Qrp MCP Server已验证已精选

qrp-mcp

An offline scanner that finds quantum-vulnerable cryptography in source code and configuration, and reports its own coverage — which files it read, which it could not, and why, per file. It runs locally via uvx (no code leaves the machine), is free and open source, and emits a CycloneDX 1.6 CBOM.

What it detects

RSA, EC/ECDSA/EdDSA/Ed25519, X25519, ECDH, DSA, DH, and the crypto that carries cryptocurrencies (secp256k1, Schnorr, BLS), plus every standardised and candidate post-quantum family (ML-KEM, ML-DSA, SLH-DSA, Falcon, Classic McEliece, and more). Config files count: prime256v1 in an nginx ssl_ecdh_curve and the hybrid X25519MLKEM768 KEM group are both found, not just library calls.

What makes it different — coverage, honestly

Most scanners report what they found. qrp-mcp also reports what it could not read. It draws a hard line between two axes: reached (did the tool open the file? — measurable, and confessed when it fails) and found (was everything present detected? — NOT self-measurable, because a silent rule and an absent algorithm produce the same output). It never claims the second axis without a control. The coverage block travels inside the CBOM.

Use it for

• Post-quantum (PQC) readiness assessment on a codebase or config tree
• Generating a CycloneDX CBOM as evidence (DORA, NIST IR 8547, CBOM workflows)
• Letting an AI agent inventory cryptography and reason about migration risk

Do not use it for

Scanning a live network endpoint, a running host, or a certificate store — it reads files on disk and nothing else. It is a discovery tool, not a fixer.

Run it

{ "mcpServers": { "qrp": { "command": "uvx", "args": ["qrp-mcp"] } } }