Bidda: Free for Defenders (No-Cost Capabilities for CISA Audiences)
===================================================================
JS-free text mirror for AI crawlers. Canonical page: https://bidda.com/cisa/free
Last updated: 2026-08-04

← BIDDA × CISA
PROGRAM 1 OF 3 · DRAFT
Free for defenders.

Bidda offers seven no-cost compliance capabilities: the Discovery API, the Discovery Index, a fully unlocked sample node, the bidda-shield SDK, an MCP server, and the /scan and /verify endpoints. Each is free at point of use, has no payment gate, and requires no Bidda account.

Built for the audience CISA's No-Cost Cybersecurity Services and Tools registry serves: federal agencies, SLTT governments, critical-infrastructure operators, and independent researchers.

The paid vault tier ($0.01 per node unlock, or a subscription) is separate. Listed here only so an analyst can see the full surface area, not as part of the no-cost offering.

AUDIENCE

Federal agencies

NIST, CISA, DHS, DoD compliance crosswalks built in.

State, Local, Tribal & Territorial (SLTT)

State-specific privacy and AI laws covered: CCPA, CPRA, NY SHIELD, Texas, Colorado.

Critical infrastructure operators

IEC/ISA 62443, NERC CIP, NIS2, EU CRA, ICS/OT-aware response.

Independent researchers & journalists

Full tamper-evidence verification path. No vendor account required.

What's free

Seven distinct capabilities. None require payment. None require an account. All seven are usable by an agent or a human, today, against the live 10,099-node registry.

Discovery API (preview)
API

AUDIENCE

Any defender, any agent

CYBERSECURITY OUTCOME

PREVIEW ONLY. Returns 6 public fields per node (id, title, domain, version, BLUF, paywall status) plus a hint of which keys live behind the vault gate. Use this to look up the existence and summary of any node in the registry. For the full 13-key node, see the Free Sample card below or unlock a vault node for $0.01.

COST

$0

AUTH REQUIRED

No

URL

https://bidda.com/api/v1/nodes/{node_id}.json

EXAMPLE

curl https://bidda.com/api/v1/nodes/eu-ai-act-article-10-data-governance-training.json
Discovery Index
API

AUDIENCE

Bulk-ingestion tools, search agents

CYBERSECURITY OUTCOME

A single JSON array of every node in the registry (discovery tier preview only). Suitable for offline indexing or LLM retrieval grounding. Each entry is the 6-field preview.

COST

$0

AUTH REQUIRED

No

URL

https://bidda.com/api/v1/nodes/index.json

EXAMPLE

curl https://bidda.com/api/v1/nodes/index.json | jq length
Free Sample Node - FULLY UNLOCKED
FULL UNLOCK
NODE

AUDIENCE

Evaluators, procurement officers, due-diligence reviewers

CYBERSECURITY OUTCOME

The complete 13-key vault-tier node served without any payment gate: the EU AI Act Article 10 (data governance for training) reference implementation. Returns the full deterministic workflow (8 steps with conditions, actions, fallbacks), full actionable schema, full dependency chain, full crosswalk values, and all 7 verbatim primary citations. ~6,852 bytes. This is exactly what a paying customer sees on every other vault node.

COST

$0

AUTH REQUIRED

No

URL

https://bidda.com/api/v1/vault/nodes/eu-ai-act-article-10-data-governance-training.json

EXAMPLE

curl https://bidda.com/api/v1/vault/nodes/eu-ai-act-article-10-data-governance-training.json

Verify the unlock: the response is ~6,852 bytes containing all 8 workflow steps and 7 primary citations. Try curl ... | wc -c → 6852, or | grep -c '"step":' → 8.

bidda-shield (Python SDK)
SDK

AUDIENCE

AI engineers, agent builders

CYBERSECURITY OUTCOME

Pre-flight compliance gate for any AI agent action. Asks Bidda "is this action governed by a regulation I need to respect?" and returns the relevant nodes inline. Free for the discovery tier; vault calls require a key.

