@heossi/qnsi-mcp 0.1.4

package/LICENSE

@@ -0,0 +1,8 @@
+# QNSP Licensing
+
+This repository is **multi-licensed**.
+
+- Source code under `packages/*` and selected `apps/*` directories is licensed **per package**. Refer to the `LICENSE` file inside each package directory.
+- Public SDK packages (those with `publishConfig.access: "public"`) are licensed under the **Apache License 2.0**.
+- Core platform packages (including `apps/ai-orchestrator` and `packages/kms`, and `packages/liboqs-native`) are licensed under the **Business Source License 1.1** with a Change License of **GPL-2.0-or-later**.
+- Materials under `docs/patent-ip-candidates` are **Proprietary**.

package/README.md

@@ -0,0 +1,183 @@
+# @heossi/qnsi-mcp
+
+[![npm version](https://img.shields.io/npm/v/@heossi/qnsi-mcp.svg)](https://www.npmjs.com/package/@heossi/qnsi-mcp)
+[![npm downloads](https://img.shields.io/npm/dm/@heossi/qnsi-mcp.svg)](https://www.npmjs.com/package/@heossi/qnsi-mcp)
+[![license](https://img.shields.io/npm/l/@heossi/qnsi-mcp.svg)](./LICENSE)
+
+**Official QNSP Model Context Protocol server** — give Claude, Cursor, Windsurf,
+and any MCP-compatible agent first-class access to a production post-quantum
+cryptography platform: FIPS 203 / 204 / 205 key management, a quantum-safe
+vault, a cryptographic bill of materials (CBOM), searchable encrypted storage,
+and immutable audit trails — tenant-scoped and tier-gated end-to-end.
+
+> **Free tier available.** Get an API key at
+> <https://cloud.qnsp.cuilabs.io/signup?src=mcp> — no credit card.
+
+---
+
+## Why install this?
+
+Your agent can now:
+
+- Generate and rotate NIST-standardised PQC keys (ML-KEM, ML-DSA, SLH-DSA, Falcon).
+- Store secrets in a quantum-safe vault with per-tenant envelope encryption.
+- Scan your infrastructure's cryptographic posture (CBOM) and score PQC readiness.
+- Query an immutable, hash-chained audit log for any tenant action.
+- Run searchable symmetric-encryption (SSE-X) queries over encrypted documents.
+- Report tenant tier, quota, and billing status without leaving the chat.
+
+Every call is tenant-scoped, entitlement-enforced on the server, and billable
+against your QNSP plan.
+
+---
+
+## Install
+
+### Claude Desktop
+
+Add to `~/Library/Application Support/Claude/claude_desktop_config.json`
+(macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows):
+
+```json
+{
+  "mcpServers": {
+    "qnsp": {
+      "command": "npx",
+      "args": ["-y", "@heossi/qnsi-mcp"],
+      "env": {
+        "QNSP_API_KEY": "qnsp_pqc_api_..."
+      }
+    }
+  }
+}
+```
+
+### Cursor
+
+Add to `~/.cursor/mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "qnsp": {
+      "command": "npx",
+      "args": ["-y", "@heossi/qnsi-mcp"],
+      "env": { "QNSP_API_KEY": "qnsp_pqc_api_..." }
+    }
+  }
+}
+```
+
+### Windsurf
+
+Add to `~/.codeium/windsurf/mcp_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "qnsp": {
+      "command": "npx",
+      "args": ["-y", "@heossi/qnsi-mcp"],
+      "env": { "QNSP_API_KEY": "qnsp_pqc_api_..." }
+    }
+  }
+}
+```
+
+### VS Code (GitHub Copilot / Continue)
+
+Add to `.vscode/mcp.json` (workspace) or the user-level MCP config:
+
+```json
+{
+  "servers": {
+    "qnsp": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "@heossi/qnsi-mcp"],
+      "env": { "QNSP_API_KEY": "qnsp_pqc_api_..." }
+    }
+  }
+}
+```
+
+### CLI (any MCP client)
+
+```bash
+npm install -g @heossi/qnsi-mcp
+export QNSP_API_KEY="qnsp_pqc_api_..."
+qnsp-mcp
+```
+
+---
+
+## Tools exposed
+
+All tools are registered with the `qnsp_` namespace prefix so they never
+collide with tools from other MCP servers an agent may have enabled.
+
+| Tool | Description | Tier |
+|---|---|---|
+| `qnsp_kms_generate_key` | Generate a PQC keypair (ML-KEM, ML-DSA, SLH-DSA, Falcon). | Dev+ |
+| `qnsp_kms_list_keys` | List keys in the current tenant. | Dev+ |
+| `qnsp_kms_get_key` | Retrieve a key's public metadata. | Dev+ |
+| `qnsp_kms_rotate_key` | Rotate a key; previous version retained for verification. | Dev+ |
+| `qnsp_vault_create_secret` | Store a secret under PQC envelope encryption. | Pro+ |
+| `qnsp_vault_get_secret` | Retrieve a vault secret. | Pro+ |
+| `qnsp_vault_list_secrets` | List secrets in the tenant. | Pro+ |
+| `qnsp_crypto_scan` | Trigger a cryptographic discovery job (CBOM). | Dev+ |
+| `qnsp_crypto_inventory` | List recent inventory jobs and results. | Dev+ |
+| `qnsp_crypto_readiness` | PQC-readiness scorecard for the tenant. | Dev+ |
+| `qnsp_audit_query` | Query the immutable, hash-chained audit log. | Dev+ |
+| `qnsp_search_query` | Searchable symmetric-encryption (SSE-X) query. | Business+ |
+| `qnsp_tenant_info` | Show current tenant configuration. | Dev+ |
+| `qnsp_billing_status` | Show tier, limits, and upgrade URL. | Any |
+| `qnsp_platform_health` | Platform liveness and regional posture. | Any |
+
+If your tier does not include a feature, the tool returns a clear upgrade
+message with a deep link to <https://cloud.qnsp.cuilabs.io/billing>.
+
+---
+
+## Configuration
+
+| Env var | Required | Default | Purpose |
+|---|---|---|---|
+| `QNSP_API_KEY` | yes | — | Tenant-scoped API key. Create one at <https://cloud.qnsp.cuilabs.io/api-keys>. |
+| `QNSP_PLATFORM_URL` | no | `https://api.qnsp.cuilabs.io` | Point at a staging or self-hosted edge gateway. |
+
+---
+
+## How it works
+
+On start, the server calls `@heossi/qnsi-sdk-activation` to resolve the API key into a
+tenant, tier, and feature-flag set. Every tool invocation is:
+
+1. **Gated client-side** by the resolved tier (fails fast with a human-readable
+   upgrade prompt instead of a raw 402/403).
+2. **Enforced server-side** by the QNSP edge gateway and PDP — the client-side
+   gate is a UX optimization, not the security boundary.
+3. **Audited** as an immutable hash-chained event in the QNSP audit log.
+
+No data is cached locally; every call is a round-trip to your tenant.
+
+---
+
+## Security
+
+- API keys are transmitted over TLS 1.3 (hybrid-PQC negotiation where
+  supported) to `api.qnsp.cuilabs.io` and never logged.
+- Tool output is JSON — the server never embeds raw secret material into
+  natural-language responses unless the tool semantics require it.
+- Report vulnerabilities to <security@cuilabs.io>.
+
+---
+
+## Links
+
+- **Docs:** <https://docs.qnsp.cuilabs.io/sdk/mcp-server>
+- **Cloud console:** <https://cloud.qnsp.cuilabs.io>
+- **Pricing:** <https://qnsp.cuilabs.io/pricing>
+- **Issues:** <https://github.com/heossi-hq/qnsp-public/issues>
+
+Apache-2.0 © HEOSSI (PTE.) LTD.

