quantakrypto
Loading…
Loading…
qScan now reads the platform around your code — CI/CD signing, secrets at rest, Kubernetes PKI, message brokers, databases, IaC, and token encryption. Same CLI, same GitHub Action, same MCP server. No new install.
A source-code fix moves you forward from today. It does nothing for the encrypted secret already sitting in your git history, or the broker traffic an adversary recorded last quarter. Harvest-now-decrypt-later means the ciphertext is captured today and opened the day a cryptographically-relevant quantum computer exists — so the backup you took in 2019 is a breach waiting on a date. qScan ranks these retroactive, un-fixable surfaces first, because they are the ones a code review will never catch.
Every place your platform pins itself to pre-quantum cryptography, in one scan — grouped by how it fails: harvest-now-decrypt-later first (un-fixable in hindsight), then forgeable at Q-day, then weak configuration.
18
infrastructure surfaces
14
source languages
5
report formats
Apache-2.0
open source
GitOps secrets
Ciphertext committed to git is un-fixable in hindsight. Rotate the key all you like — the encrypted blob already in your history was captured the moment it was pushed, and it decrypts the day a quantum computer arrives.
Detects
Event streaming
Broker traffic is long-lived and trivial to tap. A classical ECDHE handshake protecting a Kafka or MQTT stream is a harvestable session key — recorded now, opened later.
Detects
Data layer
Public-key encryption inside the database, and weak transport to reach it, are both quantum-exposed — and the rows they protect carry the longest confidentiality lifetime you own.
Detects
Edge / service TLS
The proxy that terminates TLS at your edge, and the gRPC channels between your services, negotiate the session keys everything else rides on. A classical-only ECDHE handshake there is a harvestable key — recorded now, opened later — and it sits in front of the mesh, where the Kubernetes detectors never see it.
Detects
Token encryption
Encrypted tokens pin their security to the key-management algorithm in the header. A captured JWE — or a JWK with a classical curve — is decryptable later if that algorithm is classical.
Detects
Runtime key minting
The keys your application code mints in AWS, GCP, or Azure KMS decide the crypto posture of everything they wrap. RSA key-encryption and EC key-agreement specs are quantum-exposed — the application-code counterpart to the IaC detectors.
Detects
Secrets engines
Vault's transit engine wraps real production data with the key algorithm you configure. An RSA transit key, or a classical PKI role, is a quantum-exposed root for everything it protects.
Detects
Binary key material
A keystore committed to a repo is un-fixable in hindsight: the private keys inside were captured the moment it was pushed, and they decrypt or forge the day a quantum computer exists.
Detects
Hardware roots
HSMs hold your longest-lived roots — CA keys, code-signing keys — exactly the keys a post-quantum migration has to find first. Classical mechanisms on a PKCS#11 token are the hardest to rotate and the most exposed.
Detects
Network transport
Recorded tunnel traffic is decryptable the day a quantum computer arrives. WireGuard's Curve25519 handshake has no standard PQC option, and IPsec's finite-field and elliptic-curve DH groups are equally exposed — a captured session opens later.
Detects
Enterprise SSO
Encrypted SAML assertions pin their confidentiality to RSA key transport — captured now, opened later — and a forged XML-DSig signature is a spoofed SSO assertion. Enterprise identity rides on both.
Detects
Supply chain
A signature is only as future-proof as its algorithm. Every classical signature you ship today becomes forgeable the day a quantum computer exists — and a forged release signature is a supply-chain compromise. The same detectors flag SHA-1 (which NIST retires on the same 2030 window) and MD5 (already broken and disallowed today) in signing or certificate contexts.
Detects
Access PKI
An SSH CA signs the host and user certificates that grant access across your fleet. If the CA key is classical, every certificate it issues is forgeable the day a quantum computer exists — and a forged SSH certificate is unauthenticated access to anything that trusts the CA.
Detects
Workload identity
SPIRE issues the X.509-SVID identities workloads use to authenticate to each other. The key algorithm on the authority and the SVIDs sets the floor for the entire identity plane — classical keys leave every workload identity quantum-exposed.
Detects
DNS trust chain
A forged DNSKEY/RRSIG chain lets an attacker spoof DNSSEC-validated records the day classical signatures fall. The signing algorithms in your zone policy decide whether that day is reachable.
Detects
Kubernetes
cert-manager mints the certificates that hold your mesh together. If the issuer's key algorithm is classical, so is every leaf it signs — and the mesh negotiates down to match.
Detects
Infrastructure as code
The keys your infrastructure code generates, and the KMS aliases it wires up, decide the crypto posture of everything downstream — provisioned before a single workload runs.
Detects
Infrastructure as code
Terraform isn't the only place infrastructure provisions keys. CloudFormation, Bicep, Pulumi, and Ansible generate the TLS keys and KMS aliases that set the crypto floor for everything downstream — before a workload runs.
Detects
One zero-dependency repo · Apache-2.0 · npm @quantakrypto/*
The infrastructure detectors ship inside the same qscan CLI, GitHub Action, and MCP server. Nothing new to add to your toolchain — point it at a repository and it reads code and infrastructure together. Findings export as JSON, SARIF, a CycloneDX CBOM, an ISO 27001 A.8.24 evidence report, or OpenVEX.
Scan a repository
$ npx @quantakrypto/qscan ./Gate every pull request
$ uses: quantakrypto/pqc-tools/packages/action@v1Inside your AI coding agent
$ claude mcp add quantakrypto npx @quantakrypto/mcpqprobe — active probe
Static scanners read configuration. qprobe reads reality — a separate, opt-in package that handshakes the TLS and SSH endpoints you own and reports whether they negotiate a post-quantum hybrid key exchange.
Opt-in install
$ npx @quantakrypto/qprobe --i-own-this example.comDetects
Ownership-gated · read-only
qprobe is a separate, opt-in install — never bundled with qscan. It runs only against endpoints you explicitly attest you own, sends nothing beyond a key-exchange handshake, and never modifies a target. No attestation, no probe.
Eighteen surfaces around your code, including CI/CD and code signing, secrets at rest, Kubernetes PKI, message brokers, databases, infrastructure-as-code, VPNs, DNSSEC, and HSMs.
No. It is the same qScan CLI, the same GitHub Action, and the same MCP server you already use for source code. No new install.
Because of harvest now, decrypt later. Encrypted backups and traffic captured today can be opened once a large quantum computer arrives. Your 2019 backups are the breach of 2033.
By three risk archetypes: harvest now, decrypt later; forgeable at Q-day; and weak key or legacy TLS floor. That tells you what to move first.
It checks live endpoints for hybrid key exchange, TLS X25519MLKEM768 and SSH mlkem768x25519 or sntrup761x25519, and flags classical-only endpoints and silent downgrades. It is ownership-gated and read-only.
Reports in JSON, SARIF, CycloneDX CBOM, ISO 27001 A.8.24 evidence, and OpenVEX.
Run the scan across your platform, then book a discovery call for a senior read on what to migrate first.