This server provides a comprehensive suite of tools for assessing, planning, and managing post-quantum cryptography (PQC) readiness in codebases and live systems.
Scan & Inventory
scan_path — Scan a file/directory for classical (quantum-vulnerable) asymmetric cryptography; returns a summary or raw JSON findings.
inventory_crypto — Produce a 0–100 post-quantum readiness score with finding counts broken down by algorithm, category, and severity.
generate_cbom — Emit a CycloneDX 1.6 Cryptographic Bill of Materials (CBOM) of all classical cryptographic assets, for compliance and supply-chain tooling.
check_dependency — Check if a package is in the known quantum-vulnerable dependency database.
Migration Planning & Recommendations
plan_migration — Generate a prioritized migration plan ordered by harvest-now-decrypt-later (HNDL) risk, with PQC targets and readiness-score impact per finding.
suggest_hybrid — Recommend a post-quantum/hybrid migration strategy for a given classical algorithm (supports CNSA 2.0 / national-security tier).
get_fix_examples — Retrieve before/after code examples for migrating away from a classical algorithm.
explain_finding — Get a detailed explanation of a finding (by ruleId or algorithm) and its post-quantum remediation guidance.
list_rules — Browse the full detector catalog listing every detector ID and description.
Remediation & Verification
remediate_findings — Produce a deterministic remediation request bundle (rubric, fix schema, per-finding metadata) for the host agent to execute fixes.
apply_verified_patch — Verify a proposed fix through patch-policy, verify_fix, and blast-radius gates before writing; returns approved: true only if safe and effective.
verify_fix — Run detectors over a code snippet to confirm quantum-vulnerable crypto has been removed.
Triage & Scoring
triage_findings — Produce a deterministic triage request bundle for the host agent to assess each finding's real-world exposure.
apply_triage — Attach triage verdicts to findings and re-sort by exposure score (highest first); never suppresses findings.
score_delta — Compute the readiness-score and HNDL change between two sets of findings (e.g., before and after a migration).
Live Endpoint Probing
probe_endpoint — Probe a live TLS/SSH endpoint you own for PQC-hybrid key exchange and classical certificate posture. Requires ownership attestation (i_own_this: true); performs only a benign unauthenticated handshake.
Scans C/C++ codebases for quantum-vulnerable asymmetric cryptography, returning findings and a readiness score.
Scans Dart code for quantum-vulnerable asymmetric cryptography, returning findings and a readiness score.
Scans Elixir codebases for quantum-vulnerable asymmetric cryptography, returning findings and a readiness score.
Scans Istio configuration files for quantum-vulnerable cryptography as part of infrastructure coverage.
Scans Kotlin code for quantum-vulnerable asymmetric cryptography, returning findings and a readiness score.
Scans Kubernetes configuration files for quantum-vulnerable cryptography as part of infrastructure coverage.
Scans MQTT message broker configuration for quantum-vulnerable cryptography as part of infrastructure coverage.
Scans OpenTofu infrastructure-as-code configurations for quantum-vulnerable cryptography as part of infrastructure coverage.
Scans PHP code for quantum-vulnerable asymmetric cryptography, returning findings and a readiness score.
Scans Python code for quantum-vulnerable asymmetric cryptography, returning findings and a readiness score.
Scans Ruby code for quantum-vulnerable asymmetric cryptography, returning findings and a readiness score.
Scans Rust code for quantum-vulnerable asymmetric cryptography, returning findings and a readiness score.
Scans Scala code for quantum-vulnerable asymmetric cryptography, returning findings and a readiness score.
Scans Solidity code for quantum-vulnerable asymmetric cryptography, returning findings and a readiness score.
Scans Swift code for quantum-vulnerable asymmetric cryptography, returning findings and a readiness score.
Scans Terraform infrastructure-as-code configurations for quantum-vulnerable cryptography as part of infrastructure coverage.
Scans TypeScript code for quantum-vulnerable asymmetric cryptography, returning findings and a readiness score.
Open-source post-quantum readiness tooling by quantakrypto. Find quantum-vulnerable cryptography in any codebase, wire post-quantum readiness into your editor and your CI, and conformance-test post-quantum implementations — with zero runtime dependencies (Node built-ins only).
