Documentation

Everything you need to integrate QCrypton

Architecture Overview

QCrypton is a modular, 46-module quantum-resilient security platform. Each module is independent with zero external crypto dependencies.

Module	Purpose	Key File
Attack Cost Engine	FTQC resource estimation for 28 algorithms + 2-level validation + 3 timeline scenario presets (Early/Planning/Late)	`lib/quantum-cost.js`
Threat Scanners	13 runtime scanners (injection, phishing, card fraud, etc.)	`lib/scanners.js`
Code Scanner	Crypto scanning across 6 languages + 13 implementation flaw detectors + SARIF + CBOM	`lib/code-scanner.js`
Remediation	Auto-fix weak crypto, config remediation, input sanitization	`lib/remediate.js`
Autonomous PR	Scan repos, generate patches, open PRs on GitHub	`lib/pr-orchestrator.js`
CNSA 2.0 & Federal Compliance	CNSA 2.0 + OMB M-23-02 + NSM-10 + EO 14028 + NIST IR 8547 compliance checking, unified timeline, migration roadmap	`lib/cnsa2.js`
PQC Benchmarks	Performance benchmarking for NIST PQC algorithms	`lib/pqc-benchmark.js`
HPKE Encryption	RFC 9180 HPKE with PSK mode for HNDL defense	`lib/hpke.js`
QKD Engine	BB84 protocol with enhanced eavesdrop detection	`lib/qkd.js`
HSM/KMS	6 providers, 9 PQC algorithms, FIPS 140-3 Level 3	`lib/hsm.js`
Noise Reachability	12 noise types, 6 QEC codes, 720 evaluations	`lib/noise-reachability.js`
Slack Integration	Block Kit alerts for threats, assignments, SLA breaches, PRs	`src/services/slackService.js`
Crypto Threat Intel	25+ quantum milestones, threat timeline, dynamic risk multipliers	`lib/threat-intel.js`
TLS Crypto Monitor	Live TLS endpoint probing, cipher suite & cert quantum assessment	`lib/tls-monitor.js`
Supply Chain Audit	Dependency manifest scanning across 5 ecosystems, 75+ crypto packages	`lib/supply-chain.js`
PQC Migration Agent	Multi-turn AI workflow: inventory, dependency mapping, migration planning, Red/Blue/Arbiter adversarial validation, PR generation	`lib/migration-agent.js`
Migration Optimizer	4 cost/risk strategies with side-by-side comparison	`lib/migration-optimizer.js`
NL Console	Natural language orchestrator with 12 intents, AI/local matching	`lib/nl-orchestrator.js`
Predictive Models	Quantum timeline forecast, MTTR trend, risk trajectory projection	`lib/predictive-models.js`
Parallel Sweep	Org-wide concurrent scanning with bounded concurrency (1–50 workers)	`lib/parallel-sweep.js`
Financial Risk Engine	Board Number (expected loss), Cryptographic Debt (7-factor), HNDL exposure, NPV-discounted financial impact, scenario comparison	`lib/financial-risk.js`
LLM Provider	Multi-provider AI abstraction (Claude, GPT, Gemini, Ollama/vLLM)	`lib/llm-provider.js`

Getting Started

QCrypton can be used in three ways: as a CLI tool, as a library/SDK, or as a full REST API platform. No server or database is required for scanning, analysis, or encryption.

Quick Start (5 minutes)

# 1. Install
npm install -g qcrypton

# 2. Scan your project
qcrypton scan .

# 3. See quantum attack costs
qcrypton assess RSA-2048

# 4. Auto-fix weak crypto
qcrypton gate . --fail-on-weak --auto-fix

# 5. Check CNSA 2.0 compliance
qcrypton cnsa2 .

# 6. Start the full platform (optional — needs PostgreSQL)
export DATABASE_URL=postgres://user:pass@localhost/qcrypton
npm start
# Dashboard at http://localhost:3000

CLI Reference

Install QCrypton globally via npm:

npm install -g qcrypton

# Scan a project for weak cryptography
qcrypton scan .

# Assess quantum attack cost for an algorithm
qcrypton assess RSA-2048

# Run CI/CD gate with auto-fix
qcrypton gate . --fail-on-weak

# Generate SARIF output for GitHub Security
qcrypton sarif .

# Encrypt data with HPKE
qcrypton encrypt --mode hpke --input data.json

# Generate CBOM (CycloneDX)
qcrypton cbom .

# Generate CBOM (SPDX 2.3)
qcrypton spdx .

# Show quantum threat timeline & milestones
qcrypton threat-intel

# Probe a TLS endpoint for quantum vulnerability
qcrypton tls-probe example.com --port 443

# Scan dependencies for quantum-vulnerable crypto
qcrypton supply-chain .

# Show migration agent usage info
qcrypton migration-agent

API Reference

QCrypton exposes 213+ REST API endpoints. Below are the key endpoint groups:

