Quantum Readiness Scan

What the Quantum Readiness Scan MCP server does

The Quantum Readiness Scan MCP server examines a local repository for cryptographic algorithms and related configuration. It recognizes quantum-vulnerable public-key families including secp256k1, Ed25519, BLS, Schnorr, RSA, DSA, DH, and ECDSA. It also identifies weak primitives such as MD5, SHA-1, RC4, and DES/3DES.

The scan covers source files across languages including Solidity, Rust, Move, Cairo, Python, Go, Java, JavaScript/TypeScript, Ruby, PHP, C/C++, C#, PowerShell, Perl, and shell. It also reads CI/CD files, infrastructure-as-code, dependency manifests, protocol settings, cipher suites, and signing commands. Findings retain context such as file and line location, detection basis, and observed key sizes.

How it works

All processing takes place on the local machine. The server makes no outbound network requests and requires no account or API key. Its only started process is a local Git command used to identify what was read; repository hooks and filters are disabled for that operation.

The scanner distinguishes an observed cryptographic operation from weaker evidence such as a configured protocol or declared dependency. It does not treat a library declaration as proof that code calls an algorithm, and it does not infer quantum vulnerability from a protocol version alone. Coverage information records what the scan inspected and what it could not establish, allowing the result to be reviewed with those limits intact.

Use the Quantum Readiness Scan MCP server when you need an inventory of signing and cryptographic paths in a repository, especially for blockchain code, wallet software, or long-lived validator keys.

Setup and configuration

The README provides a standard MCP configuration that runs the server through uvx:

{
  "mcpServers": {
    "qrp": {
      "command": "uvx",
      "args": ["qrp-mcp"]
    }
  }
}

uv must be available on PATH; uvx fetches and runs the package. Claude Code can use the packaged plugin instead, installed through the documented marketplace and plugin commands, followed by /qrp:pqc-scan in a project.

The server can also run without an agent. uvx qrp-mcp scan <path> --out result.json writes scan output, while cbom writes a CycloneDX 1.6 CBOM and closure compares two saved scans. Masked and trimmed output levels reduce quoted source detail while retaining file and line references. Each written file has its SHA-256 printed.

Tools and capabilities

• scan_repo(path) scans repository content and returns findings, a summary, and coverage data.
• export_cbom(path) produces the same inventory as a CycloneDX 1.6 CBOM.
• compare_coverage(a, b) checks whether two scans are comparable.
• prove_closure(before, after) identifies findings closed by a change when the scans qualify for comparison.
• list_algorithms() lists recognized algorithm families and their classifications.

The output includes smallest and all observed key sizes per algorithm family, enabling separate checks for weak sizes and every size encountered. Protocols, dependencies, and cipher-suite components are reported in separate categories rather than being presented as observed algorithm calls.

Limitations and notes

The scanner reports textual and structural evidence; a named algorithm without an operation may not count as a finding. A dependency declaration does not prove use, and a protocol version does not by itself establish quantum vulnerability. Closure analysis requires two saved scans of the same tree that are comparable. The README also describes coverage measurements as disagreement counts from model-labelled repositories, not recall or ground truth.