{
  "markdown": "# KHEPRA MCP Server\n\n[![smithery badge](https://smithery.ai/badge/skone/pqc-khepra-mcp)](https://smithery.ai/servers/skone/pqc-khepra-mcp)\n[![MCP Registry](https://img.shields.io/badge/MCP_Registry-io.github.nouchix%2Fpqc--khepra--mcp-blue?style=for-the-badge)](https://registry.modelcontextprotocol.io/?q=khepra)\n[![mcpservers.org](https://img.shields.io/badge/mcpservers.org-nouchix%2Fpqc--khepra--mcp-orange?style=for-the-badge)](https://mcpservers.org/servers/nouchix/pqc-khepra-mcp)\n[![Cline Marketplace](https://img.shields.io/badge/Cline_Marketplace-Issue_%231824-blueviolet?style=for-the-badge)](https://github.com/cline/mcp-marketplace/issues/1824)\n[![License](https://img.shields.io/badge/License-Community%20%2F%20Commercial-green?style=for-the-badge)](https://nouchix.com)\n[![Container](https://img.shields.io/badge/Container-ghcr.io-green?style=for-the-badge&logo=docker)](https://ghcr.io/nouchix/pqc-khepra-mcp)\n[![PQC](https://img.shields.io/badge/PQC-ML--DSA--65%20%2F%20FIPS%20204-purple?style=for-the-badge)](https://csrc.nist.gov/pubs/fips/204/final)\n[![Live](https://img.shields.io/badge/Live-mcp.souhimbou.ai-brightgreen?style=for-the-badge)](https://mcp.souhimbou.ai/mcp/v1/health)\n\n**Sovereign compliance engine with 36,195 STIG/CCI/NIST/CMMC mappings. 76 tools. v2.0.0.**\n\nAir-gappable. Zero token costs. Run `ert_scan` → get a Godfather Report with dollar-denominated business impact.  \nThe only MCP compliance server that runs on your metal — with the **World's First DoD PQC STIG** built in.\n\n> **[PQC-01-STIG-V1R1 — Full Whitepaper →](docs/PQC-01-STIG-V1R1.md)**  \n> 17 controls covering CNSA 2.0, FIPS 203/204/205, and the NSA's May 2026 MCP security advisory.  \n> The world's first DoD-style Post-Quantum Cryptography STIG, including the first PQC controls for agentic AI and MCP deployments.\n\n> **Live hosted endpoint:** `https://mcp.souhimbou.ai/sse` — zero install, connect in 30 seconds.  \n> Self-host for sovereign/air-gap: [Docker](#option-a-docker-recommended) or [binary](#option-b-compiled-binary).\n\n---\n\n\n## Tiers\n\n| Tier | Price | License Key | Tools | Continuous Compliance Scanning | Egress |\n|------|-------|-------------|-------|---------------------------------|--------|\n| **Community** | Free | ❌ Not required | `pqc_stig` + 12 core tools | — | Zero (sovereign mode) |\n| **Pro** | $19/mo | ✅ Required | Compliance reporting, ACP, NHI inventory | ✅ | Zero |\n| **Enterprise** | $499/mo | ✅ Required | All 76 tools | ✅ | Zero |\n| **Sovereign** | Custom — [Contact Sales](https://khepra.nouchix.com) | ✅ Required | All 76 tools + air-gap/offline licensing + HSM | ✅ | Zero |\n\n> **Community tier is free.** Run `pqc_stig` to assess your project's quantum readiness against  \n> **PQC-01-STIG-V1R1** — the World's First DoD-style Post-Quantum Cryptography STIG — no license key needed.\n>\n> **Continuous compliance scanning (autopilot) is included in every paid tier** — it's core to the product, not an upsell.\n\n---\n\n## What It Does\n\nKHEPRA MCP connects your AI assistant directly to a hardened compliance engine. Ask Claude or any MCP client to scan a system, map findings to STIG/NIST/CMMC controls, and generate an executive-ready risk report — all without sending data to external APIs.