Design goals: simple, clean, reusable code; zero runtime dependencies; everything documented, tested, and example-driven.
Tool | What it does | Get it |
qScan ( | CLI that finds quantum-vulnerable crypto (RSA, (EC)DH, ECDSA, EdDSA, …) across 14 languages (JS/TS, Python, Go, Java/Kotlin/Scala, C#, Rust, Ruby, PHP, Elixir, C/C++, Swift, Objective-C, Dart, Solidity/Move/Cairo) and prints a readiness score. SARIF / JSON / CBOM / evidence (ISO 27001 A.8.24) / OpenVEX output, baselines, incremental & parallel scans. Compliance mandate gate: |
|
MCP ( | Model Context Protocol server that gives AI coding agents post-quantum readiness tools (16 tools — scan, inventory, explain, suggest-hybrid, CBOM, plan-migration, triage, remediate, probe-endpoint, …). Local stdio + hostable HTTP. |
|
Sieve ( | Conformance battery for ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) implementations, driven over a JSON stdin/stdout protocol. |
|
Action ( | GitHub Action that runs the qScan/Sieve/qProbe checks in CI, writes SARIF for code-scanning upload, annotates the diff, and fails the build only on new quantum-vulnerable crypto. |
|
agent ( | Optional, zero-dependency BYOK (bring-your-own-key) LLM client (native |
|
qProbe ( | Actively probes live TLS/SSH endpoints you own for post-quantum readiness — PQC-hybrid key exchange (X25519MLKEM768) and classical certificate posture. Gated behind an ownership attestation; reports, never modifies ("engine disposes"). See THREAT-MODEL. |
|
All of qScan, MCP, the Action, agent, and qProbe share the engine in
@quantakrypto/core (npm i @quantakrypto/core) — detectors,
the vulnerable-dependency DB, the readiness score, SARIF/JSON/CBOM/evidence/OpenVEX
reporting, and the
offline agent-plane primitives (context redactor, verify_fix gate, codemods, patch
policy). Sieve is standalone: it tests other implementations and implements no
crypto itself.
Infrastructure coverage. Beyond application source, the shared core engine
carries config-scope detectors for Terraform/OpenTofu IaC and cloud KMS, JSON
Web Keys, Kubernetes / cert-manager / Istio, CI/CD artifact & code signing
(cosign/GPG/jarsigner/codesign/minisign), secrets at rest (SOPS/age, PGP, Sealed
Secrets), message brokers (Kafka/MQTT), databases (pgcrypto, libpq sslmode), and
JOSE/JWE key management — so qscan, the Action, and MCP flag infrastructure
crypto with no extra install. qProbe adds the live-endpoint dimension (see the
table above). The narrative anchor for infrastructure is harvest now, decrypt
later: data and secrets captured today are decryptable once a CRQC exists.
Related MCP server: PiQrypt MCP Server
# 1. Scan a codebase for quantum-vulnerable cryptography.
npx @quantakrypto/qscan ./
# 2. Give your AI coding agent post-quantum readiness tools.
claude mcp add quantakrypto npx @quantakrypto/mcp
# 3. Conformance-test a post-quantum implementation (adapter speaks the JSON protocol).
npx @quantakrypto/sieve --impl "node ./my-impl.js" --param ml-kem-768
# 4. Gate against a compliance mandate's dated deadlines (CNSA 2.0 / NIST IR 8547).
# Verdicts also ride in --format json/sarif/evidence; --policy lets an org
# acknowledge families it is knowingly migrating (exempt from early gating).
npx @quantakrypto/qscan ./ --mandate cnsa-2.0 [--policy .quantakrypto/crypto-policy.json]Add the CI gate by dropping
packages/action/examples/quantum-readiness.yml
into .github/workflows/, or wire it up directly:
- uses: quantakrypto/pqc-tools/packages/action@v1
with:
path: "."
severity-threshold: "high"Each package README has the full options reference and more examples: qScan · MCP · Sieve · Action · core · agent.
quantakrypto does not implement post-quantum cryptography, by design — it is
the scanner, the CI gate, and the conformance harness you wrap around a real PQC
library like liboqs / Open Quantum Safe. They
compose: quantakrypto finds and gates classical crypto (qscan, the Action),
tells you what to migrate to and in what order (qscan --tier, MCP
plan_migration, qremediate), and conformance-tests the replacement
(sieve runs any ML-KEM/ML-DSA/SLH-DSA implementation against FIPS 203/204/205,
with exact-value KATs when you supply official NIST ACVP vectors). liboqs
supplies the primitives.
