← BIDDA × CISA
PROGRAM 1 OF 3 · DRAFT
Free for defenders.
Bidda offers seven no-cost compliance capabilities: the Discovery API, the Discovery Index, a fully unlocked sample node, the bidda-shield SDK, an MCP server, and the /scan and /verify endpoints. Each is free at point of use, has no payment gate, and requires no Bidda account.
Built for the audience CISA's No-Cost Cybersecurity Services and Tools registry serves: federal agencies, SLTT governments, critical-infrastructure operators, and independent researchers.
The paid vault tier ($0.01 per node unlock, or a subscription) is separate. Listed here only so an analyst can see the full surface area, not as part of the no-cost offering.
AUDIENCE
Federal agencies
NIST, CISA, DHS, DoD compliance crosswalks built in.
State, Local, Tribal & Territorial (SLTT)
State-specific privacy and AI laws covered: CCPA, CPRA, NY SHIELD, Texas, Colorado.
Critical infrastructure operators
IEC/ISA 62443, NERC CIP, NIS2, EU CRA, ICS/OT-aware response.
Independent researchers & journalists
Full tamper-evidence verification path. No vendor account required.
What's free
Seven distinct capabilities. None require payment. None require an account. All seven are usable by an agent or a human, today, against the live 10,099-node registry.
Discovery API (preview)
API
AUDIENCE
Any defender, any agent
CYBERSECURITY OUTCOME
PREVIEW ONLY. Returns 6 public fields per node (id, title, domain, version, BLUF, paywall status) plus a hint of which keys live behind the vault gate. Use this to look up the existence and summary of any node in the registry. For the full 13-key node, see the Free Sample card below or unlock a vault node for $0.01.
COST
$0
AUTH REQUIRED
No
URL
https://bidda.com/api/v1/nodes/{node_id}.json
EXAMPLE
curl https://bidda.com/api/v1/nodes/eu-ai-act-article-10-data-governance-training.json
Discovery Index
API
AUDIENCE
Bulk-ingestion tools, search agents
CYBERSECURITY OUTCOME
A single JSON array of every node in the registry (discovery tier preview only). Suitable for offline indexing or LLM retrieval grounding. Each entry is the 6-field preview.
COST
$0
AUTH REQUIRED
No
URL
https://bidda.com/api/v1/nodes/index.json
EXAMPLE
curl https://bidda.com/api/v1/nodes/index.json | jq length
Free Sample Node - FULLY UNLOCKED
FULL UNLOCK
NODE
AUDIENCE
Evaluators, procurement officers, due-diligence reviewers
CYBERSECURITY OUTCOME
The complete 13-key vault-tier node served without any payment gate: the EU AI Act Article 10 (data governance for training) reference implementation. Returns the full deterministic workflow (8 steps with conditions, actions, fallbacks), full actionable schema, full dependency chain, full crosswalk values, and all 7 verbatim primary citations. ~6,852 bytes. This is exactly what a paying customer sees on every other vault node.
COST
$0
AUTH REQUIRED
No
URL
https://bidda.com/api/v1/vault/nodes/eu-ai-act-article-10-data-governance-training.json
EXAMPLE
curl https://bidda.com/api/v1/vault/nodes/eu-ai-act-article-10-data-governance-training.json
Verify the unlock: the response is ~6,852 bytes containing all 8 workflow steps and 7 primary citations. Try curl ... | wc -c → 6852, or | grep -c '"step":' → 8.
bidda-shield (Python SDK)
SDK
AUDIENCE
AI engineers, agent builders
CYBERSECURITY OUTCOME
Pre-flight compliance gate for any AI agent action. Asks Bidda "is this action governed by a regulation I need to respect?" and returns the relevant nodes inline. Free for the discovery tier; vault calls require a key.
