craclock

When Grype, Trivy or Dependency-Track turns up something in your product that's actually being exploited, craclock works out whether you have to report it, prepares the report, and keeps the proof of when you knew and what you filed. You submit it yourself: a filing is a legal statement by you, not by a tool, so craclock hands you the finished text instead of sending it for you.

Not yet released. craclock hasn’t shipped its first build. The v1 CLI will be a thin client of the craclock HTTP API. Every subcommand below is fixed for v1. See the Quickstart for these commands run in sequence against one real scenario.

Summary

craclock init
craclock product create --name <name> [--eu-establishment-country <ISO-3166-1 alpha-2>]
craclock sbom push <product-version-id> --file <cyclonedx-or-spdx.json>
craclock scan push <product-version-id> --file <grype-or-trivy.json>
craclock signals --exploited
craclock case open --type AEV|SI --product-version <id> --awareness-at <RFC3339> [--signal <id>]
craclock case package <case-id> --stage ew|notif|final [--json]
craclock case submitted <case-id> --stage ew|notif|final --at <RFC3339> --ref <portal-reference>
craclock status

craclock init

Authenticates the CLI and selects the org it’ll act on.

No flags.

$ craclock init
✓ Logged in as jordan@nimbus-sensors.example
✓ Org: Nimbus Sensors GmbH

craclock product create

Registers a product and its first version.

  • --name <name> (required)
  • --eu-establishment-country <ISO-3166-1 alpha-2> (optional): feeds the CDaC selection when you don’t have a main EU establishment elsewhere.
$ craclock product create --name "Nimbus Edge Gateway" --eu-establishment-country DE
✓ Created product prod_8f3a2b1c
✓ Version 3.4.1 → pv_2c91f7ae

craclock sbom push

Uploads a software bill of materials for a product version.

  • <product-version-id> (positional, required)
  • --file <cyclonedx-or-spdx.json> (required)
$ craclock sbom push pv_2c91f7ae --file gateway-sbom.cdx.json
✓ Parsed CycloneDX 1.5: 214 components

craclock scan push

Uploads a vulnerability scan and matches its findings against exploited- vulnerability feeds (the CISA KEV catalog and ENISA’s EUVD).

  • <product-version-id> (positional, required)
  • --file <grype-or-trivy.json> (required)
$ craclock scan push pv_2c91f7ae --file grype-results.json
✓ Ingested 6 findings
⚠ 1 matches the CISA KEV catalog: CVE-2026-41234 in libnimbus-tls@1.2.0

A KEV or EUVD match only flags the finding. craclock never opens a case on its own.

craclock signals --exploited

Lists findings with exploitation evidence that haven’t become a case yet.

  • --exploited (filters to signals with a KEV or EUVD match)
$ craclock signals --exploited
CVE             COMPONENT             PRODUCT VERSION   FIRST SEEN
CVE-2026-41234  libnimbus-tls@1.2.0   pv_2c91f7ae       2026-01-10T08:40:00Z

craclock case open

Opens a case and records awareness_at, starting its clocks.

  • --type AEV|SI (required)
  • --product-version <id> (required)
  • --awareness-at <RFC3339> (required)
  • --signal <id> (optional): links the case to the signal that triggered it
$ craclock case open --type AEV --product-version pv_2c91f7ae --awareness-at 2026-01-10T09:00:00Z --signal sig_51a2
✓ Case case_51df02 opened (AEV)
    Early Warning     due 2026-01-11T09:00:00Z
    72h Notification  due 2026-01-13T09:00:00Z
    Final Report      pending fix

craclock case package

Renders the paste-ready package for a stage, fields ordered the way the portal asks for them.

  • <case-id> (positional, required)
  • --stage ew|notif|final (required)
  • --json (optional): machine-readable output instead of markdown
$ craclock case package case_51df02 --stage ew
✓ Wrote case_51df02-ew.md

See What the package looks like for this exact case’s full rendered output.

craclock case submitted

Records that a stage’s package was pasted into the portal, closing that stage and starting the next one.

  • <case-id> (positional, required)
  • --stage ew|notif|final (required)
  • --at <RFC3339> (required): when you submitted it
  • --ref <portal-reference> (required): the portal’s own reference for the submission
$ craclock case submitted case_51df02 --stage ew --at 2026-01-10T18:00:00Z --ref SRP-2026-004471
✓ Recorded submission for case_51df02 (ew)
✓ 72h Notification now the open stage, due 2026-01-13T09:00:00Z

craclock status

Reports every open case with a missed deadline. Exits non-zero if anything is overdue, so it’s built for CI: wire it in right after scan push (see GitHub Action).

No flags.

$ craclock status
✗ case_9b220e: Early Warning overdue by 3h12m (was due 2026-01-11T09:00:00Z)
exit status 2