Free agent pluginNo purchase required
ECZ-ID SBOM & CRA Readiness is a free agent plugin.
No account, no sign-in, no licence key, no trial and no paywall. Every capability it has works in full the moment you install it, in whatever host you run it in. It is open source under the MIT licence.
It answers one question: Could your team identify an affected component and its evidence chain within the CRA reporting window?
- A filename-and-path-only review of the SBOM and Cyber Resilience Act evidence in a workspace you choose — SBOM documents, lockfiles, VEX and CSAF statements, disclosure policy, provenance and release records.
- A deterministic Review Priority with its reasons, why each evidence class is asked for, and what to review next.
- The same detectors and guidance as the free VS Code extension, with no file ever opened and no network request made.
/plugin marketplace add Ecocitizenz/eczid-agent-plugins
/plugin install eczid-sbom-cra-readiness@eczid-pluginsVS Code, GitHub Copilot and any Agent Skills host are on the plugins page. None of those routes asks for payment, an account or a key.
ECZ-ID SBOM & CRA Readiness for VS Code runs the same detectors and guidance, and is free with no paid edition. Marketplace ↗ · Open VSX ↗
Everything priced on this page is optional and separate. ECZ-ID SBOM credentials — subscription products that turn a reviewed posture into resolver-verifiable proof a counterparty can check. They are set up and paid for in TrustOps, not here. None of it is required. The plugin is complete without it, nothing the plugin does is withheld until you buy anything, and the plugin never runs checkout, sells a subscription or grants entitlement.
SBOM Credentials
Three tiers of software-supply-chain evidence — independently verifiable through the ECZ-ID Resolver. Choose the tier that matches your release cadence and buyer footprint, then move into the guided flow. Acquisition is handled in TrustOps. Verification is handled in Resolver. This site documents and routes.
What this is
SBOM — Software Bill of Materials — is the evidence chain that lets a buyer, auditor, or regulator independently confirm what a piece of software is built from. ECZ-ID SBOM credentials convert your SBOM data, vulnerability posture, product evidence record, and IoT device provenance into resolver-verifiable credentials that a counterparty can query directly — without you sending a spreadsheet or PDF.
The site explains what each tier covers and routes you to TrustOps to acquire it. Resolver is where the evidence is later Resolver-checked by counterparties. The site does not issue credentials, host checkout, or perform verification.
Choose a tier
Optional and separateNot required to use the free agent plugin
The SBOM credential tiers below are paid subscriptions.
They are a different thing from the free ECZ-ID SBOM & CRA Readiness plugin and the free VS Code extension above. Those two do the reviewing your own SBOM and CRA evidence; these turn a reviewed posture into resolver-verifiable proof a counterparty can check without asking you for documents. Nothing the free tools do is withheld until you buy one, and acquisition happens in TrustOps, not on this site.
SBOM Essentials
Software suppliers entering SBOM scope or supplying a small number of regulated or enterprise buyers.
Baseline SBOM-aligned evidence: software supply chain transparency, product evidence record, cyber posture, and IoT device provenance — independently queryable in Resolver.
Fits when: You need SBOM evidence in a form a buyer or auditor can verify without document exchange.
What is inside
- ·Software Supply Chain Passport™
- ·Product Passport™
- ·Cyber Resilience Passport™
- ·IoT Device Passport™
SBOM Managed
Software suppliers whose release cadence is outpacing manual SBOM evidence cycles.
Everything in Essentials, plus per-release SBOM refresh, vulnerability disclosure cadence, and component drift review support.
Fits when: Your SBOM is in resolver, but stale provenance between releases is becoming the operational risk.
What is inside
- ·SBOM Essentials baseline
- ·Per-release SBOM refresh
- ·Vulnerability disclosure cadence
- ·Component drift review support
SBOM Enterprise
Software vendors at portfolio scale where SBOM exposure is a board, audit-committee, insurer, and capital-provider concern.
Everything in Managed, plus portfolio-wide SBOM operations, critical-infrastructure software evidence record, board and capital disclosure, and Capital Access Overlay alignment.
Fits when: You need a single resolver entry covering portfolio SBOM posture for buyers, auditors, insurers, and capital providers.
What is inside
- ·SBOM Managed baseline
- ·Portfolio-wide SBOM operations
- ·Board and capital SBOM disclosure pack
- ·Critical-infrastructure software evidence record
- ·Capital Access Overlay alignment
How the flow works
- 1Explain. This page sets out what each SBOM tier covers and who it fits.
- 2Guided flow. Each tier has a short qualification and breakdown flow on this site.
- 3TrustOps midpoint. Halfway through the flow you are routed into TrustOps to acquire the tier.
- 4Return. When TrustOps completes acquisition it returns you to this site with continuation state, and the flow resumes from the post-acquisition step.
- 5Verification. Counterparties verify your SBOM posture independently at resolver.ecocitizenz.org. Verification is not performed on this site.
What this site does not claim
- · This site does not issue regulator certifications.
- · This site does not perform vulnerability disclosure evidence record.
- · This site does not host checkout or take payment for credentials.
- · This site does not verify credentials — Resolver does that, independently.
- · SBOM tiers describe ECZ-ID credential coverage, not regulator endorsement.
Formal governance and specifications are published at ecocitizenz.org. ECZ-ID provides resolver-verifiable software-supply-chain evidence, not regulatory authority or endorsement.
DORA scope as well?
If your ICT operating posture is also under DORA scope, the DORA + SBOM Enterprise Suite combines DORA Enterprise and SBOM Enterprise into a single resolver-backed programme.