Getting started with MM CRA Toolkit

Three steps take you from a fresh install to a complete CRA technical file for your first plugin: install, run the Setup Wizard, then generate your artifacts.

What the toolkit does

The EU Cyber Resilience Act (Regulation (EU) 2024/2847) applies to any product with digital elements placed on the EU market — a commercial WordPress plugin sold to a single EU customer is in scope. From 11 September 2026 you owe a Software Bill of Materials, a published Vulnerability Disclosure Policy, and a signed EU Declaration of Conformity for every product, plus ongoing vulnerability handling. MM CRA Toolkit produces each artifact from inside your existing WordPress admin. It is self-hosted: the only outbound calls are to OSV.dev for advisory checks and to mmplugs.com for license verification and updates.

The three steps

1. Install the toolkit — upload the zip from your account and activate it.
2. Run the Setup Wizard — five steps that capture manufacturer identity, your EU representative, VDP fields, Declaration of Conformity defaults, and monitoring preferences.
3. Generate your artifacts — from the dashboard, generate the SBOM, VDP, and Declaration of Conformity for each plugin, then export a Compliance Bundle (Pro).

Requirements

• WordPress 6.2 or higher, PHP 7.4 or higher
• libsodium (default in PHP 7.4+) for signed update verification
• PHP ZipArchive for SBOM-from-zip and bundle export
• Outbound HTTPS to osv.dev and mmplugs.com

Free and Pro

The free tier covers the core artifacts every WordPress product author needs: SBOM generation, the Vulnerability Disclosure Policy, the Declaration of Conformity, a compliance checklist, and security.txt. Pro adds multi-plugin support, the Plugin Scanner, OSV.dev monitoring on a weekly cron, and the one-click Compliance Bundle. See Activate your license to unlock Pro.