COST

$0 (discovery tier)

AUTH REQUIRED

No

URL

https://pypi.org/project/bidda-shield/

EXAMPLE

pip install bidda-shield # then: from bidda_shield import shield
MCP Server
MCP

AUDIENCE

Claude Code, Cursor, any MCP client

CYBERSECURITY OUTCOME

Nine read-only tools exposed over the Model Context Protocol: list_pillars, search_nodes, get_node, get_dependency_chain, get_crosswalk, get_latest_changes, get_jurisdiction_bundle, get_mitre_mapping, and check_action_compliance. No key required.

COST

$0

AUTH REQUIRED

No

URL

https://bidda.com/mcp

EXAMPLE

Add to MCP client config: { "bidda": { "url": "https://bidda.com/mcp" } }
/scan Endpoint
ENDPOINT

AUDIENCE

Agent runtimes, CI pipelines, security teams

CYBERSECURITY OUTCOME

REST endpoint that accepts raw source code, a git diff, or arbitrary text up to roughly half a megabyte, and returns a ranked list of regulatory matches with a calculated risk level. Built to be safe in continuous-integration pipelines and in agent runtimes that want a fast compliance pre-check.

COST

$0

AUTH REQUIRED

No

URL

https://bidda.com/scan

EXAMPLE

curl -sX POST https://bidda.com/scan -H "Content-Type: text/plain" --data-binary "deploy facial recognition in a public space"
/verify Endpoint
ENDPOINT

AUDIENCE

Auditors, defenders, journalists

CYBERSECURITY OUTCOME

Tamper-evidence lookup. Given a node ID, returns the current SHA-256 content hash, TLS SPKI fingerprint of the source URL, and last weekly fingerprint check timestamp. Independent verification path.

COST

$0

AUTH REQUIRED

No

URL

https://bidda.com/verify

EXAMPLE

Browser, or curl the underlying /api/v1/registry-health.json
Submission checklist

What CISA's intake reviewer is going to want to see, and where Bidda stands on each item.

DONE

Public listing of every no-cost asset, audience and outcome

This page.

DONE

RFC 9116 security contact

/.well-known/security.txt

DONE

Coordinated vulnerability disclosure policy + safe harbour

/security

DONE

Tamper-evidence verification path

/verify + Git Merkle audit chain

DONE

Methodology and accuracy pipeline disclosure

/methodology, where the four-gate pipeline is documented.

DONE

United States data-handling section in the privacy policy

/privacy section 11a, which describes United States federal, state and SLTT user posture.

BLOCKED

Host organisation based in the United States

CISA's first eligibility question requires a US-based host organisation. Bidda Intelligence (PTY) LTD is South African. Unlock path: register a US entity (Bidda Inc. or Bidda LLC) before submitting, or partner with a US co-host.

TODO

Submit CISA No-Cost Cybersecurity Services and Tools webform

cisa.gov/forms/no-cost-cybersecurity-services. Deferred until the US-based-host prerequisite above is resolved.

Frequently asked
What compliance tools does Bidda offer for free?

Seven capabilities, all free at point of use with no account required: the Discovery API, the Discovery Index, a fully unlocked sample node, the bidda-shield Python SDK, an MCP server with nine read-only tools, the /scan endpoint, and the /verify endpoint.

Do any of these free tools require an account or API key?

No. All seven assets on this page work without a Bidda account, a payment, or an API key.

What is the Free Sample Node?

It is the complete, unpaid, 13-key vault-tier node for EU AI Act Article 10 (data governance for training), served with its full workflow, schema, dependency chain, crosswalks, and citations, the same content a paying customer sees on any other vault node.

Who is this page built for?

Federal agencies, State/Local/Tribal/Territorial (SLTT) governments, critical-infrastructure operators, and independent researchers or journalists evaluating Bidda under CISA's No-Cost Cybersecurity Services and Tools criteria.

FOR CISA REVIEWERS

Reference this page when Bidda submits

When Bidda formally submits to CISA's No-Cost Cybersecurity Services and Tools webform, this page is the canonical reference. It is the single URL a reviewer needs to evaluate the offering against the registry's published criteria.

← BACK TO CISA HUB
CPG CROSSWALK →
SECURE BY DESIGN →