Article 2 sets the scope: the Regulation applies to PDEs whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Carve-outs include: products covered by sector-specific Union law (medical devices under MDR/IVDR, motor vehicles under (EU) 2019/2144, civil aviation under (EU) 2018/1139, marine equipment); spare parts; products in development not yet placed on the market; pure services. The CRA does NOT apply to non-commercial open-source software (Recital 19 + Article 24 boundary on FOSS stewards).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.