package/dist/api-client.d.ts

@@ -0,0 +1,36 @@
+/**
+ * QNSP API Client
+ *
+ * Thin HTTP client for calling QNSP platform APIs through the edge gateway.
+ * All requests include the API key as Bearer token and tenant ID header.
+ * The edge gateway handles entitlement enforcement, quota checks, and PQC signing.
+ */
+export interface ApiClientConfig {
+    readonly baseUrl: string;
+    readonly apiKey: string;
+    readonly tenantId: string;
+    readonly timeoutMs?: number;
+}
+export interface ApiResponse<T = unknown> {
+    readonly ok: boolean;
+    readonly status: number;
+    readonly data: T;
+}
+export declare class ApiClient {
+    private readonly baseUrl;
+    private readonly apiKey;
+    private readonly tenantId;
+    private readonly timeoutMs;
+    constructor(config: ApiClientConfig);
+    get<T = unknown>(path: string): Promise<ApiResponse<T>>;
+    post<T = unknown>(path: string, body?: unknown): Promise<ApiResponse<T>>;
+    patch<T = unknown>(path: string, body?: unknown): Promise<ApiResponse<T>>;
+    del<T = unknown>(path: string): Promise<ApiResponse<T>>;
+    private request;
+}
+export declare class QnspApiError extends Error {
+    readonly statusCode: number;
+    readonly body: unknown;
+    constructor(message: string, statusCode: number, body: unknown);
+}
+//# sourceMappingURL=api-client.d.ts.map

package/dist/api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,OAAO;IACvC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;CACjB;AAED,qBAAa,SAAS;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,MAAM,EAAE,eAAe;IAO7B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAIvD,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAIxE,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAIzE,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YAI/C,OAAO;CAoCrB;AAED,qBAAa,YAAa,SAAQ,KAAK;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;gBAEX,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO;CAM9D"}

package/dist/api-client.js

@@ -0,0 +1,75 @@
+/**
+ * QNSP API Client
+ *
+ * Thin HTTP client for calling QNSP platform APIs through the edge gateway.
+ * All requests include the API key as Bearer token and tenant ID header.
+ * The edge gateway handles entitlement enforcement, quota checks, and PQC signing.
+ */
+const DEFAULT_TIMEOUT_MS = 15_000;
+export class ApiClient {
+    baseUrl;
+    apiKey;
+    tenantId;
+    timeoutMs;
+    constructor(config) {
+        this.baseUrl = config.baseUrl.replace(/\/$/, "");
+        this.apiKey = config.apiKey;
+        this.tenantId = config.tenantId;
+        this.timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    }
+    async get(path) {
+        return this.request("GET", path);
+    }
+    async post(path, body) {
+        return this.request("POST", path, body);
+    }
+    async patch(path, body) {
+        return this.request("PATCH", path, body);
+    }
+    async del(path) {
+        return this.request("DELETE", path);
+    }
+    async request(method, path, body) {
+        const url = `${this.baseUrl}${path}`;
+        const headers = {
+            authorization: `Bearer ${this.apiKey}`,
+            "x-qnsp-tenant": this.tenantId,
+            "x-qnsp-tenant-id": this.tenantId,
+            "x-tenant-id": this.tenantId,
+            "content-type": "application/json",
+            "user-agent": "qnsp-mcp-server/0.1.0",
+        };
+        const response = await fetch(url, {
+            method,
+            headers,
+            ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+            signal: AbortSignal.timeout(this.timeoutMs),
+        });
+        const text = await response.text();
+        let data;
+        try {
+            data = JSON.parse(text);
+        }
+        catch {
+            data = text;
+        }
+        if (!response.ok) {
+            const msg = typeof data === "object" && data !== null && "message" in data
+                ? String(data["message"])
+                : `HTTP ${response.status}`;
+            throw new QnspApiError(msg, response.status, data);
+        }
+        return { ok: true, status: response.status, data };
+    }
+}
+export class QnspApiError extends Error {
+    statusCode;
+    body;
+    constructor(message, statusCode, body) {
+        super(message);
+        this.name = "QnspApiError";
+        this.statusCode = statusCode;
+        this.body = body;
+    }
+}
+//# sourceMappingURL=api-client.js.map