Threat Scanning

POST /scan/injection — Scan for prompt injection attacks (21 patterns)
POST /scan/tool-poisoning — Detect MCP tool poisoning
POST /scan/exfiltration — Check for data exfiltration attempts
POST /scan/brute-force — Detect brute force and credential stuffing
POST /scan/phishing — Identify phishing and brand impersonation
POST /scan/card-fraud — Detect card swap and payment fraud
POST /scan/quantum-threat — Quantum threat assessment
POST /scan/pqc-readiness — PQC migration readiness evaluation
POST /scan/noise-reachability — Quantum noise reachability analysis
POST /scan/sarif — Generate SARIF 2.1.0 report

Cryptography

POST /crypto/encrypt — AES-256-GCM symmetric encryption
POST /crypto/decrypt — AES-256-GCM symmetric decryption
POST /crypto/hpke/encrypt — HPKE public-key encryption
POST /crypto/hpke/decrypt — HPKE decryption
POST /crypto/hash — LSH-256 / SHA3-256 hashing
POST /crypto/qkd/session — BB84 QKD key exchange

Attack Cost Estimation

GET /quantum-cost/:algorithm — FTQC resource estimation for a specific algorithm
GET /quantum-cost/compare — Compare multiple algorithms
GET /quantum-cost/all — All 28 algorithms
GET /quantum-cost/:algorithm/scenario/:scenario — Scenario-adjusted estimate (early/planning/late)
GET /quantum-cost/:algorithm/scenarios — Compare all three timeline scenarios

Financial Risk Quantification

POST /financial-risk/board-number — Calculate Board Number (expected financial loss) across assets
POST /financial-risk/crypto-debt — Calculate Cryptographic Debt score (7-factor model)
POST /financial-risk/hndl — HNDL (Harvest Now, Decrypt Later) exposure analysis
POST /financial-risk/assess — Full financial risk assessment from scan results
GET /financial-risk/hndl-portfolio — Aggregate HNDL exposure across all tenant assets. Query: ?scenario=planning|early|moderate|late. Returns exposure rate, urgency distribution, top exposed assets, scenario breakdown.

Code Scanner

POST /scan/code — Scan source code for weak cryptography
POST /scan/secrets — Detect hardcoded secrets (26 patterns)
POST /scan/binary — Binary crypto constant detection
POST /scan/cbom — Generate CycloneDX CBOM. Query: ?format=cyclonedx|spdx. SPDX 2.3 output includes packages, relationships, and cryptographic annotations.

Remediation

POST /remediate/code — Auto-fix weak crypto in source code
POST /remediate/config — Fix insecure server configurations
POST /remediate/sanitize — Sanitize malicious input

Autonomous PR Generation

POST /remediation/pr/create — Trigger autonomous remediation PR (returns 202, runs async)
GET /remediation/pr — List remediation PRs (filter by platform, repo, status)
GET /remediation/pr/:id — Get PR details with patch summary
POST /remediation/pr/:id/sync — Sync PR status from GitHub
DELETE /remediation/pr/:id — Cancel and close PR on GitHub

# Create a remediation PR on GitHub
curl -X POST https://api.qcrypton.com/api/remediation/pr/create \
  -H "Authorization: Bearer YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"platform":"github","owner":"my-org","repo":"my-app","baseBranch":"main","minRisk":"medium"}'

CNSA 2.0 & Federal Compliance

GET /cnsa2/timeline — CNSA 2.0 migration timeline milestones
GET /compliance/federal — Check all federal mandates (OMB M-23-02, NSM-10, EO 14028, NIST IR 8547)
GET /compliance/unified-timeline — Merged chronological timeline across all mandates
GET /cnsa2/algorithms — List approved and deprecated algorithms
GET /cnsa2/check/:algorithm — Check a single algorithm
POST /cnsa2/compliance — Run CNSA 2.0 compliance check on code or project

