quantumscan
Post-quantum cryptography (PQC) vulnerability scanner for GitHub, GitLab, and Bitbucket repositories.
Community: Submitted by a user or imported; check the owner before granting accessOnlineNo sign-inGlobalFreeCan modify data
What it can do
- Scan Repository: Submit a GitHub, GitLab, or Bitbucket repository for post-quantum cryptography (PQC) vulnerability scanning. Returns a scan_id. Call get_scan_result to poll for the result. Free tier:
- Get Scan Result: Get the result of a previously submitted scan. Returns status (submitted | working | completed | failed) and, when completed, a full CBOM (Cryptographic Bill of Materials) compliant w
- Check Pqc Risk: Instant check (no DB, no scan) — returns whether a list of algorithm names are quantum-vulnerable. Useful for quick risk assessment before calling scan_repository. Rate-limited: 100 ca
What data it sees
Do you need an account
No: the server works without sign-in
Post-quantum cryptography (PQC) vulnerability scanner for GitHub, GitLab, and Bitbucket repositories. Detects ECDSA, RSA, AES-128, and other quantum-vulnerable algorithms. Returns risk score 0-100, CBOM (CycloneDX 1.6), and migration paths to NIST FIPS 203/204/205 standards (ML-KEM, ML-DSA, SLH-DSA). Also scans Ethereum smart contracts for PQC vulnerabilities and fraud patterns. Free tier: 10 scans/day per IP, no key required.
Server tool list (4)
Raw names from tools/list. Only developers need these.
| scan_repository | Submit a GitHub, GitLab, or Bitbucket repository for post-quantum cryptography (PQC) vulnerability scanning. Returns a scan_id. Call get_scan_result to poll for the result. Free tier: 10 scans/day per IP. Paid tier: credit-based (register at /api/agent/register). |
| get_scan_result | Get the result of a previously submitted scan. Returns status (submitted | working | completed | failed) and, when completed, a full CBOM (Cryptographic Bill of Materials) compliant with EIP-7789 and CycloneDX CBOM 1.6, plus a quantum risk score (0 = fully safe, 100 = fully vulnerable). Rate-limited: 60 calls/min per IP or API key. |
| check_pqc_risk | Instant check (no DB, no scan) — returns whether a list of algorithm names are quantum-vulnerable. Useful for quick risk assessment before calling scan_repository. Rate-limited: 100 calls/day per IP (free), 500/day per API key (paid). |
| scan_contract | Scan a verified on-chain smart contract for quantum-vulnerable cryptography AND today's fraud patterns (rug pulls, honeypots, uncapped mints, reentrancy). Use this BEFORE signing a transaction, interacting with a DeFi protocol, or integrating a contract into an agent workflow. Synchronous — result is immediate (no polling needed). Requires the contract to be verified on Sourcify (https://sourcify.dev). Returns risk score 0-100, agent risk score, finding breakdown, and concrete PQC migration steps. Rate-limited: same as scan_repository (10/day per IP free, credit-based paid). |