\n\n**Key capabilities:**\n- 36,195 STIG/CCI/NIST 800-53/800-171/CMMC mappings (offline, bundled)\n- Post-quantum cryptographic attestation on every tool call (ML-DSA-65 / FIPS 204)\n- **World's First DoD PQC STIG** — 17 controls covering CNSA 2.0 / FIPS 203/204/205 + agentic AI / MCP ([PQC-01-STIG-V1R1](docs/PQC-01-STIG-V1R1.md))\n- Godfather Report: dollar-denominated business impact per finding (FAIR model)\n- Air-gap and SCIF compatible — sovereign/ironbank modes make zero egress calls\n- Flat annual licensing — no per-token or per-query charges\n- Runs on your metal: on-prem, DoD, IC, classified environments\n\n---\n\n## Quickstart — Hosted Endpoint (Zero Install)\n\nThe fastest path to a live compliance tool in your AI client. No Docker, no binary, no build:\n\n```json\n{\n  \"mcpServers\": {\n    \"khepra\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"mcp-remote\", \"https://mcp.souhimbou.ai/sse\"]\n    }\n  }\n}\n```\n\nOr if your client supports native SSE transport:\n```\nhttps://mcp.souhimbou.ai/sse\n```\n\nHealth check: `https://mcp.souhimbou.ai/mcp/v1/health`\n\n> **Data note:** The hosted endpoint runs in `edge` mode — DAG is in-memory and ephemeral. For persistent, signed audit trails and air-gap deployment, use the self-hosted options below.\n\n---\n\n## Self-Hosted Installation\n\nFor sovereign/air-gap deployment: **Docker** (recommended, no build required) or **compiled binary** (fastest startup, SCIF-ready). Both support the same environment variables and all MCP clients.\n\nChoose your path:\n\n| Method | Best For | Startup |\n|--------|----------|---------|\n| [Hosted endpoint](#quickstart--hosted-endpoint-zero-install) | Fastest start, cloud tools | Instant |\n| [Docker](#option-a-docker-recommended) | Most users, easiest self-host | ~2s |\n| [Compiled Binary](#option-b-compiled-binary) | Air-gap, SCIF, performance | ~300ms |\n\n---\n\n### Option A: Docker (Recommended)\n\nRequires Docker Desktop or Docker Engine. The image is pre-built and ships the full compliance database — no additional downloads in sovereign mode.\n\n```bash\n# Pull once\ndocker pull ghcr.io/nouchix/pqc-khepra-mcp:latest\n\n# Test it (should print the initialize response and exit)\necho '{\"jsonrpc\":\"2.0\",\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-11-25\",\"capabilities\":{},\"clientInfo\":{\"name\":\"test\",\"version\":\"1.0\"}},\"id\":0}' \\\n  | docker run --rm -i -e KHEPRA_MODE=sovereign ghcr.io/nouchix/pqc-khepra-mcp:latest\n```\n\n---\n\n### Option B: Compiled Binary\n\nRequires Go 1.21+ for building, or download a pre-built release from [GitHub Releases](https://github.com/nouchix/PQC-Khepra-MCP/releases).\n\n```bash\ngit clone https://github.com/nouchix/PQC-Khepra-MCP.git\ncd PQC-Khepra-MCP\n\n# Build (cross-compile for your OS)\ngo build -o khepra-mcp ./cmd/khepra-mcp        # Linux / macOS\ngo build -o khepra-mcp.exe ./cmd/khepra-mcp    # Windows\n\n# Test the binary\necho '{\"jsonrpc\":\"2.0\",\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-11-25\",\"capabilities\":{},\"clientInfo\":{\"name\":\"test\",\"version\":\"1.0\"}},\"id\":0}' \\\n  | KHEPRA_MODE=sovereign ./khepra-mcp\n```\n\n#### Windows — using the batch launcher\n\nThe repo ships a `run-mcp.bat` launcher for Windows. It uses the pre-built binary (fast path) and falls back to `go run` automatically:\n\n```bat\n:: run-mcp.bat is already in the repo at the root of PQC-Khepra-MCP\n:: Point your MCP client to: cmd /c C:\\path\\to\\PQC-Khepra-MCP\\run-mcp.bat\n```\n\n---\n\n## Adding to Your AI Client\n\n### Claude Desktop\n\nConfig file location:\n- **macOS**: `~/Library/Application Support/Claude/claude_desktop_config.json`\n- **Windows**: `%APPDATA%\\Claude\\claude_desktop_config.json`\n- **Linux**: `~/.config/Claude/claude_desktop_config.json`\n\n#### Community tier — Docker (macOS / Linux)\n\n```json\n{\n  \"mcpServers\": {\n    \"khepra\": {\n      \"command\": \"docker\",\n      \"args\": [\n        \"run\", \"--rm\", \"-i\",\n        \"-e\", \"KHEPRA_MODE=sovereign\",\n        \"-v\", \"/var/lib/khepra:/var/lib/khepra\",\n        \"ghcr.io/nouchix/pqc-khepra-mcp:latest\"\n      ]\n    }\n  }\n}\n```\n\n#### Community tier — Docker (Windows)\n\n```json\n{\n  \"mcpServers\": {\n    \"khepra\": {\n      \"command\": \"docker\",\n      \"args\": [\n        \"run\", \"--rm\", \"-i\",\n        \"-e\", \"KHEPRA_MODE=sovereign\",\n        \"-v\", \"C:\\\\Users\\\\YourName\\\\.khepra:/var/lib/khepra\",\n        \"ghcr.io/nouchix/pqc-khepra-mcp:latest\"\n      ]\n    }\n  }\n}\n```\n\n#### Community tier — Binary (Windows, fastest startup)\n\n```json\n{\n  \"mcpServers\": {\n    \"khepra\": {\n      \"command\": \"C:\\\\path\\\\to\\\\PQC-Khepra-MCP\\\\khepra-mcp.exe\",\n      \"args\": [],\n      \"env\": {\n        \"KHEPRA_MODE\": \"sovereign\",\n        \"KHEPRA_NETWORK_POLICY\": \"lan\",\n        \"MCP_PQC_ENABLED\": \"true\",\n        \"KHEPRA_MANIFEST_PATH\": \"C:\\\\path\\\\to\\\\PQC-Khepra-MCP\\\\manifest.json\"\n      }\n    }\n  }\n}\n```\n\n#### Community tier — Binary via batch launcher (Windows)\n\n```json\n{\n  \"mcpServers\": {\n    \"khepra\": {\n      \"command\": \"cmd\",\n      \"args\": [\"/c\", \"C:\\\\path\\\\to\\\\PQC-Khepra-MCP\\\\run-mcp.bat\"],\n      \"env\": {\n        \"KHEPRA_MODE\": \"sovereign\",\n        \"KHEPRA_NETWORK_POLICY\": \"lan\",\n        \"MCP_PQC_ENABLED\": \"true\"\n      }\n    }\n  }\n}\n```\n\n#### Pro / Enterprise / Sovereign tier (with license key)\n\n```json\n{\n  \"mcpServers\": {\n    \"khepra\": {\n      \"command\": \"docker\",\n      \"args\": [\n        \"run\", \"--rm\", \"-i\",\n        \"-e\", \"KHEPRA_LICENSE_KEY\",\n        \"-e\", \"KHEPRA_MODE=sovereign\",\n        \"-v\", \"/var/lib/khepra:/var/lib/khepra\",\n        \"-v\", \"/var/log/khepra:/var/log/khepra\",\n        \"ghcr.io/nouchix/pqc-khepra-mcp:latest\"\n      ],\n      \"env\": {\n        \"KHEPRA_LICENSE_KEY\": \"YOUR_LICENSE_KEY_HERE\"\n      }\n    }\n  }\n}\n```\n\nAfter editing, restart Claude Desktop. Verify in **Settings → Developer** — you should see `khepra` with status **running** and all tools listed.\n\n---\n\n### Cursor\n\nConfig file: `.cursor/mcp.json` in your project root, or `~/.cursor/mcp.json` globally.\n\n#### Docker (macOS / Linux)\n\n```json\n{\n  \"servers\": {\n    \"khepra\": {\n      \"type\": \"stdio\",\n      \"command\": \"docker\",\n      \"args\": [\n        \"run\", \"--rm\", \"-i\",\n        \"-e\", \"KHEPRA_MODE=sovereign\",\n        \"-v\", \"/var/lib/khepra:/var/lib/khepra\",\n        \"ghcr.io/nouchix/pqc-khepra-mcp:latest\"\n      ]\n    }\n  }\n}\n```\n\n#### Binary (macOS / Linux)\n\n```json\n{\n  \"servers\": {\n    \"khepra\": {\n      \"type\": \"stdio\",\n      \"command\": \"/path/to/khepra-mcp\",\n      \"args\": [],\n      \"env\": {\n        \"KHEPRA_MODE\": \"sovereign\",\n        \"KHEPRA_MANIFEST_PATH\": \"/path/to/PQC-Khepra-MCP/manifest.json\"\n      }\n    }\n  }\n}\n```\n\n#### Binary (Windows)\n\n```json\n{\n  \"servers\": {\n    \"khepra\": {\n      \"type\": \"stdio\",\n      \"command\": \"C:\\\\path\\\\to\\\\PQC-Khepra-MCP\\\\khepra-mcp.exe\",\n      \"args\": [],\n      \"env\": {\n        \"KHEPRA_MODE\": \"sovereign\",\n        \"KHEPRA_MANIFEST_PATH\": \"C:\\\\path\\\\to\\\\PQC-Khepra-MCP\\\\manifest.json\"\n      }\n    }\n  }\n}\n```\n\n---\n\n### VS Code (with GitHub Copilot or Cline extension)\n\nConfig file: `.vscode/mcp.json` in your project, or user settings.