CRA-AGENT — Cyber Resilience Act Compliance Agent
An autonomous agentic AI system for continuous CRA compliance monitoring. It scans every commit, identifies vulnerabilities, creates Jira tickets with triage recommendations, and reacts to Jira webhook updates (suppress known issues or auto-fix).
Architecture Overview
┌─────────────────────────────────────────────────────────────────────┐
│ CRA-AGENT Orchestrator │
│ (main.py) │
└──────────────┬──────────────────────────────────────┬───────────────┘
│ │
┌─────────▼──────────┐ ┌──────────▼──────────┐
│ Git Monitor │ │ Webhook Server │
│ (commit watcher) │ │ (Jira updates) │
└─────────┬──────────┘ └──────────┬──────────┘
│ │
┌─────────▼──────────┐ ┌──────────▼──────────┐
│ Diff Analyzer │ │ Jira Handler │
│ (changed files) │ │ (route actions) │
└─────────┬──────────┘ └──────────┬──────────┘
│ │
┌─────────▼──────────────────────────────────────▼──────────┐
│ Agent Layer (LangGraph) │
│ ┌────────────┐ ┌────────────┐ ┌────────────┐ ┌────────┐ │
│ │ Scanner │ │ Triage │ │ Fixer │ │ Jira │ │
│ │ Agent │ │ Agent │ │ Agent │ │ Agent │ │
│ └─────┬──────┘ └─────┬──────┘ └─────┬──────┘ └───┬────┘ │
└────────┼──────────────┼──────────────┼────────────┼───────┘
│ │ │ │
┌────────▼──────────────▼──────────────▼────────────▼───────┐
│ Scanner Layer │
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────────┐ │
│ │ Dependency │ │ SAST │ │ Secrets │ │
│ │ Scanner │ │ Scanner │ │ Scanner │ │
│ └──────────────┘ └──────────────┘ └──────────────────┘ │
│ ┌──────────────────────────────────────────────────────┐ │
│ │ Suppression Store (SQLite) — known/ignored vulns │ │
│ └──────────────────────────────────────────────────────┘ │
└────────────────────────────────────────────────────────────┘
│
┌────────▼──────────────────────────────────────────────────┐
│ Integrations │
│ ┌──────────────┐ ┌──────────────┐ ┌────────────────┐ │
│ │ Jira Client │ │ LLM Client │ │ Git Client │ │
│ └──────────────┘ └──────────────┘ └────────────────┘ │
└────────────────────────────────────────────────────────────┘
Project Structure
CRA-AGENT/
├── Project.md # Project requirements
├── README.md # This file
├── DESIGN.md # Detailed design document
├── pyproject.toml # Python project config & dependencies
├── .env.example # Environment variable template
├── config/
│ ├── __init__.py
│ ├── settings.py # App settings (pydantic-settings)
│ └── scanner_rules.yaml # Scanner rule definitions
├── src/
│ ├── __init__.py
│ ├── main.py # Entry point / orchestrator
│ ├── core/
│ │ ├── __init__.py
│ │ ├── models.py # Pydantic data models
│ │ ├── git_monitor.py # Commit watcher (polling / webhook)
│ │ └── diff_analyzer.py # Analyze commit diffs
│ ├── agents/
│ │ ├── __init__.py
│ │ ├── orchestrator.py # LangGraph state machine
│ │ ├── scanner_agent.py # Runs scanners on diffs
│ │ ├── triage_agent.py # Recommends triage actions
│ │ ├── fixer_agent.py # Auto-fixes vulnerabilities
│ │ └── jira_agent.py # Creates/updates Jira tickets
│ ├── scanners/
│ │ ├── __init__.py
│ │ ├── base_scanner.py # Abstract scanner interface
│ │ ├── dependency_scanner.py
│ │ ├── sast_scanner.py
│ │ ├── secrets_scanner.py
│ │ └── suppression_store.py
│ ├── integrations/
│ │ ├── __init__.py
│ │ ├── jira_client.py # Jira REST API client
│ │ ├── llm_client.py # LLM provider abstraction
│ │ └── git_client.py # Git operations wrapper
│ ├── webhook/
│ │ ├── __init__.py
│ │ ├── server.py # FastAPI webhook server
