pqc-scan

Cryptographic inventory

Scan the directory the user names with the scan_repo tool from the qrp MCP server. If they name none, scan the current working directory.

Report in this order.

1. What was found. Each algorithm, its classification — quantum-vulnerable, post-quantum, weak, or unknown — with the file and line, so the user can open it. For post-quantum schemes, give the family it rests on (structured or unstructured lattice, code-based, hash-based, isogeny-based, multivariate, symmetric-based) and where it stands: standardised, selected, candidate, withdrawn, eliminated, or broken. "Post-quantum" is a category, not an assessment: SIKE is broken, HAWK was withdrawn by its own authors, and CROSS was dropped by NIST — all three are post-quantum by design.

Report also_present whenever it is set. A hybrid or composite name carries two algorithms: X25519MLKEM768 is ML-KEM and X25519, and id-MLDSA44-RSA2048-PSS-SHA256 is ML-DSA and RSA-2048. The construction holds if either half holds, which is why the post-quantum name leads — but the classical half is the component Shor breaks, and a summary that names only the post-quantum one is describing the half that is fine. Say both.

2. What the scan could not read. State unreadable_files and its count plainly, even when it is zero. A file nobody could open is not a file that is clean, and the difference is the coverage of the whole report. Never let an unreadable file pass as an absence of findings.

3. Coverage, as a fraction with a real base. files_scanned against files_present — how much was read, out of how much was there. Then files_skipped_by_type: files not read because this tool does not claim that type, counted by extension. That is a boundary of the scan, not a gap in it, but it is the reader's to judge, not yours to hide. The three outcomes always account for every file: scanned, unreadable, skipped.

If the skipped list contains something that could hold cryptography — .env, .pem, .p12, .json, a Dockerfile, a binary — say so, and offer to look at those files yourself. You are holding the tree; the scanner is not. That question is the one thing you can answer that it cannot.

Then stop.