quantakrypto
Loading…
Loading…
Free tooling for frontend, backend, and infrastructure post-quantum readiness — a scanner, an MCP server for AI agents, a conformance battery, and a CI gate. Built from what we find in audits.
7
packages
14
source languages
5
report formats
0
runtime dependencies
The same tools read your platform, not just your code — 18 infrastructure surfaces →
qScan finds quantum-vulnerable cryptography across your codebase; Sieve conformance-tests your ML-KEM/ML-DSA/SLH-DSA against the bugs that matter.
CLI scanner · TypeScript
Find quantum-vulnerable cryptography in any codebase.
A static scanner that walks your source (14 languages), dependency manifests, and infrastructure config for classical asymmetric crypto — RSA, ECDH, ECDSA, EdDSA, DH, and more — plus TLS, PKI, key material, and code-signing surfaces, then scores where harvest-now-decrypt-later exposure is highest.
Quick start
$ npx @quantakrypto/qscan ./Live-endpoint prober · TypeScript
Probe live TLS/SSH endpoints you own for post-quantum readiness.
The static scanners read configuration; qProbe reads reality. It handshakes the live TLS and SSH endpoints you own and reports whether they actually negotiate a post-quantum hybrid key exchange. Hard-gated behind an ownership attestation — it never modifies a target and never scans ranges.
Quick start
$ npx @quantakrypto/qprobe --i-own-this example.comConformance battery · TypeScript
Conformance-test an ML-KEM / ML-DSA / SLH-DSA implementation against the bugs that matter.
A conformance harness that drives any implementation over a simple stdin/stdout JSON protocol and exercises it against curated categories — each targeting a bug class we have seen in real audits or the public literature. It ships no test vectors and never fabricates expected values.
Quick start
$ npx @quantakrypto/sieve --impl "node ./my-impl.js" --param ml-kem-768One zero-dependency repo · Apache-2.0 · npm @quantakrypto/*
Run qScan on every pull request and make post-quantum readiness a standing quality gate — new classical asymmetric crypto becomes a reviewable signal, not a silent regression.
CI integration · GitHub Actions
Fail the build when new quantum-vulnerable crypto lands.
Run qScan on every pull request and turn post-quantum readiness into a standing quality gate. New classical asymmetric cryptography becomes a reviewable signal instead of a silent regression.
Workflow
uses: quantakrypto/pqc-tools/packages/action@v1Give AI coding agents first-class PQC capabilities over the Model Context Protocol — inventory the cryptography in a repo, explain the exposure, and propose hybrid migrations, right inside the editor.
MCP server · TypeScript
PQC-readiness, native to your AI coding agent.
A Model Context Protocol server that gives AI coding agents first-class post-quantum capabilities: inventory the cryptography in a repository, explain exposure, and propose hybrid migrations — directly inside the editor. Local stdio today, with a hostable HTTP transport.
Quick start
$ claude mcp add quantakrypto npx @quantakrypto/mcpHosted MCP · OAuth · OAuth 2.1
The MCP as a managed, OAuth-secured endpoint — nothing to run.
Connect any MCP-compatible agent to the hosted quantakrypto server: sign in over OAuth 2.1 and get a 30-day token. Exposes the advisory and content-analysis tools over HTTP (whole-repo filesystem scans stay on the local server). The gateway is open source, so you can self-host your own endpoint instead of using ours.
Quick start
$ claude mcp add --transport http quantakrypto https://mcp.quantakrypto.com/mcpBYOK LLM client (library) · TypeScript
Bring-your-own-key LLM triage & fix-drafting for qScan.
An opt-in, bring-your-own-key LLM client (Anthropic or OpenAI-compatible) that powers qScan's --triage re-ranking and the qremediate fix-drafting. Zero third-party runtime dependencies via native fetch; secrets are always redacted, and the offline scanner never loads it unless you ask.
Quick start
$ npm i @quantakrypto/agentOpen tooling drives adoption and invites scrutiny — the same way the strongest open security frameworks work. The framework is open; the audit, the certificate, and the deliverables are where the practice lives. If you find a bug we missed, it becomes a new test, and the toolkit grows sharper over time.
Yes. Everything is Apache-2.0 in one monorepo, pqc-tools, with zero runtime dependencies. You can use it commercially at no cost.
It scans your codebase across fourteen languages for quantum-vulnerable cryptography, gives a readiness score from zero to one hundred with harvest-now-decrypt-later ranking, and exports SARIF, JSON, CycloneDX CBOM, ISO 27001 A.8.24 evidence, and OpenVEX.
A live prober that checks whether a TLS or SSH endpoint actually negotiates hybrid post-quantum key exchange, such as X25519MLKEM768. It is read-only and gated behind an ownership attestation: no attestation, no probe.
A conformance battery that tests an ML-KEM, ML-DSA, or SLH-DSA implementation against the FIPS 203, 204, and 205 standards.
Yes. The quantakrypto GitHub Action fails the build when new quantum-vulnerable cryptography appears, with inline pull-request annotations and baselines so existing findings do not block you.
No. The tools run locally. Optional LLM triage is bring-your-own-key, so any AI assistance uses your own provider and keys.
Start with a scan, then book a discovery call when you want a senior pair of eyes.