See the worked end-to-end walkthrough — scan → migrate → verify → gate — in
examples/liboqs-migration/.
quantakrypto-tools/
├── packages/
│ ├── core/ @quantakrypto/core — shared engine (the contract lives in src/types.ts + src/index.ts)
│ ├── qscan/ @quantakrypto/qscan — CLI
│ ├── mcp/ @quantakrypto/mcp — MCP server (stdio now, HTTP scaffold for hosting)
│ ├── action/ @quantakrypto/action — GitHub Action
│ ├── sieve/ @quantakrypto/sieve — conformance battery + JSON protocol
│ ├── agent/ @quantakrypto/agent — opt-in BYOK LLM client (triage + remediation)
│ └── qprobe/ @quantakrypto/qprobe — active TLS/SSH endpoint probing (gated; the only prober)
├── docs/ architecture, hosted-MCP design, improvement roadmap
└── examples/ end-to-end examplesRequires Node ≥ 20.
npm install # links the workspaces
npm run build # tsc --build (project references)
npm test # node:test across all packagesThe toolchain is intentionally tiny: TypeScript + tsx (to run node:test on
.ts) are the only dev dependencies; there are no runtime dependencies.
Full documentation lives in docs/:
Objectives & scope — what the toolchain is for, what each library does, the load-bearing decisions, and the deliberate scope boundaries. Start here.
Architecture decisions — the immutable "why" behind each load-bearing choice (zero deps, shared core contract, two-plane agent, …).
Standards & compliance — what the tools touch and could align to: NIST FIPS 203/204/205, SP 800-208, CNSA 2.0, SARIF, CWE, ISO/IEC 27001 (A.8.24), Common Criteria, FIPS 140-3, EU DORA/NIS2, US M-23-02 / NSM-10, and OSS assurance (SLSA, OpenSSF Scorecard, SPDX/REUSE).
Governance: Contributing · Security · Code of Conduct · Changelog.
Apache-2.0. The methodology is open; the assessments, attestation reports, and deliverables are where the quantakrypto practice lives.
Questions, commercial support, or post-quantum readiness training for your team — visit quantakrypto.com or email hello@quantakrypto.com.
Deterministically attach your triage verdicts to their findings and re-sort by exposure (highest first). Never suppresses. Pass the same 'findings' array you triaged plus a 'verdicts' array of { fingerprint, exposureScore, priority, rationale }.
| Name | Required | Description | Default |
|---|---|---|---|
| findings | Yes | The findings that were triaged. | |
| verdicts | Yes | One verdict per finding, keyed by fingerprint. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavior. It mentions 'deterministically' and 'never suppresses', indicating non-destructive and predictable behavior. However, it does not detail side effects, authorization needs, or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core action and key constraint ('Never suppresses'). Every sentence adds value, no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 2 parameters and no output schema, the description explains the operation and parameter structure well. It could explicitly state the return value, but the overall context is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with basic descriptions. The description adds the structure of the verdicts array: '{ fingerprint, exposureScore, priority, rationale }', which is not fully in the schema. This adds meaningful context beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action: 'attach your triage verdicts to their findings and re-sort by exposure (highest first).' It distinguishes from siblings like triage_findings and remediate_findings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit usage context: 'Pass the same findings array you triaged plus a verdicts array...' This implies using after triage, but does not explicitly list alternative tools or conditions for not using.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Deterministically VERIFY a proposed fix before writing it — runs the same patch-policy + verify_fix + blast-radius gates as qremediate (offline, no key, no network). Give the finding, the file's current content, and your proposed FULL corrected content; returns approved:true only if the patch is in-policy, clears the finding, adds no new finding, introduces no network/exec sink, and is bounded in size. This does NOT write the file — you write it, only when approved, and never auto-merge.
