Open-source, by design.

Find quantum-vulnerable cryptography in any codebase.

A static scanner that walks your source and dependency tree for classical asymmetric crypto — RSA, ECDH, ECDSA, DH, and more — plus legacy TLS configuration, then scores where harvest-now-decrypt-later exposure is highest.

• Crypto inventory + 0–100 readiness score
• Harvest-now-decrypt-later exposure ranking
• Vulnerable-dependency database + TLS/cert checks
• SARIF, JSON & CycloneDX CBOM output

$ npx @quantakrypto/qscan ./

PQC-readiness, native to your AI coding agent.

A Model Context Protocol server that gives AI coding agents first-class post-quantum capabilities: inventory the cryptography in a repository, explain exposure, and propose hybrid migrations — directly inside the editor. Local stdio today, with a hostable HTTP transport.

• Crypto-inventory & explain tools for agents
• Hybrid migration suggestions (X25519MLKEM768)
• Local stdio now, hostable HTTP transport
• Zero-dependency JSON-RPC, MCP-spec compliant

$ claude mcp add quantakrypto npx @quantakrypto/mcp

Conformance-test an ML-KEM / ML-DSA / SLH-DSA implementation against the bugs that matter.

A conformance harness that drives any implementation over a simple stdin/stdout JSON protocol and exercises it against curated categories — each targeting a bug class we have seen in real audits or the public literature. It ships no test vectors and never fabricates expected values.

• ML-KEM, ML-DSA & SLH-DSA (FIPS 203/204/205)
• Implicit-rejection & modulus-range checks
• Categories tagged to real audit findings
• Ships no KAT vectors — never fabricates values

$ npx @quantakrypto/sieve --impl "./your-impl" --param ml-kem-768

Fail the build when new quantum-vulnerable crypto lands.

Run qScan on every pull request and turn post-quantum readiness into a standing quality gate. New classical asymmetric cryptography becomes a reviewable signal instead of a silent regression.

• Drop-in GitHub Action
• Inline PR annotations on new findings
• Configurable severity thresholds
• Baselines so existing debt does not block

$ uses: dandelionlabs-io/qproof-tools/packages/action@v1