Post-quantum readiness, native to your AI coding agent
The quantakrypto MCP server gives AI coding agents first-class post-quantum tools — inventory the cryptography in your code, explain the exposure, and get hybrid-migration guidance, without leaving the editor. Run it locally, or connect to the hosted endpoint at mcp.quantakrypto.com with an OAuth sign-in and a 30-day token.
What the agent gets
Two classes of tools. Advisory tools answer from quantakrypto’s detectors and knowledge base. Analysis tools take content you send — a snippet, a package name — and never read your filesystem, so they are safe to run against the hosted endpoint.
explain_findingExplain a detected classical-crypto finding and its quantum exposure.
suggest_hybridRecommend a hybrid post-quantum replacement (e.g. X25519MLKEM768).
list_rulesList the detectors and the algorithms they catch.
get_fix_examplesReturn worked before/after remediation examples.
verify_fixRun the detectors over a submitted code snippet — confirm an edit removed the vulnerable usage.
check_dependencyCheck whether a package is in the known quantum-vulnerable dependency database.
triage_findingsRank findings by harvest-now-decrypt-later exposure.
remediate_findingsPropose remediations for a set of findings.
Connect it
Run it locally today for whole-repository scans, or use the hosted endpoint (early access) for a zero-install, always-on server your team shares.
# Local (stdio) — available today, reads your workspace claude mcp add quantakrypto npx @quantakrypto/mcp # Cursor / VS Code / any MCP client: # command: npx args: ["@quantakrypto/mcp"]
# Hosted (remote) — live at mcp.quantakrypto.com · OAuth 2.1 · 30-day tokens # Your client runs the OAuth flow; sign in and it stores a 30-day token: claude mcp add --transport http quantakrypto https://mcp.quantakrypto.com/mcp
The hosted endpoint is live at mcp.quantakrypto.com. Connecting opens a sign-in page; sign in with email, Google, or GitHub, and your client receives an access token valid for 30 days.
Questions
What is the difference between the local and hosted MCP?
The local server runs over stdio via npx and can read your workspace directly — best for scanning a repository you have checked out. The hosted server is a shared, remote endpoint reached over HTTP with an OAuth token; it exposes the advisory tools and the content-based analysis tools (you send a snippet or a dependency name rather than a path), so it never touches your filesystem.
How does authentication work for the hosted MCP?
You register with an email and verify it, then your MCP client completes an OAuth 2.1 flow and receives an access token valid for 30 days. The token is sent as a Bearer credential on each request; you can revoke or regenerate it from your account. The hosted endpoint is live at mcp.quantakrypto.com — sign in when your MCP client prompts you. See the Privacy Policy for how sign-in data is handled.
Does the hosted server see my source code?
Only what you explicitly send it. The hosted tools are advisory (they answer from quantakrypto's rules and knowledge) or content-based (you pass a snippet to verify_fix or a package name to check_dependency). The filesystem tools that walk a directory are disabled over HTTP by design — use the local stdio server for whole-repository scans.
Is the MCP server open source?
Yes. The server, its detectors, and the transport are Apache-2.0 in the public pqc-tools monorepo. The hosted service adds the multi-tenant auth and rate limiting around that same open core.
Full toolkit and quick-starts on the docs and tools pages. How we handle sign-in data: Privacy · Terms.
Bring post-quantum readiness into your workflow
Register for hosted MCP early access, or book a call to scope an audit or migration.