Skip to main content

How do I use CVD Portal from Claude Code?

The CVD Portal plugin for Claude Code connects a software repository to a CVD Portal account and adds three commands. The commands list Cyber Resilience Act gaps, write SECURITY.md and security.txt, and upload an SBOM.

Key takeaways​

  • Install with /plugin marketplace add porta-regulus/cvd-portal-claude-plugin, then sign in through /mcp.
  • list-gaps needs the Compliance plan. The SBOM upload needs the Reporting plan and an ADMIN.
  • The agent asks for approval before each write to the portal and before each Annex I sign-off or Article 14 decision.
  • No command files a report with ENISA.

Last updated 19 October 2026.

The plugin is open source under the MIT license at github.com/porta-regulus/cvd-portal-claude-plugin. It contains instructions for Claude and the address of the MCP server. It contains no code that runs on your machine.

Install​

Run these commands in Claude Code.

/plugin marketplace add porta-regulus/cvd-portal-claude-plugin
/plugin install cvd-portal@porta-regulus

Start a new session after the install, or run /reload-plugins.

Sign in​

The plugin registers the MCP server cvd-portal at https://cvdportal.com/api/mcp.

  1. Run /mcp in Claude Code.
  2. Select cvd-portal.
  3. Sign in to CVD Portal in the browser window that opens.
  4. Approve the access request.

Claude Code keeps the token. You do not need an API key.

Use an API key instead​

Use an API key when a browser sign-in is not possible, for example on a CI runner.

  1. Create a key under Settings → API Keys. On the Compliance plan, give it only MCP scopes. See Connecting with an API key.
  2. Put the key in the variable CVD_PORTAL_API_KEY. This command reads the key without echo, so the key does not go into the shell history. Paste the key and press Enter.
read -rs CVD_PORTAL_API_KEY && export CVD_PORTAL_API_KEY
  1. Add a second server with the key. If the variable is empty, the server gets an empty key and every call fails.
claude mcp add --transport http --scope user cvd-portal-key https://cvdportal.com/api/mcp \
  --header "Authorization: Bearer ${CVD_PORTAL_API_KEY}"
  1. Disable the plugin server cvd-portal in /mcp, so that only one server is active.

Claude Code stores the key in plain text in ~/.claude.json. Give the key a short expiry and rotate it. Do not write the key into a file in the repository.

Commands​

CommandWhat it doesWhat it changes
/cvd-portal:list-gaps [product]Lists the open conformity gaps for a product. Ranks each gap by the evidence that the repository can supply.Nothing. It only reads.
/cvd-portal:init-cvd [slug]Writes SECURITY.md and .well-known/security.txt. Both point to https://<slug>.cvdportal.com. Shows the diff.Local files only. It does not commit.
/cvd-portal:sbom [file] [product]Finds an SBOM in the repository, or a dependency manifest such as package.json. Shows the component count. Uploads it with upload_sbom after you confirm. It only reads and uploads a file that you created.The stored SBOM of the product, after you confirm.

Claude starts init-cvd and sbom only when you type the command.

Plan requirements​

CommandPlanOther requirements
list-gapsCompliance or higherread scope
init-cvdAny plan with a public portalNone. With MCP access the command reads the portal URL. Without it, give the slug yourself.
sbomReporting or highersbom:write scope and the ADMIN role. An SBOM file or a dependency manifest in the repository.

The free trial runs at the Compliance level, so all three commands work during the trial. An upload is limited to 5 MB.

To create an SBOM before you upload it, run a generator yourself, for example syft dir:. -o cyclonedx-json=bom.cdx.json or npx @cyclonedx/cdxgen@12.8.5 -o bom.cdx.json .. The detail of a dependency manifest depends on its format. Gemfile.lock and go.mod include indirect dependencies. package.json and Cargo.toml list only direct dependencies. A requirements.txt holds the packages its author listed, which is every installed package when it comes from pip freeze. An SBOM from a generator also records hashes and licences.

Rules that the agent follows​

Every command first reads the plugin's AGENTS.md. These are the main rules.

  • Claude does not sign off an Annex I requirement or record an Article 14 decision without your approval for that specific call.
  • No tool files a report with ENISA. An authorized person files on the ENISA Single Reporting Platform.
  • Claude does not invent a legal citation. Verify each citation on EUR-Lex.
  • Each change in the repository names the Annex I point or the Article that it serves.
  • Claude asks before each call that writes to the portal.

Privacy​

  • The commands read files in your repository to find evidence. The file contents go to the Claude model that you use.
  • File contents go to CVD Portal only when you confirm an upload, for example the SBOM.
  • Vulnerability reports and Article 14 drafts stay in CVD Portal. The commands do not write them into repository files.

Update or remove​

  • Run /plugin marketplace update porta-regulus to get a new version.
  • Run /plugin uninstall cvd-portal@porta-regulus to remove the plugin.

See also​