COST
$0 (discovery tier)
AUTH REQUIRED
No
URL
https://pypi.org/project/bidda-shield/
EXAMPLE
pip install bidda-shield # then: from bidda_shield import shield
MCP Server
MCP
AUDIENCE
Claude Code, Cursor, any MCP client
CYBERSECURITY OUTCOME
Nine read-only tools exposed over the Model Context Protocol: list_pillars, search_nodes, get_node, get_dependency_chain, get_crosswalk, get_latest_changes, get_jurisdiction_bundle, get_mitre_mapping, and check_action_compliance. No key required.
COST
$0
AUTH REQUIRED
No
URL
https://bidda.com/mcp
EXAMPLE
Add to MCP client config: { "bidda": { "url": "https://bidda.com/mcp" } }
/scan Endpoint
ENDPOINT
AUDIENCE
Agent runtimes, CI pipelines, security teams
CYBERSECURITY OUTCOME
REST endpoint that accepts raw source code, a git diff, or arbitrary text up to roughly half a megabyte, and returns a ranked list of regulatory matches with a calculated risk level. Built to be safe in continuous-integration pipelines and in agent runtimes that want a fast compliance pre-check.
COST
$0
AUTH REQUIRED
No
URL
https://bidda.com/scan
EXAMPLE
curl -sX POST https://bidda.com/scan -H "Content-Type: text/plain" --data-binary "deploy facial recognition in a public space"
/verify Endpoint
ENDPOINT
AUDIENCE
Auditors, defenders, journalists
CYBERSECURITY OUTCOME
Tamper-evidence lookup. Given a node ID, returns the current SHA-256 content hash, TLS SPKI fingerprint of the source URL, and last weekly fingerprint check timestamp. Independent verification path.
COST
$0
AUTH REQUIRED
No
URL
https://bidda.com/verify
EXAMPLE
Browser, or curl the underlying /api/v1/registry-health.json
Submission checklist
What CISA's intake reviewer is going to want to see, and where Bidda stands on each item.
DONE
Public listing of every no-cost asset, audience and outcome
This page.
DONE
RFC 9116 security contact
/.well-known/security.txt
DONE
Coordinated vulnerability disclosure policy + safe harbour
/security
DONE
Tamper-evidence verification path
/verify + Git Merkle audit chain
DONE
Methodology and accuracy pipeline disclosure
/methodology, where the four-gate pipeline is documented.
DONE
United States data-handling section in the privacy policy
/privacy section 11a, which describes United States federal, state and SLTT user posture.
BLOCKED
Host organisation based in the United States
CISA's first eligibility question requires a US-based host organisation. Bidda Intelligence (PTY) LTD is South African. Unlock path: register a US entity (Bidda Inc. or Bidda LLC) before submitting, or partner with a US co-host.
TODO
Submit CISA No-Cost Cybersecurity Services and Tools webform
cisa.gov/forms/no-cost-cybersecurity-services. Deferred until the US-based-host prerequisite above is resolved.
Frequently asked
What compliance tools does Bidda offer for free?
Seven capabilities, all free at point of use with no account required: the Discovery API, the Discovery Index, a fully unlocked sample node, the bidda-shield Python SDK, an MCP server with nine read-only tools, the /scan endpoint, and the /verify endpoint.
Do any of these free tools require an account or API key?
No. All seven assets on this page work without a Bidda account, a payment, or an API key.
What is the Free Sample Node?
It is the complete, unpaid, 13-key vault-tier node for EU AI Act Article 10 (data governance for training), served with its full workflow, schema, dependency chain, crosswalks, and citations, the same content a paying customer sees on any other vault node.
Who is this page built for?
Federal agencies, State/Local/Tribal/Territorial (SLTT) governments, critical-infrastructure operators, and independent researchers or journalists evaluating Bidda under CISA's No-Cost Cybersecurity Services and Tools criteria.
FOR CISA REVIEWERS
Reference this page when Bidda submits
When Bidda formally submits to CISA's No-Cost Cybersecurity Services and Tools webform, this page is the canonical reference. It is the single URL a reviewer needs to evaluate the offering against the registry's published criteria.
← BACK TO CISA HUB
CPG CROSSWALK →
SECURE BY DESIGN →