| Name | Required | Description | Default |
|---|---|---|---|
| finding | Yes | The scan finding being fixed (needs a string ruleId and location.file). | |
| newContent | Yes | Your proposed full corrected file content. | |
| originalContent | Yes | The file's current full content. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully bears the burden. It details the offline, deterministic nature, the gates (patch-policy, verify_fix, blast-radius), and the specific conditions for approval (in-policy, clears finding, no new finding, no network/exec sink, bounded size). It explicitly states it does NOT write the file, eliminating ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences cover all essential information: purpose, inputs, criteria, and limitation. No fluff; every sentence serves a clear purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity and lack of output schema, the description adequately conveys success conditions and tool behavior. It could be more complete by describing error responses or failure cases, but it is sufficient for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds critical meaning: it clarifies that newContent must be the FULL corrected content (not a diff), and that finding must include ruleId and location.file. This guidance goes beyond the schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool deterministically verifies a proposed fix before writing, with specific verb 'VERIFY' and distinct resource. It differentiates from siblings like get_fix_examples, inventory_crypto, and list_rules by focusing on verification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells when to use: when you have a proposed fix to verify, and it provides input requirements (finding, originalContent, newContent). It also clarifies the tool does not write the file, implying the agent must write after approval. However, no explicit when-not-to-use or alternatives are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Check whether a package is in quantakrypto's known quantum-vulnerable dependency database (the classical crypto it exposes). Provide 'name' and optional 'ecosystem' (default npm).
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Package name to look up (e.g. 'node-forge', 'jsonwebtoken'). | |
| ecosystem | No | Package ecosystem. Default: npm. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description bears full responsibility. It only implies a read-only lookup but does not explicitly state lack of side effects, required permissions, or response format. The word 'check' suggests non-destructive behavior, but this is not confirmed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence plus a brief parameter instruction, containing no wasted words. It is front-loaded with the core purpose and immediately actionable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With two simple parameters and no output schema, the description provides the basic intent. However, missing details on return values, error states, and whether it queries an external service reduce completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and both parameters are well-described in the schema. The description adds only 'default npm' for ecosystem, which is already in the schema. Thus, minimal added value beyond schema, meeting the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks a package against a specific database of quantum-vulnerable dependencies. It identifies the unique resource ('quantakrypto's known quantum-vulnerable dependency database') and action ('Check whether'), distinguishing it from sibling tools like scan_path or inventory_crypto.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description instructs to provide 'name' and optional 'ecosystem', but offers no guidance on when to use this tool versus alternatives (e.g., scan_path, inventory_crypto). No exclusion criteria or context for selection is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Explain a quantakrypto finding and its post-quantum remediation. Provide a ruleId (e.g. 'forge-rsa-keygen', 'elliptic-ec', 'node-rsa', 'pem-ec-private-key') and/or an algorithm (e.g. 'RSA', 'ECDSA'). The ruleId is resolved against the core detector set, so library and config rules explain correctly.
| Name | Required | Description | Default |
|---|---|---|---|
| ruleId | No | The finding's rule id, matching a detector id prefix. | |
| algorithm | No | The classical algorithm family involved (e.g. RSA, ECDH, ECDSA). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose behavioral traits such as read-only nature, side effects, or permission requirements. The tool likely performs a read operation, but this is not explicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, all essential. No wasted words. Main action is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Lacks description of the return value (no output schema), and does not mention prerequisites or side effects. However, the core purpose is clear for a relatively simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the description adds value by providing concrete examples for ruleId and algorithm, and explaining ruleId resolution. This goes beyond the schema's basic descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool explains a quantakrypto finding and its remediation, with specific verb 'explain' and resource. However, it does not differentiate from sibling tools like 'inventory_crypto' or 'remediate_findings'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides guidance on what parameters to provide (ruleId and algorithm) with examples, and explains ruleId resolution. No explicit when-not-to-use or alternatives mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Scan a path and emit a CycloneDX 1.6 Cryptographic Bill of Materials (CBOM) of the classical cryptographic assets found, for compliance / supply-chain tooling. Reads the filesystem, so it is gated like scan_path over HTTP.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute or relative path to a file or directory to inventory. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses filesystem reading and HTTP gating similar to 'scan_path'. No annotations exist, so description carries burden and does well, though lacks details on side effects or limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose and output, second adds behavioral context. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, output format, access gating, and parameter. Lacks detail on 'classical cryptographic assets' and CBOM specifics, but sufficient for agent decision given low complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% coverage for single 'path' parameter with description. Description adds context by specifying scanning action and file/directory, but schema already defines it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specifies verb 'scan', resource 'path', and output 'CycloneDX 1.6 CBOM' for compliance/supply-chain tooling. Distinguishes from sibling 'scan_path' by noting similar gating.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides context 'for compliance / supply-chain tooling' but does not explicitly state when not to use or list alternatives among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Return before/after code examples for migrating a classical algorithm to a post-quantum / hybrid replacement. Provide an 'algorithm' (RSA, ECDH, ECDSA, …) or a 'ruleId' from a finding.
