Quantumguard Mcp

io.github.kota1026Published by GitHub account kota1026v1.0.0Updated Oct 24, 2026

Post-quantum cryptography security scanner. Detect ECDSA/RSA vulnerabilities, NIST compliance.

VerifiedSTDIODesktop onlyFinanceSecurity & Monitoring

Overview

AI-generated overview

Local stdio MCP server described as a post-quantum cryptography security scanner for detecting ECDSA/RSA weaknesses and checking NIST compliance.

What you can do
  • Scan cryptographic assets for post-quantum risk, per the description's focus on ECDSA/RSA vulnerabilities.
  • Check configurations against NIST standards and report compliance findings.
  • No tool list is published, so the exact operations the assistant can call are not documented; the README instead describes a broader Ethereum post-quantum asset-protection project with dual ML-DSA and SLH-DSA signatures, prover pools, time-locked custody and governance.
When to use it
Consider it when you want an assistant to help audit cryptographic choices, such as RSA or ECDSA usage, for quantum-era risk and NIST alignment. Verify the actual tool surface before relying on it, since the published material does not match the scanner description.
Requirements
Runs as a local process over stdio, installed from the npm package quantumguard-mcp, so Node.js is needed. No authentication, environment variables or headers are declared. The README's development setup also lists Docker, Rust, Node.js with pnpm and Foundry for the wider project.
Before you install
The README describes an Ethereum project with deployed contracts, staking, bonds, slashing and governance tokens, so any interaction could involve on-chain transactions and funds; treat that carefully. External audit is still marked as planned. The README and the registry description describe different things, so confirm what the server actually does before installing.

Installation

In SourceWeft

  1. Open Quantumguard Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Quantum Shield

[License: MIT] [Rust] [Solidity] [Next.js]

Post-quantum asset protection protocol for Ethereum using NIST-standardized cryptography

What is Quantum Shield?

Quantum Shield protects smart contract assets against quantum computing threats using NIST FIPS 204 (ML-DSA/Dilithium) and FIPS 205 (SLH-DSA/SPHINCS+) dual post-quantum signatures, combined with a decentralized Prover Pool, VRF-based selection, and time-locked custody.

Key Features

  • Dual PQC Signatures — ML-DSA-65 + SLH-DSA for defense-in-depth
  • Prover Pool — Decentralized verification with stake-weighted selection via VRF
  • Time-Locked Custody — 24h normal unlock, 7-day emergency path with bond
  • Observer Network — Independent challenge system with quadratic slashing
  • On-Chain Governance — veQS token voting, security council, insurance fund
  • 11 Sub-Applications — Consumer, Prover, Observer, Explorer, Enterprise, Governance, Admin

Architecture

┌─────────────────────────────────────────────────────────────────┐│  Frontend (Next.js 15)         11 apps, 136 routes, ja/en i18n │├─────────────────────────────────────────────────────────────────┤│  Backend API (Rust/Axum)       REST API, SIWE auth, Auto-Claim │├──────────────────┬──────────────────────────────────────────────┤│  L1: Sepolia     │  L3: Arbitrum Sepolia                       ││  • Vault         │  • CoreLayer    • Governor                  ││  • ProverRegistry│  • veQS         • RewardRouter              ││  • SPHINCS+ Vfy  │  • QSToken      • InsuranceFund             │└──────────────────┴──────────────────────────────────────────────┘

9 Core Sequences

#FlowPath
1Consumer LockFrontend → API → DB → L1 Vault
2Normal Unlock24h timelock → Prover verification → L1 claim
3Emergency UnlockBond deposit → 7-day lock → Emergency path
4Prover RegistrationStake → VRF selection → Proof generation
5Observer ChallengeMonitor → Challenge → VRF arbitration
6SlashingQuadratic penalty → L1 ProverRegistry
7GovernanceveQS voting → Proposal execution on L3
8Emergency PauseSecurity council → L1 pause
9Token HubStake QS → veQS → Rewards