package/dist/api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAelC,MAAM,OAAO,SAAS;IACJ,OAAO,CAAS;IAChB,MAAM,CAAS;IACf,QAAQ,CAAS;IACjB,SAAS,CAAS;IAEnC,YAAY,MAAuB;QAClC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,GAAG,CAAc,IAAY;QAClC,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,IAAI,CAAc,IAAY,EAAE,IAAc;QACnD,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,KAAK,CAAc,IAAY,EAAE,IAAc;QACpD,OAAO,IAAI,CAAC,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,GAAG,CAAc,IAAY;QAClC,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACpE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,MAAM,OAAO,GAA2B;YACvC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;YACtC,eAAe,EAAE,IAAI,CAAC,QAAQ;YAC9B,kBAAkB,EAAE,IAAI,CAAC,QAAQ;YACjC,aAAa,EAAE,IAAI,CAAC,QAAQ;YAC5B,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,uBAAuB;SACrC,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACjC,MAAM;YACN,OAAO;YACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;SAC3C,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,IAAO,CAAC;QACZ,IAAI,CAAC;YACJ,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACR,IAAI,GAAG,IAAoB,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,GAAG,GACR,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,SAAS,IAAI,IAAI;gBAC7D,CAAC,CAAC,MAAM,CAAE,IAAgC,CAAC,SAAS,CAAC,CAAC;gBACtD,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;CACD;AAED,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC7B,UAAU,CAAS;IACnB,IAAI,CAAU;IAEvB,YAAY,OAAe,EAAE,UAAkB,EAAE,IAAa;QAC7D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD"}

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+/**
+ * QNSP MCP Server
+ *
+ * Post-quantum cryptography tools for AI assistants.
+ * Connects to the QNSP platform via edge gateway, authenticates with an API key,
+ * and exposes tier-gated tools for KMS, Vault, Crypto Inventory, Audit, Search,
+ * and platform management.
+ *
+ * Usage (stdio):
+ *   QNSP_API_KEY=your-key qnsp-mcp
+ *
+ * Configuration:
+ *   QNSP_API_KEY          — Required. Get one at https://cloud.qnsp.cuilabs.io/api-keys
+ *   QNSP_PLATFORM_URL     — Optional. Defaults to https://api.qnsp.cuilabs.io
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/**
+ * Smithery sandbox server for capability scanning.
+ * Returns a server with all tools registered using a no-op context
+ * so Smithery can discover tool definitions without real credentials.
+ */
+export declare function createSandboxServer(): McpServer;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAmHpE;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,SAAS,CAuB/C"}

