json, yarn.lock, pnpm-lock.yaml, uv.lock, poetry.lock, pinned requirements.txt, and CycloneDX or SPDX JSON SBOMs.

What does an audit cost?

$1.76 per audit plus $0.006 per component assessed, or $0.003 per component in bulk.

Is this a CRA certificate?

No. It is an evidence pack: what your inventory shows, what needs action and what an inventory cannot show.

Audit your dependencies