\n\n```json\n{\n  \"servers\": {\n    \"khepra\": {\n      \"type\": \"stdio\",\n      \"command\": \"docker\",\n      \"args\": [\n        \"run\", \"--rm\", \"-i\",\n        \"-e\", \"KHEPRA_MODE=sovereign\",\n        \"-v\", \"${env:HOME}/.khepra:/var/lib/khepra\",\n        \"ghcr.io/nouchix/pqc-khepra-mcp:latest\"\n      ]\n    }\n  }\n}\n```\n\nOr via user `settings.json` for the Cline extension:\n\n```json\n{\n  \"cline.mcpServers\": {\n    \"khepra\": {\n      \"command\": \"docker\",\n      \"args\": [\n        \"run\", \"--rm\", \"-i\",\n        \"-e\", \"KHEPRA_MODE=sovereign\",\n        \"ghcr.io/nouchix/pqc-khepra-mcp:latest\"\n      ]\n    }\n  }\n}\n```\n\n---\n\n### Windsurf\n\nConfig file: `~/.codeium/windsurf/mcp_config.json`\n\n```json\n{\n  \"mcpServers\": {\n    \"khepra\": {\n      \"command\": \"docker\",\n      \"args\": [\n        \"run\", \"--rm\", \"-i\",\n        \"-e\", \"KHEPRA_MODE=sovereign\",\n        \"-v\", \"/var/lib/khepra:/var/lib/khepra\",\n        \"ghcr.io/nouchix/pqc-khepra-mcp:latest\"\n      ]\n    }\n  }\n}\n```\n\n---\n\n### Continue.dev\n\nConfig file: `~/.continue/config.json` — add to the `experimental.modelContextProtocolServers` array:\n\n```json\n{\n  \"experimental\": {\n    \"modelContextProtocolServers\": [\n      {\n        \"name\": \"khepra\",\n        \"transport\": {\n          \"type\": \"stdio\",\n          \"command\": \"docker\",\n          \"args\": [\n            \"run\", \"--rm\", \"-i\",\n            \"-e\", \"KHEPRA_MODE=sovereign\",\n            \"ghcr.io/nouchix/pqc-khepra-mcp:latest\"\n          ]\n        }\n      }\n    ]\n  }\n}\n```\n\n---\n\n### Cloud / SaaS AI Tools (Claude.ai, ChatGPT, Gemini, etc.)\n\nUse the **live hosted endpoint** at `mcp.souhimbou.ai` — no setup required:\n\n#### Option 1 — Live hosted endpoint (recommended, zero setup)\n\n```json\n{\n  \"mcpServers\": {\n    \"khepra\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"mcp-remote\", \"https://mcp.souhimbou.ai/sse\"]\n    }\n  }\n}\n```\n\nOr direct SSE URL for tools that accept it:\n```\nhttps://mcp.souhimbou.ai/sse\n```\n\n| Cloud Tool | Where to add MCP URL |\n|------------|---------------------|\n| Claude.ai (Pro/Team) | Settings → Integrations → MCP Servers |\n| Cursor | `.cursor/mcp.json` → `url` field |\n| OpenAI Assistants | API `tools` field with `type: \"mcp\"` |\n| Glama.ai | Workspace → MCP Servers |\n| Smithery.ai | Catalog → Self-hosted server |\n\n#### Option 2 — `mcp-remote` proxy (local binary behind the bridge)\n\nIf you need sovereign mode (zero egress) proxied to a cloud tool:\n\n```bash\n# Install once\nnpm install -g mcp-remote\n\n# Bridge your local sovereign instance\nKHEPRA_MODE=sovereign mcp-remote \\\n  --server \"docker run --rm -i -e KHEPRA_MODE=sovereign ghcr.io/nouchix/pqc-khepra-mcp:latest\" \\\n  --port 3000\n\n# Point cloud tool to:\n# http://localhost:3000/sse\n```\n\n> **Security note:** In `sovereign`/`ironbank` mode, KHEPRA makes zero egress calls — only the bridge connection to the cloud tool carries data.