package/dist/index.js

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+/**
+ * QNSP MCP Server
+ *
+ * Post-quantum cryptography tools for AI assistants.
+ * Connects to the QNSP platform via edge gateway, authenticates with an API key,
+ * and exposes tier-gated tools for KMS, Vault, Crypto Inventory, Audit, Search,
+ * and platform management.
+ *
+ * Usage (stdio):
+ *   QNSP_API_KEY=your-key qnsp-mcp
+ *
+ * Configuration:
+ *   QNSP_API_KEY          — Required. Get one at https://cloud.qnsp.cuilabs.io/api-keys
+ *   QNSP_PLATFORM_URL     — Optional. Defaults to https://api.qnsp.cuilabs.io
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { ApiClient } from "./api-client.js";
+import { SessionManager } from "./session.js";
+import * as tools from "./tools.js";
+const PACKAGE_VERSION = "0.1.0";
+function registerTools(server, ctx) {
+    server.tool("qnsp_kms_generate_key", "Generate a new post-quantum cryptographic key pair. Supports ML-KEM (Kyber), ML-DSA (Dilithium), Falcon, SPHINCS+, and the full 93-algorithm QNSP PQC catalog.", {
+        algorithm: tools.kmsGenerateKeySchema.shape.algorithm,
+        label: tools.kmsGenerateKeySchema.shape.label,
+        metadata: tools.kmsGenerateKeySchema.shape.metadata,
+    }, async (input) => tools.kmsGenerateKey(ctx, tools.kmsGenerateKeySchema.parse(input)));
+    server.tool("qnsp_kms_list_keys", "List PQC keys in your tenant's key store.", { limit: tools.kmsListKeysSchema.shape.limit }, async (input) => tools.kmsListKeys(ctx, tools.kmsListKeysSchema.parse(input)));
+    server.tool("qnsp_kms_get_key", "Get details of a specific PQC key by ID.", { keyId: tools.kmsGetKeySchema.shape.keyId }, async (input) => tools.kmsGetKey(ctx, tools.kmsGetKeySchema.parse(input)));
+    server.tool("qnsp_kms_rotate_key", "Rotate a PQC key — generates a new version while preserving the key ID.", { keyId: tools.kmsRotateKeySchema.shape.keyId }, async (input) => tools.kmsRotateKey(ctx, tools.kmsRotateKeySchema.parse(input)));
+    server.tool("qnsp_vault_create_secret", "Store a secret in the quantum-safe encrypted vault.", {
+        name: tools.vaultCreateSecretSchema.shape.name,
+        value: tools.vaultCreateSecretSchema.shape.value,
+        metadata: tools.vaultCreateSecretSchema.shape.metadata,
+    }, async (input) => tools.vaultCreateSecret(ctx, tools.vaultCreateSecretSchema.parse(input)));
+    server.tool("qnsp_vault_get_secret", "Retrieve a secret from the quantum-safe vault by ID.", { secretId: tools.vaultGetSecretSchema.shape.secretId }, async (input) => tools.vaultGetSecret(ctx, tools.vaultGetSecretSchema.parse(input)));
+    server.tool("qnsp_vault_list_secrets", "List secrets in the quantum-safe vault.", { limit: tools.vaultListSecretsSchema.shape.limit }, async (input) => tools.vaultListSecrets(ctx, tools.vaultListSecretsSchema.parse(input)));
+    server.tool("qnsp_crypto_scan", "Run a cryptographic inventory scan (CBOM). Discovers all PQC and classical crypto assets.", { scope: tools.cryptoScanSchema.shape.scope }, async (input) => tools.cryptoScan(ctx, tools.cryptoScanSchema.parse(input)));
+    server.tool("qnsp_crypto_inventory", "List cryptographic assets in the inventory (Cryptographic Bill of Materials).", { limit: tools.cryptoInventorySchema.shape.limit }, async (input) => tools.cryptoInventory(ctx, tools.cryptoInventorySchema.parse(input)));
+    server.tool("qnsp_crypto_readiness", "Check post-quantum readiness status — identifies vulnerable algorithms and migration paths.", {}, async (input) => tools.cryptoReadiness(ctx, tools.cryptoReadinessSchema.parse(input)));
+    server.tool("qnsp_audit_query", "Query the immutable audit trail. Filter by topic, source service, or time range.", {
+        topic: tools.auditQuerySchema.shape.topic,
+        sourceService: tools.auditQuerySchema.shape.sourceService,
+        limit: tools.auditQuerySchema.shape.limit,
+    }, async (input) => tools.auditQuery(ctx, tools.auditQuerySchema.parse(input)));
+    server.tool("qnsp_search_query", "Search encrypted documents using SSE-X (Server-Side Encryption with eXtended PQC). Requires dev-pro tier or higher.", { query: tools.searchQuerySchema.shape.query, limit: tools.searchQuerySchema.shape.limit }, async (input) => tools.searchQuery(ctx, tools.searchQuerySchema.parse(input)));
+    server.tool("qnsp_tenant_info", "Get your tenant information — plan, region, crypto policy, and metadata.", {}, async (input) => tools.tenantInfo(ctx, tools.tenantInfoSchema.parse(input)));
+    server.tool("qnsp_billing_status", "Check your current billing tier, feature limits, and upgrade options.", {}, async (input) => tools.billingStatus(ctx, tools.billingStatusSchema.parse(input)));
+    server.tool("qnsp_platform_health", "Check QNSP platform health status across all services.", {}, async (input) => tools.platformHealth(ctx, tools.platformHealthSchema.parse(input)));
+}
+/**
+ * Smithery sandbox server for capability scanning.
+ * Returns a server with all tools registered using a no-op context
+ * so Smithery can discover tool definitions without real credentials.
+ */
+export function createSandboxServer() {
+    const noopApi = new ApiClient({
+        baseUrl: "https://api.qnsp.cuilabs.io",
+        apiKey: "sandbox",
+        tenantId: "sandbox",
+    });
+    const sandboxGate = {
+        hasFeature: () => true,
+        tier: "sandbox",
+        tenantId: "sandbox",
+        limits: {
+            storageGB: 0,
+            apiCalls: 0,
+            enclavesEnabled: true,
+            aiTrainingEnabled: true,
+            aiInferenceEnabled: true,
+            sseEnabled: true,
+            vaultEnabled: true,
+        },
+    };
+    const server = new McpServer({ name: "qnsp", version: PACKAGE_VERSION });
+    registerTools(server, { api: noopApi, gate: sandboxGate });
+    return server;
+}
+function getRequiredEnv(name) {
+    const value = process.env[name];
+    if (!value || value.length === 0) {
+        process.stderr.write(`Error: ${name} is required. Get your free API key at https://cloud.qnsp.cuilabs.io/api-keys\n`);
+        process.exit(1);
+    }
+    return value;
+}
+async function main() {
+    const apiKey = getRequiredEnv("QNSP_API_KEY");
+    const platformUrl = process.env["QNSP_PLATFORM_URL"] ?? "https://api.qnsp.cuilabs.io";
+    // Activate SDK session — resolves API key → tenant ID → tier → limits
+    const session = new SessionManager({ apiKey, platformUrl });
+    const gate = await session.activate();
+    // Create API client for edge gateway calls
+    const api = new ApiClient({
+        baseUrl: platformUrl,
+        apiKey,
+        tenantId: gate.tenantId,
+    });
+    const ctx = { api, gate };
+    const server = new McpServer({ name: "qnsp", version: PACKAGE_VERSION });
+    registerTools(server, ctx);
+    // Start stdio transport
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+// Only run the stdio server when QNSP_API_KEY is set.
+// When Smithery imports this module for capability scanning, it calls
+// createSandboxServer() instead — no API key needed for tool discovery.
+if (process.env["QNSP_API_KEY"]) {
+    main().catch((error) => {
+        process.stderr.write(`QNSP MCP Server fatal error: ${error instanceof Error ? error.message : String(error)}\n`);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AAEpC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEhC,SAAS,aAAa,CAAC,MAAiB,EAAE,GAAgB;IACzD,MAAM,CAAC,IAAI,CACV,uBAAuB,EACvB,gKAAgK,EAChK;QACC,SAAS,EAAE,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS;QACrD,KAAK,EAAE,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK;QAC7C,QAAQ,EAAE,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,QAAQ;KACnD,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACnF,CAAC;IACF,MAAM,CAAC,IAAI,CACV,oBAAoB,EACpB,2CAA2C,EAC3C,EAAE,KAAK,EAAE,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,EAC9C,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAC7E,CAAC;IACF,MAAM,CAAC,IAAI,CACV,kBAAkB,EAClB,0CAA0C,EAC1C,EAAE,KAAK,EAAE,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,EAC5C,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACzE,CAAC;IACF,MAAM,CAAC,IAAI,CACV,qBAAqB,EACrB,yEAAyE,EACzE,EAAE,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,EAAE,EAC/C,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAC/E,CAAC;IACF,MAAM,CAAC,IAAI,CACV,0BAA0B,EAC1B,qDAAqD,EACrD;QACC,IAAI,EAAE,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,IAAI;QAC9C,KAAK,EAAE,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,KAAK;QAChD,QAAQ,EAAE,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,QAAQ;KACtD,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACzF,CAAC;IACF,MAAM,CAAC,IAAI,CACV,uBAAuB,EACvB,sDAAsD,EACtD,EAAE,QAAQ,EAAE,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,QAAQ,EAAE,EACvD,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACnF,CAAC;IACF,MAAM,CAAC,IAAI,CACV,yBAAyB,EACzB,yCAAyC,EACzC,EAAE,KAAK,EAAE,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,EAAE,EACnD,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACvF,CAAC;IACF,MAAM,CAAC,IAAI,CACV,kBAAkB,EAClB,2FAA2F,EAC3F,EAAE,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,EAC7C,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAC3E,CAAC;IACF,MAAM,CAAC,IAAI,CACV,uBAAuB,EACvB,+EAA+E,EAC/E,EAAE,KAAK,EAAE,KAAK,CAAC,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,EAClD,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACrF,CAAC;IACF,MAAM,CAAC,IAAI,CACV,uBAAuB,EACvB,6FAA6F,EAC7F,EAAE,EACF,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACrF,CAAC;IACF,MAAM,CAAC,IAAI,CACV,kBAAkB,EAClB,kFAAkF,EAClF;QACC,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK;QACzC,aAAa,EAAE,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,aAAa;QACzD,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK;KACzC,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAC3E,CAAC;IACF,MAAM,CAAC,IAAI,CACV,mBAAmB,EACnB,qHAAqH,EACrH,EAAE,KAAK,EAAE,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,EAC1F,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAC7E,CAAC;IACF,MAAM,CAAC,IAAI,CACV,kBAAkB,EAClB,0EAA0E,EAC1E,EAAE,EACF,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAC3E,CAAC;IACF,MAAM,CAAC,IAAI,CACV,qBAAqB,EACrB,uEAAuE,EACvE,EAAE,EACF,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACjF,CAAC;IACF,MAAM,CAAC,IAAI,CACV,sBAAsB,EACtB,wDAAwD,EACxD,EAAE,EACF,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACnF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IAClC,MAAM,OAAO,GAAG,IAAI,SAAS,CAAC;QAC7B,OAAO,EAAE,6BAA6B;QACtC,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,SAAS;KACnB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG;QACnB,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;QACtB,IAAI,EAAE,SAAkB;QACxB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE;YACP,SAAS,EAAE,CAAC;YACZ,QAAQ,EAAE,CAAC;YACX,eAAe,EAAE,IAAI;YACrB,iBAAiB,EAAE,IAAI;YACvB,kBAAkB,EAAE,IAAI;YACxB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;SAClB;KACD,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;IACzE,aAAa,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,UAAU,IAAI,iFAAiF,CAC/F,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,KAAK,UAAU,IAAI;IAClB,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,6BAA6B,CAAC;IAEtF,sEAAsE;IACtE,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAEtC,2CAA2C;IAC3C,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;QACzB,OAAO,EAAE,WAAW;QACpB,MAAM;QACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACvB,CAAC,CAAC;IAEH,MAAM,GAAG,GAAgB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAEvC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;IACzE,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE3B,wBAAwB;IACxB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,sDAAsD;AACtD,sEAAsE;AACtE,wEAAwE;AACxE,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;IACjC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAC1F,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/session.d.ts

