pqc-tools is an open-source post-quantum readiness toolchain provided by quantakrypto, designed to help developers discover quantum-vulnerable cryptography in codebases and integrate post-quantum readiness capabilities into editors and CI workflows, while also performing consistency testing on post-quantum implementations. The entire toolchain has zero runtime dependencies, uses only Node built-in modules, and requires Node ≥ 20.
In terms of purpose, pqc-tools mainly addresses the "harvest now, decrypt later" risk: data and keys captured today can be decrypted once a cryptographically relevant quantum computer (CRQC) appears. Therefore, quantum-vulnerable algorithms such as RSA, ECDH, ECDSA, and DH need to be identified and migrated in advance.
Main capabilities include: qScan scans codebases for quantum-vulnerable cryptography; MCP connects post-quantum readiness capabilities to editors; Action provides CI gating; agent provides offline agent primitives; qProbe adds a real-time endpoint dimension; Sieve independently tests other post-quantum implementations and does not itself implement cryptography. All components share the @quantakrypto/core engine, which includes detectors, a vulnerable dependency database, readiness scoring, SARIF/JSON/CBOM/evidence/OpenVEX reporting, and offline agent primitives (context redaction, verify_fix gating, codemods, patch policies).
In terms of infrastructure coverage, in addition to application source code, the core engine also carries configuration-scope detectors covering Terraform/OpenTofu IaC and cloud KMS, JSON Web Keys, Kubernetes/cert-manager/Istio, CI/CD artifacts and code signing (cosign/GPG/jarsigner/codesign/minisign), static secrets (SOPS/age, PGP, Sealed Secrets), message brokers (Kafka/MQTT), databases (pgcrypto, libpq sslmode), and JOSE/JWE key management. Therefore qscan, Action, and MCP can flag infrastructure cryptography issues without additional installation.
In terms of usage, a CI gate can be added by placing packages/action/examples/quantum-readiness.yml into .github/workflows/, orwire it up directly. Each package README provides a complete options reference and more examples. The toolchain is used in combination with PQC libraries such as liboqs/OQS: quantakrypto is responsible for discovery and gating of classical cryptography (qscan, Action), informing migration targets and order (qscan --tier, MCP plan_migration, qremediate), and performing consistency testing on replacement implementations (sieve runs any ML-KEM/ML-DSA/SLH-DSA implementation against FIPS 203/204/205, performing exact-value KATs when official NIST ACVP vectors are available). liboqs provides the primitives. For an end-to-end walkthrough, see examples/liboqs-migration/.
Applicable scenarios include: codebases that need to assess post-quantum readiness status, teams that need to incorporate post-quantum checks into CI, developers who need to test the consistency of post-quantum implementations, and organizations that need to cover cryptography issues in infrastructure configuration.
In terms of limitations, quantakrypto by design does not implement post-quantum cryptography and serves only as a scanner, CI gate, and consistency testing framework. The toolchain requires Node ≥ 20, with development dependencies limited to TypeScript + tsx and no runtime dependencies. Documentation is located in docs/, covering goals and scope, architecture decisions, standards and compliance (NIST FIPS 203/204/205, SP 800-208, CNSA 2.0, SARIF, CWE, ISO/IEC 27001 (A.8.24), Common Criteria, FIPS 140-3, EU DORA/NIS2, US M-23-02/NSM-10, SLSA, OpenSSF Scorecard, SPDX/REUSE). The license is Apache-2.0. The methodology is open, and assessments, certification reports, and deliverables fall within the scope of quantakrypto practice. Support and training can be reached via quantakrypto.com or hello@quantakrypto.com.
