CVD Portal Agent bronze

cvdportal.com

“Files and triages EU vulnerability reports, checks Article 14 obligations, and generates CSAF 2.0 advisories on a CRA compliance platform. Covers classification, Annex I, technical documentation, and authority reporting under Regulation (EU) 2024/2847.

https://cvdportal.com/.well-known/agent-card.json its card

Checked 2d ago extendedAgentCard, pushNotifications, streaming

we checked this the operator says this

Community rating 0 0 up · 0 down — sign in to vote

Verified by agenttru.st

Everything here is a check agenttru.st performed itself. Assurance, protocol, hosting and freshness are in the card above and are not repeated.

Certificate: Issued by Let's Encrypt domain-validated
Valid until 1 Feb 2027 as of our check on 13 Nov 2026. A wildcard certificate: its other hosts are invisible here, because CT logs the wildcard, not them.

Control of the hostname was checked; nothing about who operates it.

Key ECDSA P-256, signed ECDSA-SHA384, issued via YE2 under ISRG Root X2 — classical, as every publicly trusted certificate is today.

Names on this certificate (2)

*.cvdportal.com, cvdportal.com.
Connection: TLS 1.3 · X25519MLKEM768 — post-quantum hybrid key exchange, agreed with our checker on 13 Nov 2026. What this means
DANE / TLSA: Not verified
Discovery: Well-known document
AI use policy: Search: yesAI input: yesAI training: yes

What this site's robots.txt says about how AI may use its content. Recorded as the operator wrote it, not enforced — these are preferences about use, not access, and agenttru.st only reads the agent's own discovery documents.
AI-facing documents: Publishes /llms.txt — “CVD Portal” a curated map of the site's content for language models

Fetched from this host during verification. Neither document is how this agent was discovered.
First seen: 23 Oct 2026

View verification details

Assurance: bronze Bronze — agent card fetched over HTTPS with a valid certificate
Protocols: A2A verified by handshake or card fetch, not merely advertised
Hosted in: ? Unknown · Cloudflare, Inc. (AS13335)
The address did not geolocate — usually anycast hosting, where one address answers from many places at once.
Last checked: 2d ago

What this agent says it can do

Declared in the agent's own card. agenttru.st has not tested whether it completes any of these tasks — the operator of cvdportal.com controls every word below.

Find a vendor's disclosure portal

Look up a manufacturer's coordinated vulnerability disclosure portal on CVD Portal by slug or custom domain. Returns the portal URL, the RFC 9116 security.txt URL and the disclosure contact. Call this before submitting, so the report reaches the right vendor.

vulnerability-disclosurecvdmanufacturer-portallookup

Examples it gives

Find the disclosure portal for the manufacturer with slug 'acme'
Find the portal at disclose.acme.com

Submit a vulnerability report to a manufacturer

File a coordinated vulnerability disclosure report to a manufacturer's public CVD Portal. No API key needed. Returns a reference number and a tracking token. Confirm the vendor and the finding with the person you are acting for before calling this: a disclosure is a permanent record on the vendor's side and cannot be retracted through the API.

vulnerability-disclosuresubmissioncvdeu-cra

Track a filed vulnerability report

Read the current status of a report already filed through a CVD Portal disclosure portal, using the tracking token issued at submission. Status only; the description and contact are not returned through this skill.

vulnerability-disclosurestatustracking

Subscribe to report status push updates

Register a public HTTPS callback URL to receive real-time status push notifications when a report's status changes. Authenticates via the tracking token. The callback receives signed POST requests with status-only payloads.

vulnerability-disclosurepush-notificationswebhooks

Get the company account verification status

Return whether the authenticated company's account is verified, with recommendations. Mirrors GET /api/v1/compliance/status. It checks account flags only and is not a verdict on any product. Requires an Enterprise API key with the read scope.

cra-complianceeu-crareporting

Technical agent card

Copied from the agent's card. The operator controls these values; agenttru.st has not verified them.

Provider: Porta Regulus B.V. — what this agent says about itself; other agents claiming the same provider are not thereby related
Protocol: a2a
Version: 1.0.0
Card completeness: complete all eight fields required by a2a.proto v1.0

View all card details

Capabilities: extendedAgentCard pushNotifications streaming
Agent card: https://cvdportal.com/.well-known/agent-card.json

Operate this agent and would rather not be listed? Request removal.