@@ -0,0 +1,34 @@
+/**
+ * QNSP MCP Session Manager
+ *
+ * Handles SDK activation (API key → tenant ID → tier → limits) and provides
+ * tier-gated access checks for MCP tools. All tier limits are resolved from billing-service
+ * via the SDK activation endpoint at runtime.
+ */
+import { type SdkActivationResponse } from "@heossi/qnsi/activation";
+export interface SessionConfig {
+    readonly apiKey: string;
+    readonly platformUrl?: string;
+}
+export interface TierGate {
+    /** Check if a boolean feature is enabled for the current tier */
+    hasFeature(feature: "enclavesEnabled" | "aiTrainingEnabled" | "aiInferenceEnabled" | "sseEnabled" | "vaultEnabled"): boolean;
+    /** Get the current tier name */
+    readonly tier: string;
+    /** Get the tenant ID */
+    readonly tenantId: string;
+    /** Get the raw limits from billing-service */
+    readonly limits: SdkActivationResponse["limits"];
+}
+export declare class SessionManager {
+    private readonly apiKey;
+    private readonly platformUrl;
+    private activation;
+    constructor(config: SessionConfig);
+    activate(): Promise<TierGate>;
+    getTierGate(): TierGate;
+    get tenantId(): string;
+    get tier(): string;
+    get isActivated(): boolean;
+}
+//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAAe,KAAK,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAqBlF,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,QAAQ;IACxB,iEAAiE;IACjE,UAAU,CACT,OAAO,EACJ,iBAAiB,GACjB,mBAAmB,GACnB,oBAAoB,GACpB,YAAY,GACZ,cAAc,GACf,OAAO,CAAC;IACX,gCAAgC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wBAAwB;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;CACjD;AAED,qBAAa,cAAc;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,UAAU,CAAsC;gBAE5C,MAAM,EAAE,aAAa;IAK3B,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IAWnC,WAAW,IAAI,QAAQ;IAsBvB,IAAI,QAAQ,IAAI,MAAM,CAKrB;IAED,IAAI,IAAI,IAAI,MAAM,CAKjB;IAED,IAAI,WAAW,IAAI,OAAO,CAEzB;CACD"}

