io.github.quantakryptoPublished by GitHub account quantakryptov0.5.2Updated Oct 24, 2026
Scan code for quantum-vulnerable cryptography and get NIST post-quantum migration guidance.
Gives coding assistants post-quantum readiness tools: explain quantum-vulnerable crypto findings, suggest hybrid migrations, and verify fixes.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/io.github.quantakrypto%2Fpqc-tools/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"quantakrypto-pqc-tools": {
"type": "http",
"url": "https://mcp.quantakrypto.com/mcp"
}
}
}[CI] [License: Apache-2.0] [OpenSSF Best Practices] [npm @quantakrypto/core] [npm @quantakrypto/qscan] [npm @quantakrypto/mcp] [npm @quantakrypto/sieve] [npm @quantakrypto/agent] [npm @quantakrypto/qprobe] [Node ≥20] [TypeScript strict] [Runtime deps: 0] [PQC targets: FIPS 203/204/205]
Open-source post-quantum readiness tooling by quantakrypto. Find quantum-vulnerable cryptography in any codebase, wire post-quantum readiness into your editor and your CI, and conformance-test post-quantum implementations — with zero runtime dependencies (Node built-ins only).
Design goals: simple, clean, reusable code; zero runtime dependencies; everything documented, tested, and example-driven.
All of qScan, MCP, the Action, agent, and qProbe share the engine in
@quantakrypto/core (npm i @quantakrypto/core) — detectors,
the vulnerable-dependency DB, the readiness score, SARIF/JSON/CBOM/evidence/OpenVEX
reporting, and the
offline agent-plane primitives (context redactor, verify_fix gate, codemods, patch
policy). Sieve is standalone: it tests other implementations and implements no
crypto itself.
Infrastructure coverage. Beyond application source, the shared core engine
carries config-scope detectors for Terraform/OpenTofu IaC and cloud KMS, JSON
Web Keys, Kubernetes / cert-manager / Istio, CI/CD artifact & code signing
(cosign/GPG/jarsigner/codesign/minisign), secrets at rest (SOPS/age, PGP, Sealed
Secrets), message brokers (Kafka/MQTT), databases (pgcrypto, libpq sslmode), and
JOSE/JWE key management — so qscan, the Action, and MCP flag infrastructure
crypto with no extra install. qProbe adds the live-endpoint dimension (see the
table above). The narrative anchor for infrastructure is harvest now, decrypt
later: data and secrets captured today are decryptable once a CRQC exists.
Add the CI gate by dropping
packages/action/examples/quantum-readiness.yml
into .github/workflows/, or wire it up directly:
Each package README has the full options reference and more examples: qScan · MCP · Sieve · Action · core · agent.
quantakrypto does not implement post-quantum cryptography, by design — it is
the scanner, the CI gate, and the conformance harness you wrap around a real PQC
library like liboqs / Open Quantum Safe. They
compose: quantakrypto finds and gates classical crypto (qscan, the Action),
tells you what to migrate to and in what order (qscan --tier, MCP
plan_migration, qremediate), and conformance-tests the replacement
(sieve runs any ML-KEM/ML-DSA/SLH-DSA implementation against FIPS 203/204/205,
with exact-value KATs when you supply official NIST ACVP vectors). liboqs
supplies the primitives.
See the worked end-to-end walkthrough — scan → migrate → verify → gate — in
examples/liboqs-migration/.
Requires Node ≥ 20.
The toolchain is intentionally tiny: TypeScript + tsx (to run node:test on
.ts) are the only dev dependencies; there are no runtime dependencies.
Full documentation lives in docs/:
Apache-2.0. The methodology is open; the assessments, attestation reports, and deliverables are where the quantakrypto practice lives.
Questions, commercial support, or post-quantum readiness training for your team — visit quantakrypto.com or email [email protected].