│ │ └── handlers.py # Jira webhook event handlers
│ └── utils/
│ ├── __init__.py
│ ├── logger.py # Structured logging
│ └── helpers.py # Shared utilities
├── skills/ # Agent skill definitions (markdown)
│ ├── scan_commit.md
│ ├── triage_vulnerability.md
│ ├── fix_vulnerability.md
│ └── handle_jira_update.md
├── tests/
│ ├── __init__.py
│ ├── conftest.py
│ ├── test_scanners/
│ ├── test_agents/
│ └── test_webhook/
└── docker-compose.yml # Local dev services
Tech Stack
| Layer | Technology |
|---|---|
| Language | Python 3.11+ |
| Agent Framework | LangGraph + LangChain |
| Webhook Server | FastAPI + Uvicorn |
| Data Models | Pydantic v2 |
| Git | GitPython |
| Jira | httpx (async REST) |
| LLM | OpenAI / Anthropic (pluggable) |
| Suppression DB | SQLite (via sqlite3) |
| Scanners | semgrep, pip-audit, gitleaks (CLI) |
| Config | pydantic-settings + YAML |
| Testing | pytest + pytest-asyncio |
Quick Start (planned)
# 1. Install dependencies pip install -e ".[dev]" # 2. Configure environment cp .env.example .env # Edit .env with your Jira, LLM, and Git credentials # 3. Run the agent python -m src.main # 4. Run webhook server (separate process) uvicorn src.webhook.server:app --reload --port 8080
Workflow
Commit-Triggered Scan
GitMonitordetects a new commit (polling or webhook).DiffAnalyzerextracts changed files and hunks.ScannerAgentruns all scanners on changed files.SuppressionStorefilters out known/ignored vulnerabilities.TriageAgentclassifies remaining vulns (severity, exploitability, CRA relevance).JiraAgentcreates Jira tickets with triage recommendations.
Jira Webhook Reaction
WebhookServerreceives Jira issue update event.JiraHandlerparses the transition/comment.- If "Ignore / Known Issue" →
SuppressionStoreadds a suppression rule. - If "Fix Required" →
FixerAgentgenerates and applies a fix, then opens a PR. JiraAgentupdates the ticket with the fix status.
CRA Compliance Mapping
The agent maps findings to CRA Annex I essential requirements:
- Annex I §1 — Security requirements (vulnerability handling)
- Annex I §2 — Vulnerability handling process
- Annex II — SBOM / software component transparency
- Article 13 — Reporting obligations for actively exploited vulnerabilities
Features
- Automated Vulnerability Scanning: Scans every commit using multiple scanners (SAST, dependency, secrets)
- AI-Powered Triage: Uses LLMs to classify severity and recommend actions
- Jira Integration: Automatically creates and updates tickets
- EUVD Sync: Synchronizes with EU Vulnerability Database every 4 hours
- Auto-Fix Capability: Generates fixes and opens pull requests
- Enterprise Dashboard: Real-time monitoring with Streamlit UI
- CRA Compliance Mapping: Maps findings to CRA Annex I requirements
Dashboard
Run the enterprise-grade dashboard:
streamlit run src/dashboard/app.py
Features:
- Real-time vulnerability monitoring
- EUVD auto-sync with countdown timer
- Today's top 10 vulnerabilities report
- Scan history and metrics
- ROI tracking
Contributing
Contributions are welcome! Please read our Contributing Guide for details on:
- How to submit pull requests
- Coding standards
- Reporting issues
- Feature requests
Code of Conduct
This project adheres to the Contributor Covenant Code of Conduct. By participating, you are expected to uphold this code.
License
This project is licensed under the Apache License 2.0 - see the LICENSE file for details.
Copyright 2026 Rohit Kulkarni
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0