| Name | Required | Description | Default |
|---|---|---|---|
| ruleId | No | A finding's ruleId (resolved to its algorithm). | |
| algorithm | No | Classical algorithm family to migrate away from. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must cover behavioral traits. It indicates a read-only operation (returning examples) but does not mention any required permissions, side effects, or response details. The description is adequate but lacks depth beyond the basic purpose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no wasted words. The first sentence conveys the core purpose, and the second explains the input options. Information is front-loaded and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description should clarify what the returned data looks like. It only says 'before/after code examples' but not the format (e.g., strings, code blocks). While the tool is simple, the lack of output specification leaves some ambiguity for an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds value by listing example algorithms ('RSA, ECDH, ECDSA') and clarifying that 'ruleId' comes from a finding, which supplements the schema descriptions. However, it does not elaborate on input format or constraints beyond what is in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns 'before/after code examples for migrating a classical algorithm to a post-quantum / hybrid replacement.' The verb 'Return' and resource 'code examples' are specific, and the tool is clearly distinct from sibling tools like 'apply_verified_patch', 'inventory_crypto', and 'list_rules'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description tells users to provide an 'algorithm' (e.g., RSA, ECDH) or a 'ruleId' from a finding, giving clear input options. However, it does not explicitly state when to use this tool versus its siblings, such as when a user needs examples versus applying a patch or listing rules.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Produce a post-quantum readiness inventory for a path: a 0-100 readiness score plus counts of cryptographic findings by algorithm, category, and severity.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute or relative path to a file or directory to inventory. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and the description only describes the output format. It does not disclose if the tool is read-only, required permissions, or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence efficiently conveys the tool's purpose and output, no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and no output schema, the description covers the core purpose. Missing behavioral details but adequate given simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single parameter, so the description adds marginal value. It confirms path is for a file/directory but does not enhance beyond the schema description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool produces a 'post-quantum readiness inventory' with a specific score (0-100) and counts by algorithm, category, severity. It distinctly differs from sibling tools like scan_path or check_dependency.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus siblings. The description implies it's for cryptographic inventory but does not provide context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List the quantakrypto detector catalog: every detector id and what it looks for.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description must convey behavioral traits. It states the tool is a list operation with no side effects, which is clear. However, it omits details like potential pagination, rate limits, or data freshness, leaving some ambiguity for a read operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no wasted words. It conveys the essential information efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (no parameters, no output schema), the description adequately tells the agent what the tool does. It could mention the output format more explicitly, but the hint about 'every detector id and what it looks for' is sufficient for basic use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and 100% schema coverage, so the description needs no parameter details. It adds value by explaining what the output contains (detector id and description), which is sufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'List' and the resource 'quantakrypto detector catalog', specifying what is returned (detector id and description). It distinguishes from sibling tools which focus on patching, fixing, or inventory, not listing detectors.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The description does not mention scenarios where it is appropriate or inappropriate to invoke it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Scan a path and return a deterministic, prioritized post-quantum migration plan: findings grouped by algorithm, ordered harvest-now-decrypt-later first, each with its PQC target and the readiness-score impact. Reads the filesystem, so it is gated like scan_path over HTTP.