Skip to content
Declarable

From your build pipeline

Every release recorded from the build that made it.

Uploading an SBOM by hand works for the first release. After that it belongs in the pipeline. Declarable takes an upload from your CI, answers over an API, posts to your webhooks, and talks to your AI agent over MCP.

Read the CI guidesSee pricing

Included in Maker, Studio and Fleet.

ci · release buildExample

# after the build writes its SBOM

export DECLARABLE_API_KEY=...        # from your secret store
export DECLARABLE_PRODUCT_ID="<your product id>"
export DECLARABLE_SBOM_PATH="build/spdx/*.spdx"
sh integrations/curl/upload.sh
The upload command is the one in the curl integration’s README; the tool names are the MCP server’s own.

What it does

CI, API and agents, in 6 parts.

  1. 01

    GitHub Actions, GitLab CI or plain sh

    A GitHub Action, a GitLab CI template, and a shell script that needs only sh and curl for anything else.

  2. 02

    Guides for your build system

    Step-by-step pipeline guides for Zephyr, Yocto, ESP-IDF, nRF Connect SDK, Buildroot, PlatformIO and Arduino.

  3. 03

    Each upload becomes the current release

    An upload under a new version becomes the product’s current release, so what Declarable watches and alerts on is what you ship.

  4. 04

    A REST API

    List products, read a release’s status and its open findings, and record decisions from your own tools.

  5. 05

    Webhooks

    New matches and incident deadlines post to Slack or to your own signed endpoint.

  6. 06

    Ask from your AI agent

    Connect Claude, ChatGPT, Cursor or VS Code over MCP. Ask what is open on a product, record a decision, work out Article 14 dates or check where the documents stand.

How it works

Three steps, the same every release.

  1. 1

    Create an API key

    Make a key in the product’s settings and store it in your CI’s secret store.

  2. 2

    Add one step after the SBOM is written

    Copy the action, the template or the script into your repository, read it, and run it from the job that builds a release.

  3. 3

    Read the results where you work

    In the app, over the API, in Slack, or by asking your agent.

What it does not do

  • It does not ask you to pipe a script from the web into a shell. You copy, read and commit what runs.
  • Your agent cannot submit an Article 14 report or sign a document through it. Those stay with a person.

Questions

Questions about CI, API and agents.

Which CI systems are supported?

GitHub Actions and GitLab CI have ready-made integrations. Any other CI can run the shell script, which needs only sh and curl.

Which AI tools can connect over MCP?

Any MCP client. The agents page has configuration for Claude Code, Claude Desktop, Cursor, VS Code and ChatGPT.

Which plans include API and CI upload?

Maker, Studio and Fleet.

The rest of Declarable

What Declarable is, and what it is not

  • A documentation aid. Declarable prepares drafts and checklists for you to review and edit.
  • Not legal advice. For a legal question about your product, ask a lawyer.
  • Not certification. Nobody at Declarable assesses or signs off your product. You sign your own declaration of conformity.
  • Not an assessment body. Some products need an outside assessment body: an product unless its maker fully applies a harmonised standard or one of the alternatives in Article 32(2), and those on the CRA's Annex III class II and Annex IV lists — the higher-risk product categories, where self-assessment is not enough. Declarable is not one. The scope check asks the questions that point to your category.
  • Not a filing agent. Declarable does not file reports for you. You submit them yourself on the ENISA platform.

Source for the assessment lists and when an outside body is needed: Annexes III and IV and Article 32 of Regulation (EU) 2024/2847 (Cyber Resilience Act), as recorded in legal state 2026.10.13-1.

Start with the free tool. Keep the record when you are ready.

Read the CI guidesSee pricing