Skip to main content

OCCTET toolkit

From source code to CRA-ready reports

A suite of interconnected open source tools that turns software compliance into a practical, guided experience for SMEs and the open source projects they rely on.

  • Open source
  • Built on Eclipse Apoapsis
  • Human in the loop
Start with the self-assessment See how it works
Know where you stand CRA Self-Assessment Platform Answer a guided questionnaire and measure your CRA preparedness in minutes. Free, confidential, with your next steps. Start the self-assessment Analyse your software The OCCTET toolchain Scan your code, review the findings and export the SBOM, VEX and audit reports your CRA documentation needs. Follow the getting started guide

How the toolchain works

Four steps, from a Git repository to standard compliance artefacts. The whole workflow can be started and managed from the Curator.

Source code Git repository
1 ORT Server

Analyse the project

The ORT Server scans the source code and creates SBOMs, reports and metadata.

  • SBOM
  • Reports
  • Dependencies
  • Licences
2 OCCTET Curator

Enrich and curate

The Curator combines the results, adds missing information and supports manual review of components, licences, copyrights and vulnerabilities, including VEX statements.

  • Components
  • Licences & copyright
  • Vulnerabilities & VEX
  • AI assistance
  • Evidence
4 Reporting

Create reports

The curated data is exported in standard formats such as SBOM, VEX and audit reports.

  • SBOM
  • VEX
  • Audit reports
3
VulnerableCode

Use external data

The federated VulnerableCode database provides up-to-date information on vulnerabilities, components and metadata, to both ORT and the Curator.

Start an analysis, launch a new ORT scan with your parameters, view the results and manage the curation, all from the Curator.

The tools

ORT Server

By Eclipse Apoapsis Apache-2.0

Automated analysis of source code, dependencies and licences.

A scalable server implementation of the OSS Review Toolkit (ORT). It identifies every open source component, with its licences, known vulnerabilities and dependencies, and passes the results on to the Curator.

  • Generate detailed SBOMs (SPDX, CycloneDX)
  • Produce analysis reports and metadata
  • Map the full dependency tree
  • Detect licence and security risks early
  • Monitor projects continuously with scheduled scans

OCCTET Curator

By Bitsea Apache-2.0

Human-in-the-loop curation and reporting.

Turns raw scan results into reviewed, trustworthy compliance data, and is the place from which users drive the whole workflow. It ships with ready-to-use Docker scripts and a documented docker-compose configuration.

  • Review and complete the inventory of components and dependencies
  • Verify licence findings and copyright holders
  • Assess vulnerabilities and create VEX statements
  • Get AI assistance to interpret findings faster
  • Keep track of decisions and produce compliance evidence

VulnerableCode

By Apache-2.0

Federated database for vulnerabilities, components and metadata.

Through FederatedCode, it connects reliable data sources and consolidates information on open source packages, keyed by Package URL (PURL), so that every SME reuses verified data instead of recomputing it.

  • Package advisories and known vulnerabilities
  • Package origin and licence metadata
  • Reference SBOMs for tracked packages
  • Open data published in Git repositories and APIs

CRA Self-Assessment Platform

By Expertware

Measure your CRA readiness and get your next steps.

A guided questionnaire that maps CRA obligations to practical questions, scores your maturity per domain and points to what to do next, with an AI assistant to help interpret the requirements.

  • Free and confidential
  • Maturity score per CRA domain
  • Explanations and evidence indicators for each question
  • Instant next steps

The hosted OCCTET instances of ORT Server and the Curator require an account. Ask for tester access, or deploy the tools yourself from their source code.

What you get

Standard, machine-readable artefacts for your CRA technical documentation.

  • SBOM

    A complete inventory of the software components in your product, in SPDX or CycloneDX.

  • VEX

    Statements on whether known vulnerabilities actually affect your product.

  • Audit reports

    Documentation of licences, copyrights, vulnerabilities and the decisions taken, to support CRA compliance.

Tested on real projects

The toolchain has analysed every Eclipse Foundation project. It was also validated on widely used open source projects and SME cases, as reported in deliverables D3.3 and D3.4.

See the toolkit results

See it in action

Eclipse Foundation projects analysed, across more than 3,600 repositories
452
popular open source projects analysed in 10 language ecosystems
96
packages with reference SBOMs in the public PurlDB demonstrator
20M+

Get started

Back to the top