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute or relative path to a file or directory to plan a migration for. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states 'Reads the filesystem', which suggests a read-only operation, but does not explicitly confirm non-destructiveness. The mention of being gated like scan_path adds some behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of moderate length that is clear and front-loaded with the primary purpose. It uses few words but covers essential details without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (one parameter, no output schema), the description is complete. It explains the return format (grouped, ordered, with PQC target and impact) and references scan_path for gating, which is sufficient for an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for the single parameter 'path', so the schema already documents its meaning. The description does not add new information about the parameter beyond referencing it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it scans a path and returns a deterministic, prioritized post-quantum migration plan. It specifies the output format: findings grouped by algorithm, ordered harvest-now-decrypt-later first, with PQC target and readiness-score impact. This clearly distinguishes it from sibling tools like scan_path.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions the tool reads the filesystem and is gated like scan_path over HTTP, implying usage context (e.g. authentication, rate limits). However, it does not explicitly state when to use this tool vs alternatives like remediate_findings or triage_findings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Actively probe ONE live TLS/SSH endpoint YOU OWN for post-quantum readiness (PQC-hybrid key exchange X25519MLKEM768, classical certificate posture). REQUIRES an ownership attestation: set i_own_this=true to confirm you are authorized to test the target. Refuses CIDR ranges / wildcards / lists — one host at a time. Performs only a benign, unauthenticated handshake and never modifies the endpoint. NOTE: this is the ONLY quantakrypto MCP tool that opens a network connection; the server is otherwise offline. Over HTTP it is disabled unless the operator sets QUANTAKRYPTO_MCP_ALLOW_NETWORK=1.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Probe mode (default: auto — SSH on :22, TLS otherwise). | |
| target | Yes | A single host or host:port you own (no ranges/CIDRs/wildcards). | |
| i_own_this | Yes | Attestation that you are authorized to probe this endpoint. Must be true; the probe is refused otherwise. | |
| timeout_ms | No | Per-connection timeout in ms (default 8000). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description fully discloses behavioral traits: it performs only a benign unauthenticated handshake, never modifies the endpoint, requires ownership attestation, and is the only network-opening tool. It also mentions the HTTP disabling condition. Minor omission is output format, but safety and constraints are well-covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is moderately concise with four sentences that each add value. It front-loads the purpose and uses clear structure. Some all-caps emphasis is slightly excessive but acceptable. Could be slightly trimmed without loss.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (4 parameters, network operation, ownership, mode), the description covers many aspects like safety, ownership, constraints, and special network behavior. However, it lacks any description of the output or return value, which is needed since there is no output schema. This is a notable gap for completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds meaningful behavioral context to parameters: explains ownership attestation, mode auto-behavior, target constraints, and timeout context. This goes beyond schema descriptions and aids correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('probe') and resource ('one live TLS/SSH endpoint') and clearly states it checks for post-quantum readiness with PQC-hybrid key exchange and classical certificate posture. It explicitly distinguishes itself as the only sibling tool that opens a network connection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context: it requires ownership attestation, refuses CIDR ranges/wildcards, and limits to one host at a time. It also notes the network connectivity specialness and the environment variable for HTTP. Missing explicit alternatives but sufficient for an agent to decide when to use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Produce a deterministic remediation REQUEST bundle (rubric + fix schema + per-finding metadata + fingerprints) for YOU (the host agent) to fix. This tool calls no model and needs no key. For each finding, propose the corrected FULL file content, then VERIFY with verify_fix and keep only fixes that clear the finding. Never touch files with secrets; never auto-merge. Pass 'findings' from scan_path --format json.
