krava.dev

What It Is

Krava is a workflow tool for developers dealing with EU Cyber Resilience Act (CRA) compliance. It does not position itself as a new vulnerability scanner; instead, it describes itself as the “layer between scanning tools and regulators.” Scanners are responsible for finding dependencies, vulnerabilities, and license issues, while Krava turns those findings into CRA-required reporting timelines, disclosure workflows, compliance status tracking, and technical documentation management.

Core Features and Ecosystem

The site explicitly notes that the CRA imposes requirements on software products sold in the EU, including 24-hour vulnerability reporting, SBOMs for every release, vulnerability disclosure mechanisms, conformity assessment, 10-year retention of technical documentation, and security updates during the support period. Krava plans to plug into development workflows through a GitHub Action and a compliance dashboard, with krava-bot leaving Pull Request comments that provide compliance scores—for example, missing license information in an SBOM, high-severity CVEs, unknown licenses, missing security.txt, or an undeclared support period.

Compared with tools such as Trivy, Grype, Syft, Snyk, and FOSSA, Krava’s differentiator is that it does not merely generate JSON output or scan reports. Instead, it manages the CRA compliance workflow, including ENISA/CSIRT reporting timelines, vulnerability disclosure management, and regulatory documentation generation. The copy says it can accept scan results from “whichever tool you use,” but it does not list the specific supported formats, languages, package managers, or CI/CD platforms.

Pricing and Maturity

At the moment, the website only offers early access. It does not disclose its pricing model, free tier, enterprise plan, payment methods, or service levels. It also does not state whether the product is open source, supports self-hosting, or provides an API/SDK. Since the GitHub Action and dashboard are still being built, Krava is better suited for early evaluation and trial registration than for immediate procurement as a production-grade compliance system.

Pros, Cons, and Who It’s For

Its main strength is a very clear positioning: it addresses the non-scanning parts of CRA implementation—reporting deadlines, disclosure workflows, compliance documentation, and continuous status tracking. Its focus on the GitHub PR workflow also fits naturally into developers’ daily routines. The downside is that public information remains limited, with no real product screenshots, documentation, integration list, security details, or pricing.

Krava is a good fit for teams selling mobile apps, desktop software, SDKs, libraries, firmware, or IoT products into the EU, especially those already using SBOM or vulnerability scanning tools but lacking compliance process management. According to the site, pure SaaS products are not covered by the CRA and instead fall under NIS2, so they may not be the primary target users.

China Access

The site does not provide information about access from mainland China, payments, or localization, so china_access can only be marked as unknown. If network access or procurement is restricted, teams can continue using open-source scanning tools such as Trivy, Grype, and Syft, while managing CRA documentation and reporting through internal processes.