PQC Benchmarks

GET /pqc-benchmark/algorithms — List PQC algorithms with metadata
POST /pqc-benchmark/run — Run performance benchmarks (ML-KEM, ML-DSA, SLH-DSA vs classical)

Slack Integration

GET /slack/configs — List Slack webhook configurations
POST /slack/configs — Add Slack webhook (events: threat_critical, finding_assigned, sla_breach, pr_created)
PUT /slack/configs/:id — Update Slack config
DELETE /slack/configs/:id — Remove Slack config
POST /slack/test — Send test message to verify connection

Finding Assignment

GET /risk/findings — List findings (filter: status, severity, assignee=me, unassigned=true)
PUT /risk/findings/:id/assign — Assign finding to user (validates user, sends email + Slack notification)
POST /risk/findings/bulk-assign — Bulk assign up to 100 findings

Enterprise

POST /auth/login — Authentication (email/password, SSO)
GET /compliance/soc2 — SOC 2 compliance report
GET /compliance/iso27001 — ISO 27001 compliance report
GET /compliance/pci-dss — PCI-DSS 4.0.1 compliance report with 19 controls mapped to QCrypton capabilities
GET /compliance/hipaa — HIPAA Security Rule compliance report with 17 controls mapped
GET /compliance/summary — Combined summary across all 4 compliance frameworks
GET /evidence-package — Generate evidence bundle for auditors (assets, findings, compliance, remediation). Query: ?frameworks=soc2,pci-dss&includeFindings=true
POST /vault/store — Store secret in encrypted vault
POST /vault/shamir/split — Shamir secret splitting
POST /vault/shamir/reconstruct — Shamir secret reconstruction
POST /siem/forward — Forward events to SIEM

Crypto Threat Intelligence

GET /api/threat-intel/milestones — Returns quantum computing milestones. Query: ?category=hardware|error_correction|algorithm|policy|photonic
GET /api/threat-intel/timeline — Returns threat timeline with break-year estimates per algorithm family
GET /api/threat-intel/timeline/:algorithm — Returns specific algorithm assessment with urgency and threat multiplier
POST /api/threat-intel/refresh — Triggers manual intelligence refresh from configured feed (admin only)
GET /api/threat-intel/alerts — Returns recent threat timeline shift alerts

Runtime TLS Monitoring

POST /api/tls/probe — Probe single TLS endpoint. Body: { host: string, port?: number }. Returns cipher, protocol, certificate chain, quantum vulnerability assessment.
POST /api/tls/scan — Batch scan up to 50 endpoints. Body: { endpoints: [{host, port}] }. Returns aggregated findings and PQC readiness.
GET /api/tls/history — Query stored TLS scan results. Query: ?host=&limit=50&offset=0

Supply Chain Crypto Audit

POST /api/scan/supply-chain — Scan project dependency manifests. Body: { path: string }. Parses package.json, requirements.txt, go.mod, Cargo.toml, pom.xml. Returns quantum-vulnerable dependencies.
POST /api/scan/supply-chain/manifest — Audit single manifest. Body: { manifest: string, filename: string }. Returns parsed dependencies with crypto exposure.
GET /api/scan/supply-chain/packages — Returns the crypto package database (75+ packages across 5 ecosystems)

Autonomous PQC Migration Agent

POST /api/migration/agent/start — Launch autonomous migration agent. Body: { platform: "github", owner, repo, baseBranch?, provider?, model?, maxFiles? }. Returns 202 (fire-and-forget).
GET /api/migration/agent — List migration agents for tenant. Query: ?status=&limit=50&offset=0
GET /api/migration/agent/:id — Get full agent state with inventory, plan, and PR history
GET /api/migration/agent/:id/plan — Get just the migration plan and dependency map
POST /api/migration/agent/:id/cancel — Cancel a running migration agent

Natural Language Console

POST /api/nl/query — Parse natural language query with AI. Body: { query: string, provider?: string, model?: string, mode?: "local"|"ai" }. Returns matched intent, action, params.
POST /api/nl/match — Quick keyword-based intent matching (no AI). Body: { query: string }
GET /api/nl/intents — List all available intent definitions and their mapped API endpoints

Predictive Models

GET /api/predictive/timeline-forecast — Forecast when quantum hardware reaches target qubit count. Query: ?targetQubits=20000000
GET /api/predictive/mttr-forecast — Forecast MTTR trend with severity breakdown. Query: ?forecastDays=30
GET /api/predictive/risk-trajectory — Project risk score trajectory and estimate compliance date. Query: ?targetScore=80
GET /api/predictive/overview — Combined forecast overview for RSA-2048 and ECDSA timeline projections

