quantakrypto pqc-tools

quantakrypto-tools

[CI] [License: Apache-2.0] [OpenSSF Best Practices] [npm @quantakrypto/core] [npm @quantakrypto/qscan] [npm @quantakrypto/mcp] [npm @quantakrypto/sieve] [npm @quantakrypto/agent] [npm @quantakrypto/qprobe] [Node ≥20] [TypeScript strict] [Runtime deps: 0] [PQC targets: FIPS 203/204/205]

Open-source post-quantum readiness tooling by quantakrypto. Find quantum-vulnerable cryptography in any codebase, wire post-quantum readiness into your editor and your CI, and conformance-test post-quantum implementations — with zero runtime dependencies (Node built-ins only).

Design goals: simple, clean, reusable code; zero runtime dependencies; everything documented, tested, and example-driven.

What's inside

All of qScan, MCP, the Action, agent, and qProbe share the engine in @quantakrypto/core (npm i @quantakrypto/core) — detectors, the vulnerable-dependency DB, the readiness score, SARIF/JSON/CBOM/evidence/OpenVEX reporting, and the offline agent-plane primitives (context redactor, verify_fix gate, codemods, patch policy). Sieve is standalone: it tests other implementations and implements no crypto itself.

Infrastructure coverage. Beyond application source, the shared core engine carries config-scope detectors for Terraform/OpenTofu IaC and cloud KMS, JSON Web Keys, Kubernetes / cert-manager / Istio, CI/CD artifact & code signing (cosign/GPG/jarsigner/codesign/minisign), secrets at rest (SOPS/age, PGP, Sealed Secrets), message brokers (Kafka/MQTT), databases (pgcrypto, libpq sslmode), and JOSE/JWE key management — so qscan, the Action, and MCP flag infrastructure crypto with no extra install. qProbe adds the live-endpoint dimension (see the table above). The narrative anchor for infrastructure is harvest now, decrypt later: data and secrets captured today are decryptable once a CRQC exists.

Quick start

# 1. Scan a codebase for quantum-vulnerable cryptography.npx @quantakrypto/qscan ./
# 2. Give your AI coding agent post-quantum readiness tools.claude mcp add quantakrypto npx @quantakrypto/mcp
# 3. Conformance-test a post-quantum implementation (adapter speaks the JSON protocol).npx @quantakrypto/sieve --impl "node ./my-impl.js" --param ml-kem-768
# 4. Gate against a compliance mandate's dated deadlines (CNSA 2.0 / NIST IR 8547).#    Verdicts also ride in --format json/sarif/evidence; --policy lets an org#    acknowledge families it is knowingly migrating (exempt from early gating).npx @quantakrypto/qscan ./ --mandate cnsa-2.0 [--policy .quantakrypto/crypto-policy.json]

Add the CI gate by dropping packages/action/examples/quantum-readiness.yml into .github/workflows/, or wire it up directly:

- uses: quantakrypto/pqc-tools/packages/action@v1  with:    path: "."    severity-threshold: "high"

Each package README has the full options reference and more examples: qScan · MCP · Sieve · Action · core · agent.

Using quantakrypto alongside a PQC library (liboqs / OQS)

quantakrypto does not implement post-quantum cryptography, by design — it is the scanner, the CI gate, and the conformance harness you wrap around a real PQC library like liboqs / Open Quantum Safe. They compose: quantakrypto finds and gates classical crypto (qscan, the Action), tells you what to migrate to and in what order (qscan --tier, MCP plan_migration, qremediate), and conformance-tests the replacement (sieve runs any ML-KEM/ML-DSA/SLH-DSA implementation against FIPS 203/204/205, with exact-value KATs when you supply official NIST ACVP vectors). liboqs supplies the primitives.

See the worked end-to-end walkthrough — scan → migrate → verify → gate — in examples/liboqs-migration/.

Workspace layout

quantakrypto-tools/├── packages/│   ├── core/     @quantakrypto/core    — shared engine (the contract lives in src/types.ts + src/index.ts)│   ├── qscan/    @quantakrypto/qscan   — CLI│   ├── mcp/      @quantakrypto/mcp     — MCP server (stdio now, HTTP scaffold for hosting)│   ├── action/   @quantakrypto/action — GitHub Action│   ├── sieve/    @quantakrypto/sieve   — conformance battery + JSON protocol│   ├── agent/    @quantakrypto/agent   — opt-in BYOK LLM client (triage + remediation)│   └── qprobe/   @quantakrypto/qprobe  — active TLS/SSH endpoint probing (gated; the only prober)├── docs/         architecture, hosted-MCP design, improvement roadmap└── examples/     end-to-end examples

Development

Requires Node ≥ 20.

npm install        # links the workspacesnpm run build      # tsc --build (project references)npm test           # node:test across all packages

The toolchain is intentionally tiny: TypeScript + tsx (to run node:test on .ts) are the only dev dependencies; there are no runtime dependencies.

Documentation & compliance

Full documentation lives in docs/:

• Objectives & scope — what the toolchain is for, what each library does, the load-bearing decisions, and the deliberate scope boundaries. Start here.
• Architecture decisions — the immutable "why" behind each load-bearing choice (zero deps, shared core contract, two-plane agent, …).
• Standards & compliance — what the tools touch and could align to: NIST FIPS 203/204/205, SP 800-208, CNSA 2.0, SARIF, CWE, ISO/IEC 27001 (A.8.24), Common Criteria, FIPS 140-3, EU DORA/NIS2, US M-23-02 / NSM-10, and OSS assurance (SLSA, OpenSSF Scorecard, SPDX/REUSE).
• Governance: Contributing · Security · Code of Conduct · Changelog.

License

Apache-2.0. The methodology is open; the assessments, attestation reports, and deliverables are where the quantakrypto practice lives.

Support & training

Questions, commercial support, or post-quantum readiness training for your team — visit quantakrypto.com or email [email protected].