CRACI vs Mend.io

The short answer

Mend.io is an application security platform. Mend AppSec combines Mend SAST for your own code with Mend SCA for open-source dependencies and containers, and Mend Renovate keeps dependencies current with automated pull requests. CRACI is a GitHub Actions-compatible CI runner that records every external dependency a build fetches, and produces the SBOM, provenance and compliance evidence from that record. Mend is a scanner. CRACI is a recorder. If you use Mend today, CRACI adds a layer rather than replacing one.

At a glance

What Mend.io does well

Prioritizing what is reachable. Mend SCA traces the call graph from your code through direct and transitive dependencies to decide whether your application actually invokes a vulnerable function. That cuts the list of findings a team has to act on. CRACI aggregates vulnerabilities across builds and repositories, but it does not do reachability analysis.

Code as well as dependencies. Mend SAST covers more than 30 languages, and the Mend CLI scans open-source components, custom code, container images and infrastructure as code. CRACI does none of these.

Keeping dependencies current. Mend Renovate opens pull requests for outdated packages across 90+ package managers. The Renovate CLI and Community editions are free; Enterprise adds security features and support.

Licenses, malicious packages and SBOMs. Mend SCA detects the licenses on direct and transitive dependencies and enforces policies, such as blocking AGPL in commercial products. It flags typosquats, dependency confusion and packages with backdoor or data exfiltration code. It produces SPDX and CycloneDX SBOMs, ingests third-party SBOMs, and applies VEX data.

Where CRACI is different

Observation instead of reconstruction

Mend's own documentation recommends scanning after the build step, because the build is what gives the scanner access to private registries and external artifacts, and scanning without building can give inaccurate results. That is a good instinct. CRACI takes it one step further: instead of reading the project once the build has finished, it records the build itself.

A package-aware proxy on the CRACI runner observes traffic to package sources while the job runs, for npm, PyPI, RubyGems, Cargo, Go, Nix and OCI, plus OS packages and source or download presets. Dependency evidence travels with CI caches, so packages restored from a cache are still accounted for. Each SBOM states its completeness per job and per cache: Complete, Complete with connections, Incomplete, Unavailable or Not recorded.

Control over the build network

Because CRACI runs the job, it can limit where the job goes. Egress policies are default deny or default allow, with 24 built-in software-source presets and typed custom sources for npm, PyPI, apt, apk, the Go proxy, Nix, Cargo, OCI registries and Git. They are validated before the job starts and fail closed. Mend detects a malicious package once it is in your dependency tree. An egress policy limits which sources a build can reach in the first place. The two layers work at different moments.

Evidence tied to each artifact

Signed provenance (Ed25519 over SHA-512) links each artifact, including OCI artifacts, to the build that produced it. Through the API you can go from an artifact to its build, its CycloneDX SBOM and the job's network trace.

Which one fits

• Your main problem is a backlog of findings in code and dependencies. Mend, with SAST, reachability and Renovate, is built for that.
• You need to prove what went into each release. CRACI records it per build, states how complete the record is, and signs the link between artifact and build.
• Your builds do more than install from a lockfile. Toolchain downloads, base images and curl fetches are where observation adds the most.
• Your pipelines are on Azure DevOps, Bitbucket or CircleCI. Mend fits today. CRACI supports GitHub Actions only.

For the Cyber Resilience Act

Mend.io publishes a CRA compliance guide and a compliance page that maps its products to the regulation: Mend AppSec for CycloneDX and SPDX SBOMs and reachability-based prioritization, Mend Renovate for ongoing vulnerability handling through dependency updates, and license compliance documented alongside security posture.

CRACI contributes evidence from the build: an SBOM for each release with its completeness stated, provenance, continuous monitoring, and reports in PDF, HTML, CSV, Excel and JSON. It automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process. No single tool makes a product compliant. See CRA compliance and what the CRA is.

Adding CRACI alongside Mend.io

CRACI replaces the runner, not GitHub Actions. Change runs-on to craci in a workflow and runs still appear in the GitHub UI. Your Mend CLI step stays where it is, after the build. Run one release pipeline on CRACI and compare its SBOM with Mend's inventory for the same commit.