package/dist/session.js

@@ -0,0 +1,82 @@
+/**
+ * QNSP MCP Session Manager
+ *
+ * Handles SDK activation (API key → tenant ID → tier → limits) and provides
+ * tier-gated access checks for MCP tools. All tier limits are resolved from billing-service
+ * via the SDK activation endpoint at runtime.
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { activateSdk } from "@heossi/qnsi/activation";
+const DEFAULT_PLATFORM_URL = "https://api.qnsp.cuilabs.io";
+// Resolve own version from package.json so activation telemetry tracks the
+// actual published version of @heossi/qnsi-mcp, not an inline literal that
+// drifts every release. The compiled module lives at dist/session.js, so the
+// package.json is one directory up from dist/.
+function readOwnVersion() {
+    try {
+        const here = dirname(fileURLToPath(import.meta.url));
+        const pkgPath = join(here, "..", "package.json");
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+        return pkg.version ?? "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+const SDK_VERSION = readOwnVersion();
+export class SessionManager {
+    apiKey;
+    platformUrl;
+    activation = null;
+    constructor(config) {
+        this.apiKey = config.apiKey;
+        this.platformUrl = config.platformUrl ?? DEFAULT_PLATFORM_URL;
+    }
+    async activate() {
+        this.activation = await activateSdk({
+            apiKey: this.apiKey,
+            sdkId: "mcp-server",
+            sdkVersion: SDK_VERSION,
+            platformUrl: this.platformUrl,
+        });
+        return this.getTierGate();
+    }
+    getTierGate() {
+        if (!this.activation) {
+            throw new Error("Session not activated. Call activate() first.");
+        }
+        const activation = this.activation;
+        return {
+            hasFeature(feature) {
+                return activation.limits[feature] === true;
+            },
+            get tier() {
+                return activation.tier;
+            },
+            get tenantId() {
+                return activation.tenantId;
+            },
+            get limits() {
+                return activation.limits;
+            },
+        };
+    }
+    get tenantId() {
+        if (!this.activation) {
+            throw new Error("Session not activated. Call activate() first.");
+        }
+        return this.activation.tenantId;
+    }
+    get tier() {
+        if (!this.activation) {
+            throw new Error("Session not activated. Call activate() first.");
+        }
+        return this.activation.tier;
+    }
+    get isActivated() {
+        return this.activation !== null;
+    }
+}
+//# sourceMappingURL=session.js.map

package/dist/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,WAAW,EAA8B,MAAM,yBAAyB,CAAC;AAElF,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAE3D,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,+CAA+C;AAC/C,SAAS,cAAc;IACtB,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAyB,CAAC;QAC9E,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,OAAO,CAAC;IAChB,CAAC;AACF,CAAC;AAED,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;AAyBrC,MAAM,OAAO,cAAc;IACT,MAAM,CAAS;IACf,WAAW,CAAS;IAC7B,UAAU,GAAiC,IAAI,CAAC;IAExD,YAAY,MAAqB;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,QAAQ;QACb,IAAI,CAAC,UAAU,GAAG,MAAM,WAAW,CAAC;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,YAAY;YACnB,UAAU,EAAE,WAAW;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC7B,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC3B,CAAC;IAED,WAAW;QACV,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,OAAO;YACN,UAAU,CAAC,OAAO;gBACjB,OAAO,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;YAC5C,CAAC;YACD,IAAI,IAAI;gBACP,OAAO,UAAU,CAAC,IAAI,CAAC;YACxB,CAAC;YACD,IAAI,QAAQ;gBACX,OAAO,UAAU,CAAC,QAAQ,CAAC;YAC5B,CAAC;YACD,IAAI,MAAM;gBACT,OAAO,UAAU,CAAC,MAAM,CAAC;YAC1B,CAAC;SACD,CAAC;IACH,CAAC;IAED,IAAI,QAAQ;QACX,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;IACjC,CAAC;IAED,IAAI,IAAI;QACP,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED,IAAI,WAAW;QACd,OAAO,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC;IACjC,CAAC;CACD"}

