CRACI vs Manifest

The short answer

Manifest (Manifest Cyber) is a software supply chain platform built around SBOMs. It creates, imports, enriches and shares them across your own products, your vendors' software and your AI models. CRACI is a GitHub Actions runner that records the dependencies each job actually fetched and produces the SBOM from that record, with a completeness state and signed provenance.

Manifest manages the SBOMs it is given or generates with scanners. CRACI produces the SBOM from the build and tracks vulnerabilities in it from there. For the software you build yourself, CRACI covers the CI, the SBOM and the vulnerability tracking, so a separate SBOM management platform is no longer needed.

At a glance

What Manifest does well

• Third-party software. This is Manifest's clearest strength. Vendors upload SBOMs directly through a secure portal, and "when a vendor won't or can't provide an SBOM, Manifest can analyze the binary and generate an SBOM directly from the compiled application." CRACI has no equivalent: it records the builds you run.
• SBOM operations. Manifest collects and merges SBOMs, enriches them with vulnerability and exploitability data, and turns the results into automatic tickets, outreach to suppliers and risk reports. It supports SPDX, CycloneDX and VEX.
• CI coverage. The Manifest CLI can generate and upload SBOMs from any CI/CD pipeline, with documented setups for GitHub Actions, CircleCI, Jenkins and Azure DevOps, plus a GitHub App.
• AI risk. Manifest inventories AI models and AIBOMs alongside software, which suits organizations governing AI adoption.
• Regulated industries. It maps its capabilities to FDA cybersecurity guidance, EO 14028, NIST 800-218, UNECE R155 and ISO/SAE 21434, and serves automotive, defense, medical devices, government and financial services.

Where CRACI is different

A record of the build, not a scan of the repository

Manifest's GitHub Action generates SBOMs with an open-source scanner. Its default is Syft, and it also supports Trivy, cdxgen and others. Those tools read the files and images they are pointed at. CRACI runs the job instead. You change runs-on to craci, and a package-aware proxy records traffic to package sources during the build: npm, PyPI, RubyGems, Cargo, Go, Nix and OCI, plus OS packages and source or download presets. Dependency evidence travels with CI caches, so a package restored from a cache is still in the record.

The difference shows up as soon as the files run out. Express 5.2.1 commits no lockfile, so a generator pointed at a clean checkout has no npm dependencies to resolve and returns whatever else it recognizes, such as GitHub Actions and workflow files. Manifest itself cannot be compared this way, and neither can CRACI, which records builds and cannot scan a directory. The point is that a scan's answer depends on the tool, its settings and the files present, and every downstream decision in a management platform inherits that answer.

A completeness state on every SBOM

CRACI states completeness per job and per cache: Complete, Complete with connections, Incomplete, Unavailable or Not recorded. The state is transitive across caches, so every alert and report runs on an inventory whose gaps are known.

Control and provenance

Because CRACI runs the job, it enforces a network egress policy: default deny or default allow, with 24 built-in software-source presets and typed custom sources, validated before the job starts and failing closed. Signed provenance (Ed25519 over SHA-512) links each artifact, including OCI artifacts, to the build that produced it.

Monitoring

CRACI re-evaluates monitored SBOMs continuously and aggregates vulnerabilities across builds and repositories. CRACI lets security teams triage findings and route them to the right team.

Replacing Manifest with CRACI

For the products you build, CRACI does the whole job: it runs the build on GitHub Actions, records the SBOM from it, keeps re-evaluating that SBOM as new vulnerabilities are published, and exports the evidence. There is no scanner to configure and no upload step between your pipeline and your SBOM platform.

Be clear about what you give up. Manifest's strength is software you buy: a vendor upload portal, and binary analysis when a supplier provides no SBOM. CRACI can hold vendor SBOMs next to your own builds, but has no vendor portal and no binary analysis. Manifest also supports VEX and automatic ticketing, inventories AI models, and works across several CI systems, while CRACI supports GitHub Actions today. If third-party software is your main exposure, Manifest remains the stronger fit.

For the Cyber Resilience Act

Manifest publishes CRA material, and for the CRA it says it "generates and maintains SBOMs/AIBOMs, links components to vulnerabilities and provenance, automates continuous monitoring and notifications, and produces exportable evidence for CRA conformity."

The CRA's reporting obligations apply from September 11, 2026: an early warning within 24 hours for an actively exploited vulnerability, through the CRA Single Reporting Platform. Its main provisions apply from December 11, 2027. For your own products, the question an authority can ask is how you know the SBOM matches the release. CRACI's answer is evidence from the build: its API takes you from an artifact to its producing build, its CycloneDX SBOM and the job network trace, and reports export in PDF, HTML, CSV, Excel and JSON.

CRACI automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process. Neither product makes a manufacturer compliant on its own. See what the CRA requires and CRA compliance with CRACI.