\n\n#### Option 3 — Smithery / MCP Registries (Community tier)\n\nKHEPRA is listed across all major MCP discovery platforms. Cloud tools that support registry-based discovery can install it directly:\n\n| Registry | URL |\n|---|---|\n| **Smithery.ai** | [smithery.ai/servers/skone/pqc-khepra-mcp](https://smithery.ai/servers/skone/pqc-khepra-mcp) |\n| **MCP Registry (official)** | [registry.modelcontextprotocol.io/?q=khepra](https://registry.modelcontextprotocol.io/?q=khepra) |\n| **mcpservers.org** | [mcpservers.org/servers/nouchix/pqc-khepra-mcp](https://mcpservers.org/servers/nouchix/pqc-khepra-mcp) |\n| **Cline Marketplace** | [github.com/cline/mcp-marketplace/issues/1824](https://github.com/cline/mcp-marketplace/issues/1824) |\n| **Live Hosted Endpoint** | [mcp.souhimbou.ai](https://mcp.souhimbou.ai/) |\n\n```\nRegistry ID: io.github.nouchix/pqc-khepra-mcp\n```\n\n---\n\n## Validation — Test Your Installation\n\nRun this from your terminal to verify the server responds correctly:\n\n```bash\n# Docker\necho '{\"jsonrpc\":\"2.0\",\"method\":\"tools/list\",\"params\":{},\"id\":1}' \\\n  | docker run --rm -i -e KHEPRA_MODE=sovereign ghcr.io/nouchix/pqc-khepra-mcp:latest\n\n# Binary (Linux / macOS)\necho '{\"jsonrpc\":\"2.0\",\"method\":\"tools/list\",\"params\":{},\"id\":1}' \\\n  | KHEPRA_MODE=sovereign ./khepra-mcp\n\n# Binary (Windows PowerShell)\n'{\"jsonrpc\":\"2.0\",\"method\":\"tools/list\",\"params\":{},\"id\":1}' \\\n  | & \".\\khepra-mcp.exe\"\n```\n\nExpected output: a JSON-RPC response listing all available tools. If you see `\"tools\": [...]` with 12+ entries — you're connected.\n\n#### Full protocol validation (Windows)\n\n```powershell\n# Runs the complete Claude Desktop handshake sequence and validates all responses\n.\\scripts\\test-mcp-handshake.ps1 -BinaryPath \".\\khepra-mcp.exe\"\n\n# Expected output:\n# [PASS] initialize | protocolVersion=2025-11-25 | listChanged=False\n# [PASS] tools/list | count=34\n# TRL-10 READY - Server passes full Claude Desktop protocol validation\n```\n\n---\n\n## MCP Tools\n\n### Community Tier (Free — No License Key)\n\n#### `pqc_stig` — World's First DoD PQC STIG ⭐\nAssesses a source code directory against **PQC-01-STIG-V1R1**: 12 controls covering CNSA 2.0 algorithm approval, ML-DSA-65 key strength, ML-KEM-768 encapsulation, hybrid cryptography, key storage, constant-time implementation, and certificate chain requirements.\n\n```\npqc_stig(scan_path?: string, profile?: \"quick\" | \"full\" | \"executive\")\n```\n\n> **Example:** *\"Run pqc_stig on my project and tell me if I'm CNSA 2.0 compliant\"*\n\n#### `nist_map`\nMap CCI identifiers or STIG findings to NIST 800-53 Rev 5 controls.\n\n#### `khepra_query_stig`\nQuery the 36,195-row STIG/CCI/NIST/CMMC compliance database by control ID.\n\n#### `dark_crypto_contribute` *(opt-in)*\nContribute anonymized cryptographic algorithm telemetry to the SouHimBou AI Dark Crypto Intelligence Network. No PII. Opt-in only — never fires without explicit invocation.\n\n---\n\n### Pro / Enterprise / Sovereign Tier\n\n#### `ert_scan`\nEnterprise Risk & Threat scan across STIG, NIST 800-53, NIST 800-171, CMMC, and FedRAMP. Returns Godfather Report with dollar-denominated business impact.\n\n```\nert_scan(target: string, frameworks?: string[], output_format?: \"godfather\" | \"json\" | \"csv\")\n```\n\n> **Example:** *\"Run ert_scan on /etc and generate a Godfather Report\"*\n\n#### `stig_check`\nAutomated RHEL-09-STIG-V1R3 compliance scan against a live system or configuration path.\n\n#### `cmmc_assess`\nFull CMMC Level 1, 2, or 3 assessment with gap analysis and POA&M generation.