Parallel Sweep Engine

POST /api/sweep/start — Launch org-wide parallel sweep. Body: { type: "code"|"tls"|"supply-chain"|"full", targets: [...], concurrency?: number }. Returns 202 (fire-and-forget).
GET /api/sweep/:id — Get sweep job status and summary
GET /api/sweep/:id/results — Get paginated sweep results. Query: ?offset=0&limit=50
GET /api/sweeps — List sweep jobs for tenant. Query: ?limit=50

Migration Optimizer

GET /api/migration/strategies — List available optimization strategies (risk-first, effort-first, dependency-first, balanced)
POST /api/migration/optimize — Evaluate all strategies against findings. Body: { findings: [...], strategies?: [...], maxSteps?: number }. Returns ranked plans with metrics.
POST /api/migration/compare — Compare two strategies side by side. Body: { findings: [...], strategyA: string, strategyB: string }

PQC Readiness Maturity Model

GET /api/maturity-model — Assess PQC readiness across 5 dimensions (governance, inventory, crypto-agility, vendor management, implementation). Returns overall level (1-5), weighted score (0-100), radar chart data, and prioritized next actions.

PQC Solution Scoring Registry

GET /api/pqc-registry — Full registry of PQC implementations scored across 10 quality dimensions. Query: ?algorithm=ML-KEM-768&sort=composite_desc
GET /api/pqc-registry/:id — Single implementation detail with dimension breakdown
POST /api/pqc-registry/compare — Side-by-side comparison. Body: { ids: ["liboqs", "aws-lc"] }

Public APIs (No Authentication Required)

POST /api/public/risk-calculator — Self-service quantum readiness assessment. Body: { industry, dataSensitivity, algorithms, dataRetention, complianceReqs, cloudProviders, pqcMigrationStatus }. Returns score (0-100), rating, breakdown, recommendations.
GET /api/public/trust-center — Platform security posture, compliance frameworks, encryption standards, and live platform statistics
GET /api/public/pqc-leaderboard — Top 10 PQC implementations by composite score (public view)

SDKs

QCrypton provides native SDKs for 6 languages:

Python

pip install qcrypton

from qcrypton import QCryptonClient
client = QCryptonClient('http://localhost:3000', api_key='your-key')

# Scan for injection
result = client.scan_injection(user_input)

# Assess quantum attack cost
cost = client.assess('RSA-2048')

Go

go get github.com/qcrypton/qcrypton-go

client := qcrypton.NewClient("http://localhost:3000", "your-key")
result, err := client.ScanInjection(input)

Java

// Maven: com.qcrypton:qcrypton-java
QCryptonClient client = new QCryptonClient("http://localhost:3000", "your-key");
ScanResult result = client.scanInjection(input);

Ruby

gem install qcrypton

client = QCrypton::Client.new('http://localhost:3000', api_key: 'your-key')
result = client.scan_injection(input)

Rust

// Cargo.toml: qcrypton = "1.0"
let client = QCryptonClient::new("http://localhost:3000", "your-key");
let result = client.scan_injection(&input).await?;

Node.js

const { DefenderClient } = require('qcrypton');
const client = new DefenderClient('http://localhost:3000');

// Or use in-process with zero HTTP overhead
const { scanners, remediate } = require('qcrypton');
const result = scanners.injection.scan(input);

Authentication

All API requests require authentication via API key or Bearer token:

curl -H "Authorization: Bearer YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"input": "test"}' \
     https://api.qcrypton.com/scan/injection

Rate Limits

API rate limits vary by plan:

Starter: 1,000 requests/hour
Large: 10,000 requests/hour
Enterprise: Custom limits

CI/CD Integration

QCrypton provides ready-made templates for GitHub Actions and Jenkins.

GitHub Actions

# .github/workflows/qcrypton.yml
name: QCrypton Security Scan
on: [pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm install -g qcrypton
      - run: qcrypton gate . --fail-on-weak --sarif results.sarif
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

Jenkins

// Jenkinsfile
pipeline {
  agent any
  stages {
    stage('Security Scan') {
      steps {
        sh 'npm install -g qcrypton'
        sh 'qcrypton gate . --fail-on-weak'
      }
    }
  }
}

Need Help?

If you need assistance with integration, reach out to support@qcryptonapp.com or file an issue on GitHub.