{
  "markdown": "# quantakrypto-tools\n\n[![CI](https://github.com/quantakrypto/pqc-tools/actions/workflows/ci.yml/badge.svg)](https://github.com/quantakrypto/pqc-tools/actions/workflows/ci.yml)\n[![License: Apache-2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)\n[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/13769/badge)](https://www.bestpractices.dev/projects/13769)\n[![npm @quantakrypto/core](https://img.shields.io/npm/v/@quantakrypto/core?label=%40quantakrypto%2Fcore)](https://www.npmjs.com/package/@quantakrypto/core)\n[![npm @quantakrypto/qscan](https://img.shields.io/npm/v/@quantakrypto/qscan?label=%40quantakrypto%2Fqscan)](https://www.npmjs.com/package/@quantakrypto/qscan)\n[![npm @quantakrypto/mcp](https://img.shields.io/npm/v/@quantakrypto/mcp?label=%40quantakrypto%2Fmcp)](https://www.npmjs.com/package/@quantakrypto/mcp)\n[![npm @quantakrypto/sieve](https://img.shields.io/npm/v/@quantakrypto/sieve?label=%40quantakrypto%2Fsieve)](https://www.npmjs.com/package/@quantakrypto/sieve)\n[![npm @quantakrypto/agent](https://img.shields.io/npm/v/@quantakrypto/agent?label=%40quantakrypto%2Fagent)](https://www.npmjs.com/package/@quantakrypto/agent)\n[![npm @quantakrypto/qprobe](https://img.shields.io/npm/v/@quantakrypto/qprobe?label=%40quantakrypto%2Fqprobe)](https://www.npmjs.com/package/@quantakrypto/qprobe)\n![Node ≥20](https://img.shields.io/badge/node-%E2%89%A520-brightgreen)\n![TypeScript strict](https://img.shields.io/badge/TypeScript-strict-3178c6)\n![Runtime deps: 0](https://img.shields.io/badge/runtime%20deps-0-success)\n[![PQC targets: FIPS 203/204/205](https://img.shields.io/badge/PQC%20targets-FIPS%20203%2F204%2F205-7c3aed)](docs/COMPLIANCE.md)\n\nOpen-source post-quantum readiness tooling by [quantakrypto](https://quantakrypto.com).\nFind quantum-vulnerable cryptography in any codebase, wire post-quantum readiness\ninto your editor and your CI, and conformance-test post-quantum implementations —\nwith **zero runtime dependencies** (Node built-ins only).\n\n> **Design goals:** simple, clean, reusable code; **zero runtime dependencies**;\n> everything documented, tested, and example-driven.\n\n## What's inside\n\n| Tool | What it does | Get it |\n|---|---|---|\n| **[qScan](packages/qscan)** (`@quantakrypto/qscan`) | CLI that finds quantum-vulnerable crypto (RSA, (EC)DH, ECDSA, EdDSA, …) across **14 languages** (JS/TS, Python, Go, Java/Kotlin/Scala, C#, Rust, Ruby, PHP, Elixir, C/C++, Swift, Objective-C, Dart, Solidity/Move/Cairo) and prints a readiness score. SARIF / JSON / CBOM / evidence (ISO 27001 A.8.24) / OpenVEX output, baselines, incremental & parallel scans. Compliance mandate gate: `--mandate cnsa-2.0` / `nist-ir-8547` reports each prohibited finding with its dated clause and fails the build on the mandate's deadlines (`--lead-months`, `--fail-now`). Opt-in `--triage` (BYOK LLM re-rank/explain) and a `qremediate` codemod CLI. | `npx @quantakrypto/qscan ./` |\n| **[MCP](packages/mcp)** (`@quantakrypto/mcp`) | Model Context Protocol server that gives AI coding agents post-quantum readiness tools (16 tools — scan, inventory, explain, suggest-hybrid, CBOM, plan-migration, triage, remediate, probe-endpoint, …). Local stdio + hostable HTTP. | `claude mcp add quantakrypto npx @quantakrypto/mcp` |\n| **[Sieve](packages/sieve)** (`@quantakrypto/sieve`) | Conformance battery for ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) implementations, driven over a JSON stdin/stdout protocol. | `npx @quantakrypto/sieve --help` |\n| **[Action](packages/action)** (`@quantakrypto/action`) | GitHub Action that runs the qScan/Sieve/qProbe checks in CI, writes SARIF for code-scanning upload, annotates the diff, and fails the build only on **new** quantum-vulnerable crypto. | `uses: quantakrypto/pqc-tools/packages/action@v1` |\n| **[agent](packages/agent)** (`@quantakrypto/agent`) | Optional, zero-dependency BYOK (bring-your-own-key) LLM client (native `fetch`; Anthropic + OpenAI-compatible adapters) that powers qScan `--triage` and `qremediate --llm`. Networked, key-holding — kept isolated (see also qProbe). | `npm i @quantakrypto/agent` |\n| **[qProbe](packages/qprobe)** (`@quantakrypto/qprobe`) | Actively probes **live TLS/SSH endpoints you own** for post-quantum readiness — PQC-hybrid key exchange (X25519MLKEM768) and classical certificate posture. Gated behind an ownership attestation; reports, never modifies (\"engine disposes\"). See [THREAT-MODEL](packages/qprobe/THREAT-MODEL.md). | `npx @quantakrypto/qprobe --i-own-this host` |\n\nAll of qScan, MCP, the Action, agent, and qProbe share the engine in\n**[`@quantakrypto/core`](packages/core)** (`npm i @quantakrypto/core`) — detectors,\nthe vulnerable-dependency DB, the readiness score, SARIF/JSON/CBOM/evidence/OpenVEX\nreporting, and the\noffline agent-plane primitives (context redactor, `verify_fix` gate, codemods, patch\npolicy). Sieve is standalone: it tests *other* implementations and implements no\ncrypto itself.\n\n**Infrastructure coverage.** Beyond application source, the shared `core` engine\ncarries **config-scope detectors** for Terraform/OpenTofu IaC and cloud KMS, JSON\nWeb Keys, Kubernetes / cert-manager / Istio, CI/CD artifact & code signing\n(cosign/GPG/jarsigner/codesign/minisign), secrets at rest (SOPS/age, PGP, Sealed\nSecrets), message brokers (Kafka/MQTT), databases (pgcrypto, libpq `sslmode`), and\nJOSE/JWE key management — so `qscan`, the Action, and MCP flag **infrastructure**\ncrypto with no extra install. **qProbe** adds the live-endpoint dimension (see the\ntable above). The narrative anchor for infrastructure is *harvest now, decrypt\nlater*: data and secrets captured today are decryptable once a CRQC exists.\n\n## Quick start\n\n```bash\n# 1. Scan a codebase for quantum-vulnerable cryptography.\nnpx @quantakrypto/qscan ./\n\n# 2. Give your AI coding agent post-quantum readiness tools.\nclaude mcp add quantakrypto npx @quantakrypto/mcp\n\n# 3. Conformance-test a post-quantum implementation (adapter speaks the JSON protocol).\nnpx @quantakrypto/sieve --impl \"node ./my-impl.js\" --param ml-kem-768\n\n# 4. Gate against a compliance mandate's dated deadlines (CNSA 2.0 / NIST IR 8547).\n#    Verdicts also ride in --format json/sarif/evidence; --policy lets an org\n#    acknowledge families it is knowingly migrating (exempt from early gating).\nnpx @quantakrypto/qscan ./ --mandate cnsa-2.0 [--policy .quantakrypto/crypto-policy.json]\n```\n\nAdd the CI gate by dropping\n[`packages/action/examples/quantum-readiness.yml`](packages/action/examples/quantum-readiness.yml)\ninto `.github/workflows/`, or wire it up directly:\n\n```yaml\n- uses: quantakrypto/pqc-tools/packages/action@v1\n  with:\n    path: \".\"\n    severity-threshold: \"high\"\n```\n\nEach package README has the full options reference and more examples:\n[qScan](packages/qscan/README.md) ·\n[MCP](packages/mcp/README.md) ·\n[Sieve](packages/sieve/README.md) ·\n[Action](packages/action/README.md) ·\n[core](packages/core/README.md) ·\n[agent](packages/agent/README.md).