\n\n#### `godfather_report`\nGenerate an executive Godfather Report from prior scan results: top 10 findings ranked by dollar exposure, remediation ROI, and FAIR model business impact.\n\n#### + 20 additional tools\n`agent_record`, `dag_attestation`, `flight_export`, `khepra_get_dag_chain`, `nhi_inventory`, `acp_status`, `owasp_agent_assess`, `khepra_export_attestation`, `khepra_export_poam`, `khepra_get_compliance_score`, `ert_crypto`, `ert_readiness`, `stig_benchmark`, `ir_analysis`, `vuln_hunter`, `sbom_generate`, `threat_model`, `khepra_query_threat_intel`, `discover_assets`, and more.\n\n---\n\n## The Godfather Report\n\nUnlike compliance scanners that output a wall of CVEs, KHEPRA translates findings into the language executives care about:\n\n```\nFinding: RHEL-09-212030 — No FIPS-validated crypto on /etc/ssh\nSeverity: CAT I (HIGH)\nBusiness Impact: $2.4M estimated breach exposure (FAIR model)\nRemediation Cost: $800 (4 hours engineer time)\nROI: 3,000x\n```\n\nEvery finding includes control ID, framework mapping, business impact in dollars, remediation cost estimate, and ROI.\n\n---\n\n## Deployment Modes\n\n| Mode | Air-Gap | Egress | Telemetry | Use Case |\n|------|---------|--------|-----------|----------|\n| `sovereign` | ✅ Yes | Zero | Zero | On-prem, SCIF, classified (DEFAULT) |\n| `ironbank` | ✅ Yes | Zero | Zero | DoD/IC production, FIPS-only |\n| `hybrid` | ❌ No | LAN | Zero | Edge + cloud coordination |\n| `edge` | ❌ No | Unrestricted | Zero | Fully stateless SaaS |\n\nSet via `KHEPRA_MODE` environment variable. Unknown values are rejected at startup and fall back to `sovereign` (fail-closed).\n\n---\n\n## Environment Variables\n\n| Variable | Required | Default | Description |\n|----------|----------|---------|-------------|\n| `KHEPRA_LICENSE_KEY` | Pro/Enterprise/Sovereign only | — | License key. Community tier runs without one. Get at [nouchix.com](https://nouchix.com) |\n| `KHEPRA_MODE` | No | `sovereign` | Deployment mode: `sovereign`, `ironbank`, `hybrid`, `edge` |\n| `KHEPRA_MANIFEST_PATH` | No | `manifest.json` | Path to signed tool manifest file |\n| `KHEPRA_HOME` | No | `/var/lib/khepra` | Data and compliance DB directory |\n| `KHEPRA_LOG_DIR` | No | `/var/log/khepra` | Log directory |\n| `KHEPRA_DAG_PATH` | No | `~/.khepra/dag` | DAG audit chain storage path |\n| `KHEPRA_AUDIT_LOG_PATH` | No | `~/.khepra/audit.ndjson` | Signed audit log path |\n| `KHEPRA_MAX_CONCURRENT` | No | `5` | Max concurrent tool calls per agent |\n| `KHEPRA_NETWORK_POLICY` | No | `lan` | Network scope: `lan`, `none`, `unrestricted` |\n| `MCP_PQC_ENABLED` | No | `true` | Enable ML-DSA-65 PQC attestation on all responses |\n\n---\n\n## Air-Gap & SCIF Deployment\n\nKHEPRA makes **zero external network calls** in `sovereign` and `ironbank` modes:\n- License validated offline via ML-DSA-65 signed `license.adinkhepra` file\n- Compliance databases (36,195 mappings) bundled in container — no external downloads\n- No telemetry, no heartbeat, no egress — verified at the transport layer\n\n```bash\n# Transfer image to air-gapped network\ndocker save ghcr.io/nouchix/pqc-khepra-mcp:latest | gzip > khepra-mcp.tar.gz\n\n# On air-gapped host:\ndocker load < khepra-mcp.tar.gz\n```\n\n> **Note on telemetry:** The `dark_crypto_contribute` tool (Community tier) sends anonymized cryptographic algorithm telemetry to the [SouHimBou AI](https://souhimbou.ai) intelligence network **only when explicitly invoked by the user**. It is never triggered automatically. In sovereign/ironbank mode, all network calls are blocked at the transport layer regardless.