| Name | Required | Description | Default |
|---|---|---|---|
| findings | Yes | Findings from a scan's JSON output. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description fully discloses behavior: it produces a bundle, verifies fixes with verify_fix, and retains only passing fixes. It explicitly states no auto-merge and no secret touching, which covers major behavioral expectations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single paragraph with multiple sentences that convey key points efficiently. It front-loads the main purpose, but could be slightly more structured (e.g., listing constraints separately). Still, no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema) and the presence of sibling tools, the description covers input origin, process (verification step), constraints (secrets, auto-merge), and output purpose. It is sufficiently complete for an AI agent to use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema coverage is 100% for the single parameter, the description adds meaning by specifying the expected source ('findings from scan_path --format json'), which clarifies format and origin beyond the schema's minimal description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('remediate') and resource ('findings'), and clearly distinguishes its role: it produces a deterministic remediation request bundle for the host agent, not applying fixes directly. It contrasts with sibling tools like apply_verified_patch and verify_fix.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context: it calls no model, needs no key, and instructs to pass findings from scan_path. It also sets boundaries (never touch secrets, never auto-merge). However, it does not explicitly state when to use alternatives like triage_findings or apply_verified_patch.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Scan a file or directory for classical (quantum-vulnerable) asymmetric cryptography using quantakrypto. Returns a readiness summary and findings.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute or relative path to a file or directory to scan. | |
| format | No | Output format: 'summary' (default) for readable text, 'json' for the raw ScanResult. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries full burden. It mentions 'using quantakrypto' as the scanning engine and indicates a read-only operation by 'Returns a readiness summary and findings'. However, it does not disclose permissions, limitations, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two well-structured sentences with no extraneous information. Every word adds value: action, resource, target, tool, output.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description explains the output as 'readiness summary and findings' with format options (summary/json), but lacks detail on the structure of the ScanResult object. Given no output schema, more detail would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, both 'path' and 'format' parameters are already described in the schema. The description adds no new semantics beyond what the schema provides, meeting baseline expectations.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'Scan', the resource 'file or directory', the specific cryptography type 'classical (quantum-vulnerable) asymmetric cryptography', and the output 'readiness summary and findings'. It effectively distinguishes from siblings like 'probe_endpoint' or 'inventory_crypto'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like 'probe_endpoint' for network endpoints or 'inventory_crypto' for broader inventory. The description lacks explicit usage scenarios or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Compute the readiness-score and HNDL change between two finding sets (e.g. before and after a migration). Pass 'before' and 'after' as arrays of findings from scan_path --format json.
| Name | Required | Description | Default |
|---|---|---|---|
| after | Yes | Findings after the change. | |
| before | Yes | Findings before the change (from a scan's JSON findings). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full behavioral disclosure burden. It describes the computation but does not explicitly state it is read-only or side-effect free. However, the action ('compute') suggests no mutation, and no contradictions are present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the main purpose, no redundant information. Every word earns its place. Highly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 2 required parameters and no output schema, the description covers input but omits output format details (e.g., structure of readiness-score and HNDL change). This gap in return value information reduces completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with basic descriptions for both parameters. The description adds context by specifying the expected source ('scan_path --format json'), which provides slight added value. Overall, the schema already handles parameter semantics adequately.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool computes 'readiness-score and HNDL change' between two finding sets, using specific verbs and resource types. It gives an example use case (before/after migration). While it doesn't explicitly differentiate from siblings, the purpose is specific enough for selection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use (comparing two finding sets) and provides input formatting guidance ('arrays of findings from scan_path --format json'). However, it lacks explicit when-not-to-use or alternative tool mentions, leaving the agent to infer context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recommend a post-quantum / hybrid migration. Provide an 'algorithm' (e.g. RSA, ECDH, ECDSA) or free-text 'context' describing the usage. Set 'tier' to 'category-5' for CNSA 2.0 / national-security systems.
| Name | Required | Description | Default |
|---|---|---|---|
| tier | No | Security tier: 'category-3' (default, commercial — ML-KEM-768 / ML-DSA-65) or 'category-5' (CNSA 2.0 / NSS, long-lived secrets — ML-KEM-1024 / ML-DSA-87). | |
| context | No | Free-text description of the cryptographic usage (used when no algorithm is given). | |
| algorithm | No | Classical algorithm family to migrate away from. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries full burden. It implies a read-only recommendation operation but does not explicitly state side effects, idempotency, or whether it modifies any state. The description provides some context but misses key behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose, followed by concise usage guidance. Every sentence adds value with no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description covers input parameters and usage context well. However, it does not describe the tool's output or return behavior, leaving a gap for the agent regarding what to expect from the call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds value by providing examples (RSA, ECDH, ECDSA) and explaining the conditional usage of 'algorithm' vs 'context', as well as the significance of 'category-5' for CNSA 2.0, going beyond the schema's descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool recommends a post-quantum/hybrid migration, using specific verbs and resources. It distinguishes itself from siblings like plan_migration and inventory_crypto by focusing on recommendations rather than planning or inventory.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear guidance on when to use the tool (to get migration recommendations) and how to specify input (algorithm or context, tier selection). It lacks explicit when-not-to-use instructions or direct comparison with alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Produce a deterministic triage REQUEST bundle (rubric + verdict schema + per-finding metadata) for YOU (the host agent) to reason over. This tool does NOT call any model and needs no API key. Assess each finding's real-world exposure, then call apply_triage with your verdicts. Pass 'findings' as an array from scan_path --format json.