Source: README.md at commit 6a81b55
Deterministically attach your triage verdicts to their findings and re-sort by exposure (highest first). Never suppresses. Pass the same 'findings' array you triaged plus a 'verdicts' array of { fingerprint, exposureScore, priority, rationale }.
findingsrequiredverdictsrequiredDeterministically VERIFY a proposed fix before writing it — runs the same patch-policy + verify_fix + blast-radius gates as `qremediate` (offline, no key, no network). Give the finding, the file's current content, and your proposed FULL corrected content; returns approved:true only if the patch is in-policy, clears the finding, adds no new finding, introduces no network/exec sink, and is bounded in size. This does NOT write the file — you write it, only when approved, and never auto-merge.
findingrequirednewContentrequiredoriginalContentrequiredCheck whether a package is in quantakrypto's known quantum-vulnerable dependency database (the classical crypto it exposes). Provide 'name' and optional 'ecosystem' (default npm).
namerequiredecosystemExplain a quantakrypto finding and its post-quantum remediation. Provide a ruleId (e.g. 'forge-rsa-keygen', 'elliptic-ec', 'node-rsa', 'pem-ec-private-key') and/or an algorithm (e.g. 'RSA', 'ECDSA'). The ruleId is resolved against the core detector set, so library and config rules explain correctly.
ruleIdalgorithmReturn before/after code examples for migrating a classical algorithm to a post-quantum / hybrid replacement. Provide an 'algorithm' (RSA, ECDH, ECDSA, …) or a 'ruleId' from a finding.
ruleIdalgorithmList the quantakrypto detector catalog: every detector id and what it looks for.
Takes no parameters.
Produce a deterministic remediation REQUEST bundle (rubric + fix schema + per-finding metadata + fingerprints) for YOU (the host agent) to fix. This tool calls no model and needs no key. For each finding, propose the corrected FULL file content, then VERIFY with verify_fix and keep only fixes that clear the finding. Never touch files with secrets; never auto-merge. Pass 'findings' from scan_path --format json.
findingsrequiredCompute the readiness-score and HNDL change between two finding sets (e.g. before and after a migration). Pass 'before' and 'after' as arrays of findings from scan_path --format json.
afterrequiredbeforerequiredRecommend a post-quantum / hybrid migration. Provide an 'algorithm' (e.g. RSA, ECDH, ECDSA) or free-text 'context' describing the usage. Set 'tier' to 'category-5' for CNSA 2.0 / national-security systems.
tiercontextalgorithmProduce a deterministic triage REQUEST bundle (rubric + verdict schema + per-finding metadata) for YOU (the host agent) to reason over. This tool does NOT call any model and needs no API key. Assess each finding's real-world exposure, then call apply_triage with your verdicts. Pass 'findings' as an array from scan_path --format json.
findingsrequiredRun the quantakrypto detectors over a code snippet (NOT the filesystem) and report any classical crypto that remains. Use this to confirm an edit actually removed the quantum-vulnerable usage. Provide 'code' plus a 'language' or 'filename'.
coderequiredfilenamelanguage100% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
# 1. Scan a codebase for quantum-vulnerable cryptography.npx @quantakrypto/qscan ./
# 2. Give your AI coding agent post-quantum readiness tools.claude mcp add quantakrypto npx @quantakrypto/mcp
# 3. Conformance-test a post-quantum implementation (adapter speaks the JSON protocol).npx @quantakrypto/sieve --impl "node ./my-impl.js" --param ml-kem-768
# 4. Gate against a compliance mandate's dated deadlines (CNSA 2.0 / NIST IR 8547).# Verdicts also ride in --format json/sarif/evidence; --policy lets an org# acknowledge families it is knowingly migrating (exempt from early gating).npx @quantakrypto/qscan ./ --mandate cnsa-2.0 [--policy .quantakrypto/crypto-policy.json]- uses: quantakrypto/pqc-tools/packages/action@v1 with: path: "." severity-threshold: "high"quantakrypto-tools/├── packages/│ ├── core/ @quantakrypto/core — shared engine (the contract lives in src/types.ts + src/index.ts)│ ├── qscan/ @quantakrypto/qscan — CLI│ ├── mcp/ @quantakrypto/mcp — MCP server (stdio now, HTTP scaffold for hosting)│ ├── action/ @quantakrypto/action — GitHub Action│ ├── sieve/ @quantakrypto/sieve — conformance battery + JSON protocol│ ├── agent/ @quantakrypto/agent — opt-in BYOK LLM client (triage + remediation)│ └── qprobe/ @quantakrypto/qprobe — active TLS/SSH endpoint probing (gated; the only prober)├── docs/ architecture, hosted-MCP design, improvement roadmap└── examples/ end-to-end examplesnpm install # links the workspacesnpm run build # tsc --build (project references)npm test # node:test across all packages