package/dist/tools.d.ts

@@ -0,0 +1,89 @@
+/**
+ * QNSP MCP Tool Definitions
+ *
+ * Each tool maps to a QNSP platform API endpoint via the edge gateway.
+ * Tools are tier-gated: the session's TierGate checks feature availability
+ * before execution. The edge gateway enforces entitlements server-side as well,
+ * so client-side checks are a UX optimization (fail fast with a clear message
+ * instead of a raw 402/403).
+ */
+import { z } from "zod";
+import type { ApiClient } from "./api-client.js";
+import type { TierGate } from "./session.js";
+export interface ToolContext {
+    readonly api: ApiClient;
+    readonly gate: TierGate;
+}
+export interface ToolResult {
+    readonly content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    readonly isError?: boolean;
+    readonly [key: string]: unknown;
+}
+export declare const kmsGenerateKeySchema: z.ZodObject<{
+    algorithm: z.ZodString;
+    label: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+export declare function kmsGenerateKey(ctx: ToolContext, input: z.infer<typeof kmsGenerateKeySchema>): Promise<ToolResult>;
+export declare const kmsListKeysSchema: z.ZodObject<{
+    limit: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export declare function kmsListKeys(ctx: ToolContext, input: z.infer<typeof kmsListKeysSchema>): Promise<ToolResult>;
+export declare const kmsGetKeySchema: z.ZodObject<{
+    keyId: z.ZodString;
+}, z.core.$strip>;
+export declare function kmsGetKey(ctx: ToolContext, input: z.infer<typeof kmsGetKeySchema>): Promise<ToolResult>;
+export declare const kmsRotateKeySchema: z.ZodObject<{
+    keyId: z.ZodString;
+}, z.core.$strip>;
+export declare function kmsRotateKey(ctx: ToolContext, input: z.infer<typeof kmsRotateKeySchema>): Promise<ToolResult>;
+export declare const vaultCreateSecretSchema: z.ZodObject<{
+    name: z.ZodString;
+    value: z.ZodString;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+export declare function vaultCreateSecret(ctx: ToolContext, input: z.infer<typeof vaultCreateSecretSchema>): Promise<ToolResult>;
+export declare const vaultGetSecretSchema: z.ZodObject<{
+    secretId: z.ZodString;
+}, z.core.$strip>;
+export declare function vaultGetSecret(ctx: ToolContext, input: z.infer<typeof vaultGetSecretSchema>): Promise<ToolResult>;
+export declare const vaultListSecretsSchema: z.ZodObject<{
+    limit: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export declare function vaultListSecrets(ctx: ToolContext, input: z.infer<typeof vaultListSecretsSchema>): Promise<ToolResult>;
+export declare const cryptoScanSchema: z.ZodObject<{
+    scope: z.ZodOptional<z.ZodEnum<{
+        full: "full";
+        keys: "keys";
+        certificates: "certificates";
+        algorithms: "algorithms";
+    }>>;
+}, z.core.$strip>;
+export declare function cryptoScan(ctx: ToolContext, input: z.infer<typeof cryptoScanSchema>): Promise<ToolResult>;
+export declare const cryptoInventorySchema: z.ZodObject<{
+    limit: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export declare function cryptoInventory(ctx: ToolContext, input: z.infer<typeof cryptoInventorySchema>): Promise<ToolResult>;
+export declare const cryptoReadinessSchema: z.ZodObject<{}, z.core.$strip>;
+export declare function cryptoReadiness(ctx: ToolContext, _input: z.infer<typeof cryptoReadinessSchema>): Promise<ToolResult>;
+export declare const auditQuerySchema: z.ZodObject<{
+    topic: z.ZodOptional<z.ZodString>;
+    sourceService: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export declare function auditQuery(ctx: ToolContext, input: z.infer<typeof auditQuerySchema>): Promise<ToolResult>;
+export declare const searchQuerySchema: z.ZodObject<{
+    query: z.ZodString;
+    limit: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export declare function searchQuery(ctx: ToolContext, input: z.infer<typeof searchQuerySchema>): Promise<ToolResult>;
+export declare const tenantInfoSchema: z.ZodObject<{}, z.core.$strip>;
+export declare function tenantInfo(ctx: ToolContext, _input: z.infer<typeof tenantInfoSchema>): Promise<ToolResult>;
+export declare const billingStatusSchema: z.ZodObject<{}, z.core.$strip>;
+export declare function billingStatus(ctx: ToolContext, _input: z.infer<typeof billingStatusSchema>): Promise<ToolResult>;
+export declare const platformHealthSchema: z.ZodObject<{}, z.core.$strip>;
+export declare function platformHealth(ctx: ToolContext, _input: z.infer<typeof platformHealthSchema>): Promise<ToolResult>;
+//# sourceMappingURL=tools.d.ts.map

package/dist/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAChC;AA0BD,eAAO,MAAM,oBAAoB;;;;iBAQ/B,CAAC;AAEH,wBAAsB,cAAc,CACnC,GAAG,EAAE,WAAW,EAChB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,GACzC,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED,eAAO,MAAM,iBAAiB;;iBAE5B,CAAC;AAEH,wBAAsB,WAAW,CAChC,GAAG,EAAE,WAAW,EAChB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,GACtC,OAAO,CAAC,UAAU,CAAC,CAMrB;AAED,eAAO,MAAM,eAAe;;iBAE1B,CAAC;AAEH,wBAAsB,SAAS,CAC9B,GAAG,EAAE,WAAW,EAChB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,GACpC,OAAO,CAAC,UAAU,CAAC,CAKrB;AAED,eAAO,MAAM,kBAAkB;;iBAE7B,CAAC;AAEH,wBAAsB,YAAY,CACjC,GAAG,EAAE,WAAW,EAChB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,GACvC,OAAO,CAAC,UAAU,CAAC,CAMrB;AAID,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AAEH,wBAAsB,iBAAiB,CACtC,GAAG,EAAE,WAAW,EAChB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,GAC5C,OAAO,CAAC,UAAU,CAAC,CAWrB;AAED,eAAO,MAAM,oBAAoB;;iBAE/B,CAAC;AAEH,wBAAsB,cAAc,CACnC,GAAG,EAAE,WAAW,EAChB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,GACzC,OAAO,CAAC,UAAU,CAAC,CAMrB;AAED,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AAEH,wBAAsB,gBAAgB,CACrC,GAAG,EAAE,WAAW,EAChB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,GAC3C,OAAO,CAAC,UAAU,CAAC,CASrB;AAID,eAAO,MAAM,gBAAgB;;;;;;;iBAK3B,CAAC;AAEH,wBAAsB,UAAU,CAC/B,GAAG,EAAE,WAAW,EAChB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,GACrC,OAAO,CAAC,UAAU,CAAC,CAMrB;AAED,eAAO,MAAM,qBAAqB;;iBAEhC,CAAC;AAEH,wBAAsB,eAAe,CACpC,GAAG,EAAE,WAAW,EAChB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,GAC1C,OAAO,CAAC,UAAU,CAAC,CAMrB;AAED,eAAO,MAAM,qBAAqB,gCAAe,CAAC;AAElD,wBAAsB,eAAe,CACpC,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,GAC3C,OAAO,CAAC,UAAU,CAAC,CAGrB;AAID,eAAO,MAAM,gBAAgB;;;;iBAI3B,CAAC;AAEH,wBAAsB,UAAU,CAC/B,GAAG,EAAE,WAAW,EAChB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,GACrC,OAAO,CAAC,UAAU,CAAC,CAQrB;AAID,eAAO,MAAM,iBAAiB;;;iBAG5B,CAAC;AAEH,wBAAsB,WAAW,CAChC,GAAG,EAAE,WAAW,EAChB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,GACtC,OAAO,CAAC,UAAU,CAAC,CAUrB;AAID,eAAO,MAAM,gBAAgB,gCAAe,CAAC;AAE7C,wBAAsB,UAAU,CAC/B,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,GACtC,OAAO,CAAC,UAAU,CAAC,CAGrB;AAED,eAAO,MAAM,mBAAmB,gCAAe,CAAC;AAEhD,wBAAsB,aAAa,CAClC,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,GACzC,OAAO,CAAC,UAAU,CAAC,CAOrB;AAID,eAAO,MAAM,oBAAoB,gCAAe,CAAC;AAEjD,wBAAsB,cAAc,CACnC,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,GAC1C,OAAO,CAAC,UAAU,CAAC,CAGrB"}