\n\n---\n\n## Compliance Coverage\n\n| Framework | Version | Mappings |\n|-----------|---------|----------|\n| STIG (RHEL 9) | V1R3 | Automated scanning |\n| NIST 800-53 | Rev 5 | 2,120 CCIs |\n| NIST 800-171 | Rev 2 | 320 controls |\n| CMMC | Level 3 | Full practice set |\n| FedRAMP | High | Baseline scanning |\n| **PQC-01-STIG-V1R1** | V1R1 | **17 PQC controls (CNSA 2.0)** |\n| **Total** | | **36,195+ mappings** |\n\n---\n\n## Licensing\n\n**No per-token or per-query charges on any paid tier.**\n\n| Tier | Cost | License Key | Tools |\n|------|------|-------------|-------|\n| Community | Free | Not required | `pqc_stig` + 12 core tools |\n| Pro | $19/mo | Required | Compliance reporting, ACP, NHI inventory, autopilot |\n| Enterprise | $499/mo | Required | All 76 tools, autopilot |\n| Sovereign | Custom — Contact Sales | Required | All 76 tools + air-gap/offline licensing + HSM, autopilot |\n\n- Community tier is permanently free — contribute to open-source PQC adoption\n- Pro/Enterprise: self-serve billing\n- Sovereign: contact [contact@nouchix.com](mailto:contact@nouchix.com) or visit [nouchix.com](https://nouchix.com)\n\n---\n\n## Security\n\n### Reporting Vulnerabilities\n\n**Do not open public issues for security vulnerabilities.**\n\nReport privately via **[GitHub Security Advisories](https://github.com/nouchix/PQC-Khepra-MCP/security/advisories/new)** or email **[support@nouchix.com](mailto:support@nouchix.com)**.\n\n| SLA | Target |\n|-----|--------|\n| Acknowledgement | 24 hours |\n| Initial assessment | 5 business days |\n| Patch / mitigation (Critical) | 30 days |\n\nWe accept encrypted reports via PGP (`keys/security_contact.asc`) and Post-Quantum channels (Dilithium / ML-DSA-65 keys in `keys/`). See [SECURITY.md](SECURITY.md) for the full disclosure policy and ASAF event taxonomy.\n\n---\n\n### Security Posture\n\n> **Deploying advanced post-quantum cryptography, air-gapped isolation, and comprehensive STIG mappings — built in direct alignment with NSA & ASD Model Context Protocol guidelines.**\n\n#### NSA & ASD MCP Security Alignment\n\nThe NSA and Australian Signals Directorate (ASD) have published specific threat vectors for AI systems interacting with local environments. KHEPRA MCP is explicitly designed to mitigate every identified vector:\n\n| NSA/ASD Requirement | KHEPRA Implementation |\n|---------------------|-----------------------|\n| Cryptographic validation of tool responses | ML-DSA-65 (Dilithium) signatures on all JSON-RPC 2.0 payloads |\n| Input validation & sanitization | Parameter injection resistance via strict JSON Schema validation |\n| Principle of least privilege credentials | Short-lived ephemeral tokens tied to specific task execution windows |\n| Comprehensive audit logging | Tamper-evident events compiled into an immutable DAG structure |\n| Resource consumption limits | Rate limiting + backpressure for LLM request loops |\n| Authorization gates for sensitive actions | Human-in-the-loop gate for destructive state changes |\n| Environment isolation | Containerized execution with zero-egress sovereign mode |\n| Software supply chain integrity | Manifest pinning for all loaded tools and dependencies |\n| Network exposure reduction | Air-gappable — zero internet transit in `sovereign`/`ironbank` modes |\n| Post-quantum resilience | PQC-signed