\n\n## Using quantakrypto alongside a PQC library (liboqs / OQS)\n\nquantakrypto **does not implement post-quantum cryptography, by design** — it is\nthe scanner, the CI gate, and the conformance harness you wrap around a real PQC\nlibrary like [liboqs / Open Quantum Safe](https://openquantumsafe.org/). They\ncompose: quantakrypto **finds and gates** classical crypto (`qscan`, the Action),\ntells you **what to migrate to and in what order** (`qscan --tier`, MCP\n`plan_migration`, `qremediate`), and **conformance-tests the replacement**\n(`sieve` runs any ML-KEM/ML-DSA/SLH-DSA implementation against FIPS 203/204/205,\nwith exact-value KATs when you supply official NIST ACVP vectors). liboqs\nsupplies the primitives.\n\nSee the worked end-to-end walkthrough — scan → migrate → verify → gate — in\n**[`examples/liboqs-migration/`](examples/liboqs-migration/README.md)**.\n\n## Workspace layout\n\n```\nquantakrypto-tools/\n├── packages/\n│   ├── core/     @quantakrypto/core    — shared engine (the contract lives in src/types.ts + src/index.ts)\n│   ├── qscan/    @quantakrypto/qscan   — CLI\n│   ├── mcp/      @quantakrypto/mcp     — MCP server (stdio now, HTTP scaffold for hosting)\n│   ├── action/   @quantakrypto/action — GitHub Action\n│   ├── sieve/    @quantakrypto/sieve   — conformance battery + JSON protocol\n│   ├── agent/    @quantakrypto/agent   — opt-in BYOK LLM client (triage + remediation)\n│   └── qprobe/   @quantakrypto/qprobe  — active TLS/SSH endpoint probing (gated; the only prober)\n├── docs/         architecture, hosted-MCP design, improvement roadmap\n└── examples/     end-to-end examples\n```\n\n## Development\n\nRequires Node ≥ 20.\n\n```bash\nnpm install        # links the workspaces\nnpm run build      # tsc --build (project references)\nnpm test           # node:test across all packages\n```\n\nThe toolchain is intentionally tiny: TypeScript + `tsx` (to run `node:test` on\n`.ts`) are the only dev dependencies; there are **no runtime dependencies**.\n\n## Documentation & compliance\n\nFull documentation lives in **[`docs/`](docs/README.md)**:\n\n- **[Objectives & scope](docs/OBJECTIVES.md)** — what the toolchain is for, what\n  each library does, the load-bearing decisions, and the deliberate scope\n  boundaries. Start here.\n- **[Architecture decisions](docs/adr/README.md)** — the immutable \"why\" behind\n  each load-bearing choice (zero deps, shared core contract, two-plane agent, …).\n- **[Standards & compliance](docs/COMPLIANCE.md)** — what the tools touch and\n  could align to: NIST FIPS 203/204/205, SP 800-208, CNSA 2.0, SARIF, CWE,\n  ISO/IEC 27001 (A.8.24), Common Criteria, FIPS 140-3, EU DORA/NIS2, US\n  M-23-02 / NSM-10, and OSS assurance (SLSA, OpenSSF Scorecard, SPDX/REUSE).\n- **Governance:** [Contributing](CONTRIBUTING.md) · [Security](SECURITY.md) ·\n  [Code of Conduct](CODE_OF_CONDUCT.md) · [Changelog](CHANGELOG.md).\n\n## License\n\n[Apache-2.0](LICENSE). The methodology is open; the assessments, attestation\nreports, and deliverables are where the [quantakrypto](https://quantakrypto.com)\npractice lives.\n\n## Support & training\n\nQuestions, commercial support, or post-quantum readiness training for your team —\nvisit **[quantakrypto.com](https://quantakrypto.com)** or email\n**[hello@quantakrypto.com](mailto:hello@quantakrypto.com)**.\n",
  "bytes": 10231,
  "sha": "359ac364465162a3793dacdded27b34e988b26910114678eaf8bfbf6ed8ce099",
  "repo_slug": "quantakrypto/pqc-tools",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_quantakrypto_pqc_tools_b722b0ac/readme"
}