quantakrypto/pqc-tools

Open-source post-quantum readiness tooling by quantakrypto.
Find quantum-vulnerable cryptography in any codebase, wire post-quantum readiness
into your editor and your CI, and conformance-test post-quantum implementations —
with **zero runtime dependencies** (Node built-ins only).
> **Design goals:** simple, clean, reusable code; **zero runtime dependencies**;
> everything documented, tested, and example-driven.
What's inside
| Tool | What it does | Get it |
|---|---|---|
| **qScan** (@quantakrypto/qscan) | CLI that finds quantum-vulnerable crypto (RSA, (EC)DH, ECDSA, EdDSA, …) across **14 languages** (JS/TS, Python, Go, Java/Kotlin/Scala, C#, Rust, Ruby, PHP, Elixir, C/C++, Swift, Objective-C, Dart, Solidity/Move/Cairo) and prints a readiness score. SARIF / JSON / CBOM / evidence (ISO 27001 A.8.24) / OpenVEX output, baselines, incremental & parallel scans. Compliance mandate gate: --mandate cnsa-2.0 / nist-ir-8547 reports each prohibited finding with its dated clause and fails the build on the mandate's deadlines (--lead-months, --fail-now). Opt-in --triage (BYOK LLM re-rank/explain) and a qremediate codemod CLI. | npx @quantakrypto/qscan ./ |
| **MCP** (@quantakrypto/mcp) | Model Context Protocol server that gives AI coding agents post-quantum readiness tools (16 tools — scan, inventory, explain, suggest-hybrid, CBOM, plan-migration, triage, remediate, probe-endpoint, …). Local stdio + hostable HTTP. | claude mcp add quantakrypto npx @quantakrypto/mcp |
| **Sieve** (@quantakrypto/sieve) | Conformance battery for ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) implementations, driven over a JSON stdin/stdout protocol. | npx @quantakrypto/sieve --help |
| **Action** (@quantakrypto/action) | GitHub Action that runs the qScan/Sieve/qProbe checks in CI, writes SARIF for code-scanning upload, annotates the diff, and fails the build only on **new** quantum-vulnerable crypto. | uses: quantakrypto/pqc-tools/packages/action@v1 |
| **agent** (@quantakrypto/agent) | Optional, zero-dependency BYOK (bring-your-own-key) LLM client (native fetch; Anthropic + OpenAI-compatible adapters) that powers qScan --triage and qremediate --llm. Networked, key-holding — kept isolated (see also qProbe). | npm i @quantakrypto/agent |
| **qProbe** (@quantakrypto/qprobe) | Actively probes **live TLS/SSH endpoints you own** for post-quantum readiness — PQC-hybrid key exchange (X25519MLKEM768) and classical certificate posture. Gated behind an ownership attestation; reports, never modifies ("engine disposes"). See THREAT-MODEL. | npx @quantakrypto/qprobe --i-own-this host |
All of qScan, MCP, the Action, agent, and qProbe share the engine in
**@quantakrypto/core** (npm i @quantakrypto/core) — detectors,
the vulnerable-dependency DB, the readiness score, SARIF/JSON/CBOM/evidence/OpenVEX
reporting, and the
offline agent-plane primitives (context redactor, verify_fix gate, codemods, patch
policy). Sieve is standalone: it tests *other* implementations and implements no
crypto itself.
**Infrastructure coverage.** Beyond application source, the shared core engine
carries **config-scope detectors** for Terraform/OpenTofu IaC and cloud KMS, JSON