CRACI vs Endor Labs

The short answer

Endor Labs is an application security platform built around reachability. It analyzes your source code and your dependencies to decide which known vulnerabilities your application can call, then helps you fix those first. It also covers first-party code, secrets, containers and malicious packages.

CRACI is a CI runner for GitHub Actions. Your jobs run on it, and while they run it records every external dependency they fetch, controls what they can reach on the network, and signs provenance for what they produce. Endor Labs tells you which findings matter. CRACI gives you a record of what went into each release. The two fit together without overlap in their core jobs.

At a glance

What Endor Labs does well

Reachability is the headline. Endor Labs uses static program analysis to perform function-level reachability analysis on direct and transitive dependencies, tracing code paths from your source to the vulnerable function. Where a full build is not possible, dependency-level and pre-computed reachability offer coarser alternatives. Endor Labs says this cuts SCA findings by 92% by filtering out vulnerabilities that are not callable in your code. For a team drowning in dependency alerts, that is the most direct relief on offer.

The fix side is strong too. Upgrade impact analysis looks for breaking changes before you upgrade and assigns a remediation risk, automated pull requests carry the upgrade, and Endor Patches backport an upstream security fix to the version you already run when an upgrade is not practical.

Beyond open-source dependencies, the platform includes AI SAST, secrets detection, container scanning, malicious package detection and a Package Firewall that sits as a proxy between your artifact repository and public registries. Its SBOM Hub generates and imports CycloneDX and SPDX SBOMs, produces reachability-based VEX documents, and keeps updating risk as new vulnerabilities are published. Endor Labs integrates with GitHub Actions, GitLab, Jenkins, CircleCI, Buildkite and Bitbucket, and its supported languages include C and C++, Java, Go, Rust, Python and JavaScript.

CRACI does none of the reachability, SAST, secrets or container scanning work. If you need it, keep Endor Labs or a tool like it.

Where CRACI is different

The build is the source of truth

Endor Labs treats source code as ground truth for its inventory, which catches direct, transitive and phantom dependencies that a manifest alone would miss. CRACI starts from a different place: the build itself. A package-aware proxy on the runner observes traffic to package sources while the job runs, across npm, PyPI, RubyGems, Cargo, Go, Nix and OCI plus OS packages and download presets. Evidence travels with CI caches, so a package restored from a cache is still accounted for. Because the runner sees the traffic, dependencies pulled in by install scripts or download steps are observed too, not only those named in a manifest.

Each SBOM carries a completeness state per job and per cache: Complete, Complete with connections, Incomplete, Unavailable or Not recorded. When the record has a gap, you are told.

Control over what the build can reach

Because CRACI is the runner, you can set an egress policy for each job: default deny or default allow, with 24 built-in software-source presets and typed custom sources for registries and Git. Policies are validated before the job starts and fail closed. Endor Labs' Package Firewall filters which packages enter through your artifact repository. CRACI's policy limits every connection the build makes. They are different layers and work well stacked.

Provenance and monitoring of what shipped

Both products sign artifacts. CRACI's signature comes from the runner that watched the build, so the SBOM, the network trace and the provenance describe the same job. Signatures are Ed25519 over SHA-512 and cover OCI artifacts. CRACI aggregates vulnerabilities across builds and repositories and keeps re-evaluating monitored SBOMs.

Which one fits

• Your problem is alert volume: start with Endor Labs. Reachability and upgrade impact analysis aim squarely at that.
• Your problem is proving what is in a release: CRACI records it from the build and ties it to the artifact.
• You worry about what builds can download: CRACI's egress policy limits the runner, and Endor Labs' Package Firewall screens packages. Use both if the risk is high.
• You run GitLab, Jenkins or CircleCI: Endor Labs covers them today. CRACI supports GitHub Actions only, so those pipelines would need to move to GitHub Actions to run on CRACI.

For the Cyber Resilience Act

Endor Labs lists the EU Cyber Resilience Act among the evidence requirements SBOM Hub supports, and its VEX output helps explain why a vulnerability does not affect a product. CRACI automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process: build-time SBOMs with stated completeness, signed provenance, continuous vulnerability tracking and report export in PDF, HTML, CSV, Excel and JSON. Neither tool makes a product compliant on its own. Read more in what the CRA is and CRA compliance.

Adding CRACI alongside Endor Labs

Nothing about your Endor Labs setup has to change. Install the CRACI GitHub App, then change runs-on to craci in the workflows you want recorded. Runs still appear in the GitHub UI, and an endorctl step runs on a CRACI runner like any other step. Learn more about build-time SBOM generation and CI/CD integration.