DAG trail protecting against harvest-now-decrypt-later |\n\n#### Compliance Certifications\n\n| Framework | Status | Coverage |\n|-----------|--------|----------|\n| CMMC Level 2 | ✅ | Automates evidence collection for AU, CM, SI, SC domains |\n| NIST SP 800-171 Rev 2 | ✅ | Logging, accountability, system integrity |\n| NIST SP 800-53 Rev 5 | ✅ | Continuous monitoring (AU-2, SI-4) |\n| FIPS 203 (ML-KEM) | ✅ | Key encapsulation for secure transit |\n| FIPS 204 (ML-DSA) | ✅ | Digital signatures for payload authentication |\n| NSM-10 PQC Mandate | ✅ | National Security Memorandum 10 compliance |\n| DFARS 252.204-7012 | ✅ | Immutable forensic trails for cyber incident reporting |\n| NSA MCP Security Guidelines | ✅ | Direct mapping to all published AI agent threat mitigations |\n\n#### Live Deployment — Physical Edge\n\nRunning continuously on constrained edge hardware since **May 12, 2026** to prove efficiency in sovereign environments:\n\n- **Hardware**: Raspberry Pi 2 · 1 GB RAM · 900 MHz ARM · Live Spectrum Router\n- **SCADA Pod**: STM32U585 / QRB2210 · Modbus TCP · MQTT · Zephyr RTOS 3.4+ · Live Dilithium Signature Verification\n- **Controls active**: 3 open ports secured · 12 STIG violations detected · 100% file integrity monitoring (AIDE) · 24/7 continuous operation\n\n#### Academic Validation\n\n| Event | Date | Institution |\n|-------|------|-------------|\n| **UAlbany AI Plus Symposium 2026** — *\"KHEPRA Protocol: Quantum-Resilient Agentic AI Security Using Cultural Cryptography\"* | March 7, 2026 | NSA CAE-CDE Institution · 200+ audience |\n| **SUNY Albany Cybersecurity Showcase** — First PQC key ceremony on STM32-class device (SCADA Pod) | May 12–13, 2026 | Live demo · SCADA architecture poster |\n\n> USPTO Provisional Patent **#73565085** — pending.  \n> 🔒 Iron Bank containers in DISA vetting process.\n\n---\n\n## Find Us — MCP Registry Listings\n\nPQC-Khepra-MCP is listed on every major MCP discovery platform:\n\n| Platform | Link | Notes |\n|---|---|---|\n| **Smithery.ai** | [smithery.ai/servers/skone/pqc-khepra-mcp](https://smithery.ai/servers/skone/pqc-khepra-mcp) | One-click install for Claude, Cursor, Windsurf |\n| **MCP Registry (official)** | [registry.modelcontextprotocol.io/?q=khepra](https://registry.modelcontextprotocol.io/?q=khepra) | Anthropic-curated registry — Registry ID: `io.github.nouchix/pqc-khepra-mcp` |\n| **mcpservers.org** | [mcpservers.org/servers/nouchix/pqc-khepra-mcp](https://mcpservers.org/servers/nouchix/pqc-khepra-mcp) | Community discovery index |\n| **Cline Marketplace** | [github.com/cline/mcp-marketplace/issues/1824](https://github.com/cline/mcp-marketplace/issues/1824) | VS Code / Cline extension marketplace |\n| **Live Hosted Endpoint** | [mcp.souhimbou.ai](https://mcp.souhimbou.ai/) | Zero-install SSE endpoint — connect in 30 seconds |\n\n---\n\n## About NouchiX\n\nVeteran-led advisory firm translating CMMC, NIST, and STIG mandates into executive roadmaps.\n\n- **Sales / General**: [contact@nouchix.com](mailto:contact@nouchix.com)\n- **Support**: [support@nouchix.com](mailto:support@nouchix.com)\n- **Website**: [https://nouchix.com](https://nouchix.com)\n- **Phone**: (518) 304-4450\n\nDeveloped by SecRed Knowledge Inc. dba NouchiX, Albany, NY.\n",
  "bytes": 26361,
  "sha": "1a9dc85c92b903bbb028a1e70f7838ea3950236439d6786917535e12b5d7da01",
  "repo_slug": "nouchix/pqc-khepra-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_nouchix_pqc_khepra_mcp_7f3822c2/readme"
}