| Name | Required | Description | Default |
|---|---|---|---|
| findings | Yes | Findings from a scan's JSON output. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, description carries full burden. It discloses deterministic behavior, no model calls, no API key needed, and that output is a reasoning bundle. This adequately informs the agent of side-effect-free, localized processing. A minor gap: no mention of error handling or format, but sufficient for core traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each essential. First sentence defines purpose, second adds behavioral traits, third gives usage flow. Front-loaded with core purpose. No verbosity or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a single parameter with high schema coverage, no output schema, and sibling tools including apply_triage, the description is complete. It explains what the tool produces, how it fits in the workflow, and key constraints. No missing information for an agent to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% coverage with description for 'findings'. Description adds valuable context: specify 'array from scan_path --format json', clarifying source and format. This goes beyond schema by providing concrete usage instructions, aiding correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool produces a triage request bundle, specifying the action ('produce') and resource ('triage request bundle'). It distinguishes from sibling tools like apply_triage and remediate_findings by clarifying this tool only prepares data for reasoning, not execution.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells the agent to assess findings then call apply_triage with verdicts, establishing a clear workflow. Also notes the tool needs no API key and doesn't call a model, guiding appropriate usage. Could strengthen with explicit 'do not use for X' but current guidance is strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run the quantakrypto detectors over a code snippet (NOT the filesystem) and report any classical crypto that remains. Use this to confirm an edit actually removed the quantum-vulnerable usage. Provide 'code' plus a 'language' or 'filename'.
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | The source code to check. | |
| filename | No | Optional filename; its extension selects the detectors (overrides 'language'). | |
| language | No | Language of the code (js, ts, python, go, java, csharp, rust, ruby, c, …). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that the tool runs detectors over a code snippet (NOT the filesystem) and reports remaining classical crypto. With no annotations, it carries the full burden. It lacks details on response format, authentication needs, or side effects, which are important for a verification tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no fluff. First sentence states function, second sentence states usage and input requirements. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description should ideally mention the output structure (e.g., list of findings, severity). It only says 'report any classical crypto that remains', which is vague. With sibling tools like scan_path that also detect crypto, more differentiation or output details would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for each parameter. The description adds value by explaining the relationship between filename and language ('filename overrides language via extension') and says to 'provide code plus a language or filename', which is helpful beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it runs quantakrypto detectors over a code snippet to report remaining classical crypto, and explicitly says to use it to confirm an edit removed quantum-vulnerable usage. This is a specific verb+resource with clear scope, differentiating it from siblings like scan_path (filesystem) or inventory_crypto.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says when to use: 'Use this to confirm an edit actually removed the quantum-vulnerable usage.' It also provides input guidance: 'Provide code plus a language or filename.' However, it does not mention when not to use or list alternatives explicitly, though the sibling list implies alternatives for other tasks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Each tool has a clearly distinct purpose: scanning, explaining, fixing, triaging, or probing. Despite overlapping input types (e.g., multiple scanning tools), their outputs differ significantly (CBOM, inventory, plan, findings). Descriptions are detailed enough to prevent ambiguity.
All tool names follow a consistent verb_noun pattern in snake_case (e.g., generate_cbom, scan_path, verify_fix). No mixing of conventions or vague verbs, making the naming predictable and readable.
With 16 tools, the server is slightly above the typical 3-15 range for a well-scoped set. However, each tool fulfills a specific function in the PQC readiness workflow, so the count is justified and not excessive.
The tool surface covers the full lifecycle: scanning, inventory, planning, explaining, dependency checking, fixing, verification, triage, and endpoint probing. No obvious gaps exist for the stated domain of post-quantum readiness assessment and migration.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
PQC scanner for GitHub repos and smart contracts. Detects quantum-vulnerable ECDSA/RSA.
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
Zero-install security baseline for AI coding agents — OWASP/CWE-cited rules over MCP.
QuantumOracle — 18 post-quantum crypto tools: Kyber, Dilithium, hybrid schemes, migration.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/quantakrypto/pqc-tools'
If you have feedback or need assistance with the MCP directory API, please join our Discord server