Validate an SPDX SBOM against the EU CRA Annex I machine-readable SBOM requirement (art-138) → check Annex I essential requirements: SBOM machine-readable, top-level dep coverage, vulnerability handling policy, secure-by-default, and conformity route (art-139) → assess CRA Article 14 vulnerability reporting readiness: 24-hour early warning, 72-hour notification, CSIRT/ENISA endpoint (art-140). Art. 14 obligations apply 11 Sep 2026. Zero network.
validate_spdx_sbom{
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"name": "validate_spdx_sbom",
"arguments": {
"sbom": {
"spdxVersion": "SPDX-2.3",
"SPDXID": "SPDXRef-DOCUMENT",
"packages": [
{
"name": "express",
"versionInfo": "4.18.2",
"downloadLocation": "https://registry.npmjs.org/express/-/express-4.18.2.tgz"
}
],
"relationships": [
{
"spdxElementId": "SPDXRef-DOCUMENT",
"relationshipType": "DESCRIBES",
"relatedSpdxElement": "SPDXRef-Package-express"
}
]
}
}
},
"id": 1
}
check_cra_annex1_completeness{
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"name": "check_cra_annex1_completeness",
"arguments": {
"sbom_present": true,
"sbom_machine_readable": true,
"top_level_deps_covered": true,
"vuln_handling_policy_present": true,
"secure_by_default": true,
"conformity_route": "self_assessment"
}
},
"id": 2
}
assess_cra_vuln_reporting_readiness{
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"name": "assess_cra_vuln_reporting_readiness",
"arguments": {
"actively_exploited_detection": true,
"early_warning_24h_process": true,
"notification_72h_process": true,
"csirt_enisa_endpoint_configured": true,
"coordinated_disclosure_policy": true
}
},
"id": 3
}