Linux 软件免费装

在这里免费安装WordPress以及其他软件

Banner图

MMCRA Toolkit

开发者 masseym
更新时间 2026年7月5日 14:38
PHP版本: 7.4 及以上
WordPress版本: 7.0
版权: GPLv2 or later
版权网址: 版权信息

标签

compliance cra sbom cyclonedx vulnerability-disclosure

下载

1.0.0

详情介绍:

Selling a commercial WordPress plugin in the EU? Starting September 11, 2026 you need a Software Bill of Materials, a Vulnerability Disclosure Policy, and an EU Declaration of Conformity in your plugin's technical file. MMCRA Toolkit generates all three from your plugin's headers and dependency files, in an afternoon, with no servers or accounts. Links What this plugin generates Who this is for Independent WordPress plugin developers and small teams who sell commercial plugins to EU customers and need to ship the technical-file artifacts the CRA mandates. The free version covers every plugin you have installed, with no limit. Ongoing OSV.dev vulnerability monitoring, incident tracking, and PDF audit reports are in MMCRA Toolkit Pro. 5-step setup wizard The wizard walks you through company identity, vulnerability disclosure policy, SBOM generation, and monitoring activation. It also explains the underlying CRA articles in plain English so you understand what each artifact is for, not just how to click the buttons. What this is NOT Pro features MMCRA Toolkit Pro adds: weekly OSV.dev vulnerability monitoring with email alerts (tiered by how many plugins you monitor), incident tracking, AI-assisted advisory triage and remediation drafting (Claude), PDF audit reports, the Compliance Bundle export (single zip per plugin combining SBOM + VDP + DoC + audit log), Plugin Scanner static analysis, SBOM-from-zip uploads for third-party code, and audit log CSV export. Translations MMCRA Toolkit is translation-ready. The included .pot file in languages/ covers every translatable string. Priority locales for the EU market — German, French, Italian, Spanish, Dutch — are open for community translation via translate.wordpress.org.

安装:

  1. Upload via Plugins → Add New → Upload Plugin, or extract to wp-content/plugins/mmcra-toolkit/.
  2. Activate the plugin.
  3. Open CRA Toolkit → Setup Wizard and follow the 5 steps.
  4. Generate SBOMs, publish your VDP, and sign your Declaration of Conformity as you ship releases.

屏幕截图:

  • Setup Wizard — five-step flow walking through company identity, VDP, SBOM generation, and monitoring activation.
  • SBOM Generator — pick a plugin, generate a valid CycloneDX 1.6 file, view recent SBOMs with download links.
  • Vulnerability Disclosure Policy editor — contact channels, in-scope and out-of-scope guidance, optional PGP key, with publish-as-page and export-as-HTML actions.
  • Declaration of Conformity editor — per-product CRA Annex V form covering manufacturer identity, risk class, conformity assessment route, applied standards, and signature block.
  • Audit log — every artifact written, with timestamp, user, plugin slug, path, and SHA-256 hash.
  • Company Settings — manufacturer identity and optional EU authorised representative section per CRA Article 17.

升级注意事项:

1.0.0 Initial release.

常见问题:

What does the CRA require of WordPress plugin developers?

The EU Cyber Resilience Act (Regulation 2024/2847) applies to any commercial digital product placed on the EU market. For a plugin developer that means you need to identify your manufacturer entity, produce a Software Bill of Materials, publish a coordinated vulnerability disclosure policy, and ship a signed Declaration of Conformity per product. From September 11, 2026, you also have to report actively exploited vulnerabilities to ENISA within 24 hours.

Do I need this if I only sell to UK or US customers?

The CRA applies to any product placed on the EU market. If you sell to EU customers — directly or through a marketplace — you're in scope. If you only sell to non-EU customers, the CRA does not apply, but the technical artifacts the toolkit produces are still useful as evidence of secure development practice.

How is the free version different from Pro?

The free version generates SBOMs, Disclosure Policies, and Declarations of Conformity for every plugin you have installed — no plugin limit. Pro adds ongoing weekly OSV.dev vulnerability monitoring (tiered by how many plugins you monitor), incident tracking, AI-assisted triage and drafting, PDF audit reports, and the single-zip Compliance Bundle export for regulator handoff.

Is the SBOM compatible with regulator tooling?

Yes. The toolkit outputs CycloneDX 1.6 JSON, which is one of the two SBOM formats explicitly named in the CRA's harmonised standards. The same format works with OWASP Dependency-Track, GitHub Advanced Security, and most enterprise procurement portals.

Where does the audit log live?

In a custom table in your WordPress database (wp_mmcra_audit_log). Every artifact written by the toolkit is recorded with timestamp, user, plugin slug, path, and the SHA-256 of the content at write time. This gives you tamper-evident evidence that you produced the file on the date it claims.

Does this plugin send any data to external services?

No. The free plugin operates entirely on your WordPress install. No telemetry, no phone-home, no third-party API calls. Pro optionally talks to OSV.dev (Google's open-source vulnerability database) for weekly monitoring and to Anthropic's Claude API for AI-assisted triage, both opt-in.

Why a wizard instead of just a settings page?

Because the CRA is unfamiliar territory for most plugin developers. The wizard explains what each step is, why the CRA requires it, and what happens if you skip it. You can re-run it any time from CRA Toolkit → Setup Wizard.

更新日志:

1.0.0 Initial public release.