Tech Stack

LayerTechnology
FrontendNext.js 15, TypeScript, Tailwind CSS, Wagmi, RainbowKit
BackendRust, Axum, PostgreSQL, Redis, RabbitMQ
ContractsSolidity 0.8.24 (Foundry), deployed to Sepolia + Arbitrum Sepolia
CryptographyNIST FIPS 204 (ML-DSA-65), FIPS 205 (SLH-DSA), SHA3-256
SDKWASM (Rust → wasm-pack), npm-publishable
TestingPlaywright (E2E), Vitest, cargo test, Foundry forge test

Deployed Contracts

L1: Ethereum Sepolia

ContractAddress
Vault0x07012aeF87C6E423c32F2f8eaF81762f63337260
ProverRegistry0x08e1fc1A0d614bc132B48950760c7A291cCB8946
SPHINCS+ Verifier0xD090b5A627d9bd6D96a8b5f6F504ebCa79980103

L3: Arbitrum Sepolia (12 contracts)

ContractAddress
CoreLayer0xb04F4DFe093dC80420117EDC8300f5EB6F6EDBf0
veQS0xE72dFa97C9E452dC0b8E6aa026c910D21B20fCAE
Governor0xe93b8129DC3dBD48E5d78C5A4C156DD1BFa8D65B
QSToken0xBD66beBE19E664dF143da54808d746192e4f2ee2

All L3 contracts verified on Sourcify.

Quick Start

Prerequisites

  • Docker & Docker Compose
  • Rust 1.75+ with cargo
  • Node.js 20+ with pnpm
  • Foundry (forge, anvil)

Development Setup

bash
# 1. Start infrastructuredocker compose up -d postgres redis rabbitmq l3-node minio minio-init
# 2. Run database migrationscd src/api/apiDATABASE_URL="postgresql://quantum:quantum_dev@localhost:5432/quantum_shield" sqlx migrate run
# 3. Start backend API (port 8080)cargo run --bin api-server
# 4. Start frontend (port 3000)cd src/frontend/webpnpm installpnpm dev

Verify

bash
curl http://localhost:8080/v1/health# {"status":"healthy"}

Project Structure

quantum-shield/├── src/│   ├── api/api/              # Rust/Axum backend│   │   ├── src/routes/       # API route handlers│   │   ├── src/services/     # Business logic│   │   ├── migrations/       # PostgreSQL migrations (17 files)│   │   └── config/           # YAML configuration│   ├── frontend/web/         # Next.js 15 frontend│   │   ├── src/app/          # App Router pages (11 apps)│   │   ├── src/components/   # 300+ React components│   │   ├── src/hooks/        # React Query hooks per app│   │   └── locales/          # ja/en translations│   ├── l1/contracts/         # L1 Solidity contracts (Foundry)│   ├── l3/                   # L3 governance contracts│   └── frontend/sdk/wasm/    # WASM SDK (Dilithium + SPHINCS+)├── docs/│   ├── core/SEQUENCES.md     # 9 core sequence specifications│   ├── ACTUAL_STATE.md       # Current implementation state│   └── pitch/                # Pitch deck, grant applications├── docker-compose.yml        # Development infrastructure└── .github/workflows/        # CI/CD pipelines

Testing

bash
# Backendcd src/api/api && cargo test
# Frontend E2Ecd src/frontend/web && npx playwright test
# Smart Contractscd src/l1/contracts && forge test

Test Coverage: 137 E2E tests passing, 107 integration tests, 0 failures.

Security

  • Cryptography: NIST FIPS 204 ML-DSA-65 + FIPS 205 SLH-DSA (post-quantum)
  • Hashing: SHA3-256 (no keccak256 in application layer)
  • Authentication: SIWE (Sign-In with Ethereum) + JWT
  • Time Locks: 24h normal, 7-day emergency with bond collateral
  • Slashing: Quadratic penalty for malicious provers

Audit Status

  • Internal code review
  • External audit (planned)

License

This project is licensed under the MIT License. See LICENSE for details.

Built for a post-quantum future.

Source: README.md at commit 90447cb

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts