This page is a good-faith summary for users, not legal advice and not a warranty. The binding terms are in the project licence.
The agent can make mistakes
- It can misread configuration, invent a symbol or API, or make a change that builds but is wrong.
- Review every change before you build, flash, or ship. You are the engineer of record — treat the agent like a fast junior pair, not an authority.
- A change is not “done” until you have built it, flashed it, and verified it on your target.
CRA output is a readiness aid — NOT a conformity assessment
- The CRA “SBOM & Fix” feature produces a readiness aid: an SBOM, an evidence-mode secure-by-design posture preview, and a dated CVE scan. It is not a CRA conformity assessment, a certification, or a legal compliance verdict, and it does not make your product compliant.
- Findings are evidence — attributed and dated (“OSV reports … as of …”) — always to be verified against your own build. The absence of a finding is not a clean bill of health: coverage is partial and stated on every report.
- Conformity assessment, CE marking, and legal compliance remain your responsibility (and your notified body’s, where applicable).
CVE / SBOM coverage is partial
- SBOMs from embedded toolchains are often identifier-sparse; only components with a usable package identifier are queried, and the report says how many. A “no matches” result means “nothing matched the queried subset as of that date” — never “secure”.
No warranty
The software is provided “as is”, without warranty of any kind, to the extent permitted by law. See the project licence for the binding terms.You stay in control
- The runtime runs on your machine; you choose the model and endpoint (see Privacy & security).
- You can review, edit, or reject any change before it touches your repo or your board.