Cybiq Cra Scope

Cybiq CRA scope check

Operator: HEXENKRAFT s.r.o. (IČO 29665931). Product site: https://cybiq.eu

Note: prefer npx skills add maticijus/hexenkraft-agent-skills --skill cybiq-cra-scope if the skills.sh detail page lags.

When to use

• “Does the Cyber Resilience Act apply to this product?”
• Conformity route / Annex III Class I–II / Annex IV critical
• Manufacturer, importer, or distributor obligations
• Key dates (reporting duties, full application)
• Buy verification checklist (€49) or compliance pack (€199)

When not to use

• Asking the model to invent CRA law text (use Cybiq; every claim is OJ-anchored server-side)
• Treating the result as legal advice or a notified-body certificate
• Paying / waiving withdrawal for the human

Discovery (read first)

Auth

None for classify. Pack purchase = Stripe Checkout URL via MCP; human pays.

Tools

MCP tools: classify_cra, start_pack_checkout, check_order_status

1) Classify — classify_cra / POST /api/classify

Deterministic. Partial answers return verdict: "needs_review" and list what is missing (no guessing). Unknown keys/values → 422.

curl -sS -X POST https://cybiq.eu/api/classify \
  -H 'Content-Type: application/json' \
  -d '{
    "locale":"en",
    "answers":{
      "market":"commercial",
      "ossMonetized":false,
      "productKind":"hardware_with_software",
      "otherRegime":"none",
      "role":"manufacturer",
      "category":"network_device"
    }
  }'

answers fields (any subset allowed):

locale: en | de (prose language only; legal anchors unchanged).

Category enum: general_app, browser, password_manager, identity_access_management, anti_malware, vpn, network_management, siem, boot_manager, pki_certificate_issuance, operating_system, security_microprocessor_microcontroller, smart_home_assistant_or_security, connected_toy, health_wearable, network_device, network_critical_infrastructure, firewall_ids_ips, tamper_resistant_chip, hypervisor_container_runtime, hsm_secure_element, industrial_control, other

Offline option: map answers via GET /api/decisions.json (large). Prefer POST /api/classify for a single product.

2) Buy pack — start_pack_checkout (MCP)

Tiers from offers (re-read before quoting):

Call MCP tool start_pack_checkout with the tier. Hand the returned Checkout URL to the human. Do not open/pay it as the agent. Poll check_order_status with session_id; do not fetch one-time unlock URLs yourself.

Idempotency: if the tool accepts idempotency_key, reuse it for retries of the same tier/locale.

3) Optional MCP JSON-RPC shape

curl -sS -X POST https://cybiq.eu/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{
    "jsonrpc":"2.0",
    "id":1,
    "method":"tools/call",
    "params":{
      "name":"classify_cra",
      "arguments":{
        "locale":"en",
        "answers":{"market":"commercial","productKind":"installable_software","role":"manufacturer","category":"general_app","otherRegime":"none"}
      }
    }
  }'

(If the server expects an initialize handshake first, follow the MCP Streamable HTTP sequence from the OpenAPI /mcp description.)

Errors

Failures are RFC 9457 problem+json when applicable. Read code when present.

Output to the human

1. Verdict + conformity route + key obligations with OJ citations from the response.
2. Explicit: not legal advice; Cybiq does not file with authorities.
3. If they need templates: €49 or €199 checkout link for human payment.
4. Mention reporting-duty / application dates only as returned by the API (don’t invent dates).

Do not

• Paste long CRA excerpts into the skill or chat; call the API
• Silently drop unknown answers
• Claim notified-body certification from a classify result