quantumguard-mcp

QuantumGuard MCP

Post-quantum cryptography security tools for AI coding agents. Scan your codebase for quantum vulnerabilities, check NIST compliance, and get migration guidance -- all from within Claude Code, Cursor, or VS Code.

Why QuantumGuard?

NIST finalized its post-quantum cryptography standards in 2024 (FIPS 203, 204, 205). The NSA's CNSA 2.0 mandates quantum-safe algorithms by 2030-2035. The EU requires migration inventories by 2027.

Meanwhile, most codebases are full of ECDSA signatures, RSA key exchanges, and SHA-1 hashes that quantum computers will break. Between $381B and $650B in crypto assets sit in quantum-vulnerable addresses today.

The problem: developers have no fast way to find and fix these vulnerabilities during their normal workflow.

QuantumGuard MCP solves this by embedding 9 PQC security tools directly into your AI coding agent via the Model Context Protocol (MCP). No context switching. No separate audit tools. Just ask your AI assistant to scan.

Quick Start (30 seconds)

Option 1: npx (zero install)

npx quantumguard-mcp

Option 2: Add to your project

Add to .mcp.json in your project root:

{
  "mcpServers": {
    "quantumguard": {
      "command": "npx",
      "args": ["-y", "quantumguard-mcp"]
    }
  }
}

Option 3: Global install

npm install -g quantumguard-mcp

Then add to your MCP config:

{
  "mcpServers": {
    "quantumguard": {
      "command": "quantumguard-mcp"
    }
  }
}

Works with Claude Code, Cursor, and VS Code (any MCP-compatible client).

9 Tools

Tool	What it does
pqc_scan_file	Scan a single file for quantum-vulnerable patterns (ECDSA, RSA, DH, Ed25519, etc.)
pqc_scan_directory	Recursively scan an entire project across 14+ file types
pqc_compliance_check	Audit a project against NIST FIPS 202/203/204/205 and CNSA 2.0
pqc_nist_standards_reference	Quick reference for all NIST PQC standard parameters
pqc_migration_guide	Code templates for ECDSA-to-Dilithium, RSA-to-ML-KEM, SHA-256-to-SHA3 in Rust, TypeScript, and Solidity
pqc_recommend_algorithm	Algorithm recommendations based on use case (blockchain, API auth, IoT, government, finance)
pqc_algorithm_comparison	Side-by-side comparison of algorithms (performance, key size, security level)
pqc_key_size_comparison	Compare key and signature sizes to plan storage/bandwidth impact
pqc_analyze_signature	Identify the algorithm from a hex-encoded signature or public key

Usage Examples

Once QuantumGuard MCP is configured, just ask your AI agent in natural language:

Scan for vulnerabilities

"Scan this project for quantum vulnerabilities"

## QuantumGuard PQC Vulnerability Report

**Total findings: 12**
- CRITICAL: 5
- HIGH: 4
- MEDIUM: 3

### PQC-002 [CRITICAL]
- **File**: `src/auth/wallet.ts:42:15`
- **Match**: `ECDSA`
- **Issue**: Elliptic curve signature/key exchange (vulnerable to Shor's algorithm)
- **Fix**: Replace with ML-DSA-65 (Dilithium) for signatures. Use FIPS 204 compliant library
- **CWE**: CWE-327

### PQC-030 [CRITICAL]
- **File**: `contracts/Vault.sol:89:5`
- **Match**: `ecrecover`
- **Issue**: EVM ECDSA recovery/signing - quantum vulnerable wallet operations
- **Fix**: Implement hybrid signing: ECDSA (EVM compat) + ML-DSA-65 (quantum safety)
- **CWE**: CWE-327

Check compliance

"Check if this project is NIST PQC compliant"

Reports pass/fail status for each FIPS standard (202, 203, 204, 205), CNSA 2.0 timeline requirements, and EU quantum-safe regulatory deadlines.

Get migration code

"Show me how to migrate from ECDSA to Dilithium in Rust"

Returns working code templates with before/after examples for your target language (Rust, TypeScript, or Solidity).

Get algorithm recommendations

"What algorithm should I use for a blockchain wallet?"

Returns context-aware recommendations considering your environment (server, browser, mobile, embedded, smart contract) and priority (security, performance, size, balanced).

What's Quantum-Vulnerable vs Quantum-Safe

Category	Quantum-Vulnerable	Quantum-Safe Replacement	Standard
Digital Signatures	ECDSA, Ed25519, DSA	ML-DSA-65 (Dilithium)	FIPS 204
Key Exchange	ECDH, DH, RSA	ML-KEM-768 (Kyber)	FIPS 203
Hash-Based Signatures	--	SLH-DSA (SPHINCS+)	FIPS 205
Hashing	SHA-1, MD5	SHA3-256	FIPS 202
Symmetric Encryption	AES-128	AES-256	--
Blockchain Signing	ecrecover, eth_sign	Hybrid: ECDSA + ML-DSA-65	FIPS 204

Vulnerability Patterns Detected

CRITICAL (broken by Shor's algorithm):

• ECDSA, Ed25519, EdDSA, RSA, DH, DSA
• secp256k1, secp256r1, P-256, P-384, curve25519
• ecrecover, eth_sign, personal_sign, signTypedData

HIGH (weakened by Grover's algorithm):

• AES-128, SHA-1, MD5
• ethers.Wallet signing, web3.eth.accounts.sign

MEDIUM (suboptimal for quantum resistance):

• SHA-256 (reduced from 256-bit to ~128-bit quantum security)
• keccak256 (pre-FIPS, use SHA3-256 instead)

Supported Languages

Scans files in: TypeScript, JavaScript, Rust, Solidity, Python, Go, Java, C#, Ruby, PHP, YAML, JSON, TOML.

Migration templates available for: Rust, TypeScript, Solidity.

Standards Coverage

Standard	Description
FIPS 202	SHA-3 (Secure Hash Algorithm 3)
FIPS 203	ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism)
FIPS 204	ML-DSA (Module-Lattice-Based Digital Signature Algorithm / Dilithium)
FIPS 205	SLH-DSA (Stateless Hash-Based Digital Signature Algorithm / SPHINCS+)
CNSA 2.0	NSA Commercial National Security Algorithm Suite 2.0
NIST SP 800-227	Post-Quantum Cryptography Migration Recommendations

Part of Quantum Shield

QuantumGuard MCP is the developer tool component of Quantum Shield, a post-quantum asset custody protocol using dual NIST signatures (Dilithium + SPHINCS+), a Prover Pool, VRF, and time-locked security.

Contributing

Contributions are welcome. Areas where help is needed:

• New vulnerability patterns -- especially for languages not yet covered
• Migration templates -- for additional languages (Go, Python, Java)
• CI/CD integration -- GitHub Actions, GitLab CI templates
• Testing -- expanding test coverage for edge cases

git clone https://github.com/kota1026/quantum-shield.git
cd quantum-shield/src/services/quantumguard-mcp
npm install
npm run dev

License

MIT