quantakrypto pqc-tools

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Scan code for quantum-vulnerable cryptography and get NIST post-quantum migration guidance.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "quantakrypto pqc-tools": {
      "url": "https://mcp.quantakrypto.com/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (11)

• apply_triage

  Deterministically attach your triage verdicts to their findings and re-sort by exposure (highest first). Never suppresses. Pass the same 'findings' array you triaged plus a 'verdicts' array of { fingerprint, exposureScore, priority, rationale }.

  Parameters:

  • findings (required) — array — The findings that were triaged.
  • verdicts (required) — array — One verdict per finding, keyed by fingerprint.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• apply_verified_patch

  Deterministically VERIFY a proposed fix before writing it — runs the same patch-policy + verify_fix + blast-radius gates as `qremediate` (offline, no key, no network). Give the finding, the file's current content, and your proposed FULL corrected content; returns approved:true only if the patch is in-policy, clears the finding, adds no new finding, introduces no network/exec sink, and is bounded in size. This does NOT write the file — you write it, only when approved, and never auto-merge.

  Parameters:

  • finding (required) — object — The scan finding being fixed (needs a string ruleId and location.file).
  • originalContent (required) — string — The file's current full content.
  • newContent (required) — string — Your proposed full corrected file content.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• check_dependency

  Check whether a package is in quantakrypto's known quantum-vulnerable dependency database (the classical crypto it exposes). Provide 'name' and optional 'ecosystem' (default npm).

  Parameters:

  • name (required) — string — Package name to look up (e.g. 'node-forge', 'jsonwebtoken').
  • ecosystem — string — Package ecosystem. Default: npm.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• explain_finding

  Explain a quantakrypto finding and its post-quantum remediation. Provide a ruleId (e.g. 'forge-rsa-keygen', 'elliptic-ec', 'node-rsa', 'pem-ec-private-key') and/or an algorithm (e.g. 'RSA', 'ECDSA'). The ruleId is resolved against the core detector set, so library and config rules explain correctly.

  Parameters:

  • ruleId — string — The finding's rule id, matching a detector id prefix.
  • algorithm — string — The classical algorithm family involved (e.g. RSA, ECDH, ECDSA).

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_fix_examples

  Return before/after code examples for migrating a classical algorithm to a post-quantum / hybrid replacement. Provide an 'algorithm' (RSA, ECDH, ECDSA, …) or a 'ruleId' from a finding.

  Parameters:

  • ruleId — string — A finding's ruleId (resolved to its algorithm).
  • algorithm — string — Classical algorithm family to migrate away from.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_rules

  List the quantakrypto detector catalog: every detector id and what it looks for.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• remediate_findings

  Produce a deterministic remediation REQUEST bundle (rubric + fix schema + per-finding metadata + fingerprints) for YOU (the host agent) to fix. This tool calls no model and needs no key. For each finding, propose the corrected FULL file content, then VERIFY with verify_fix and keep only fixes that clear the finding. Never touch files with secrets; never auto-merge. Pass 'findings' from scan_path --format json.

  Parameters:

  • findings (required) — array — Findings from a scan's JSON output.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• score_delta

  Compute the readiness-score and HNDL change between two finding sets (e.g. before and after a migration). Pass 'before' and 'after' as arrays of findings from scan_path --format json.

  Parameters:

  • before (required) — array — Findings before the change (from a scan's JSON findings).
  • after (required) — array — Findings after the change.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• suggest_hybrid

  Recommend a post-quantum / hybrid migration. Provide an 'algorithm' (e.g. RSA, ECDH, ECDSA) or free-text 'context' describing the usage. Set 'tier' to 'category-5' for CNSA 2.0 / national-security systems.

  Parameters:

  • tier — string — Security tier: 'category-3' (default, commercial — ML-KEM-768 / ML-DSA-65) or 'category-5' (CNSA 2.0 / NSS, long-lived secrets — ML-KEM-1024 / ML-DSA-87).
  • context — string — Free-text description of the cryptographic usage (used when no algorithm is given).
  • algorithm — string — Classical algorithm family to migrate away from.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• triage_findings

  Produce a deterministic triage REQUEST bundle (rubric + verdict schema + per-finding metadata) for YOU (the host agent) to reason over. This tool does NOT call any model and needs no API key. Assess each finding's real-world exposure, then call apply_triage with your verdicts. Pass 'findings' as an array from scan_path --format json.

  Parameters:

  • findings (required) — array — Findings from a scan's JSON output.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• verify_fix

  Run the quantakrypto detectors over a code snippet (NOT the filesystem) and report any classical crypto that remains. Use this to confirm an edit actually removed the quantum-vulnerable usage. Provide 'code' plus a 'language' or 'filename'.

  Parameters:

  • code (required) — string — The source code to check.
  • filename — string — Optional filename; its extension selects the detectors (overrides 'language').
  • language — string — Language of the code (js, ts, python, go, java, csharp, rust, ruby, c, …).

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.