package/dist/tools.js

@@ -0,0 +1,189 @@
+/**
+ * QNSP MCP Tool Definitions
+ *
+ * Each tool maps to a QNSP platform API endpoint via the edge gateway.
+ * Tools are tier-gated: the session's TierGate checks feature availability
+ * before execution. The edge gateway enforces entitlements server-side as well,
+ * so client-side checks are a UX optimization (fail fast with a clear message
+ * instead of a raw 402/403).
+ */
+import { z } from "zod";
+function text(value) {
+    return { content: [{ type: "text", text: value }] };
+}
+function json(value) {
+    return text(JSON.stringify(value, null, 2));
+}
+function gateError(feature, tier) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: `This feature requires a higher tier. Current tier: ${tier}. ` +
+                    `Upgrade at https://cloud.qnsp.cuilabs.io/billing to access ${feature}.`,
+            },
+        ],
+        isError: true,
+    };
+}
+// ── KMS Tools ───────────────────────────────────────────────────────────────
+export const kmsGenerateKeySchema = z.object({
+    algorithm: z
+        .string()
+        .describe("PQC algorithm (e.g. kyber-768, dilithium-2, falcon-512). See NIST FIPS 203/204/205."),
+    label: z.string().optional().describe("Human-readable key label"),
+    metadata: z.record(z.string(), z.string()).optional().describe("Key metadata tags"),
+});
+export async function kmsGenerateKey(ctx, input) {
+    const { data } = await ctx.api.post("/proxy/kms/v1/keys", {
+        tenantId: ctx.gate.tenantId,
+        algorithm: input.algorithm,
+        label: input.label ?? `mcp-${Date.now()}`,
+        metadata: input.metadata ?? {},
+    });
+    return json(data);
+}
+export const kmsListKeysSchema = z.object({
+    limit: z.number().int().min(1).max(100).optional().describe("Max keys to return (default 20)"),
+});
+export async function kmsListKeys(ctx, input) {
+    const limit = input.limit ?? 20;
+    const { data } = await ctx.api.get(`/proxy/kms/v1/keys?tenantId=${ctx.gate.tenantId}&limit=${limit}`);
+    return json(data);
+}
+export const kmsGetKeySchema = z.object({
+    keyId: z.string().describe("Key ID (UUID)"),
+});
+export async function kmsGetKey(ctx, input) {
+    const { data } = await ctx.api.get(`/proxy/kms/v1/keys/${input.keyId}?tenantId=${ctx.gate.tenantId}`);
+    return json(data);
+}
+export const kmsRotateKeySchema = z.object({
+    keyId: z.string().describe("Key ID to rotate"),
+});
+export async function kmsRotateKey(ctx, input) {
+    const { data } = await ctx.api.post(`/proxy/kms/v1/keys/${input.keyId}/rotate`, {
+        tenantId: ctx.gate.tenantId,
+        reason: "MCP rotation",
+    });
+    return json(data);
+}
+// ── Vault Tools ─────────────────────────────────────────────────────────────
+export const vaultCreateSecretSchema = z.object({
+    name: z.string().describe("Secret name (unique within tenant)"),
+    value: z.string().describe("Secret value to encrypt and store"),
+    metadata: z.record(z.string(), z.string()).optional().describe("Secret metadata"),
+});
+export async function vaultCreateSecret(ctx, input) {
+    if (!ctx.gate.hasFeature("vaultEnabled")) {
+        return gateError("Quantum-Safe Vault", ctx.gate.tier);
+    }
+    const { data } = await ctx.api.post("/proxy/vault/v1/secrets", {
+        tenantId: ctx.gate.tenantId,
+        name: input.name,
+        payload: Buffer.from(input.value).toString("base64"),
+        metadata: input.metadata ?? {},
+    });
+    return json(data);
+}
+export const vaultGetSecretSchema = z.object({
+    secretId: z.string().describe("Secret ID (UUID)"),
+});
+export async function vaultGetSecret(ctx, input) {
+    if (!ctx.gate.hasFeature("vaultEnabled")) {
+        return gateError("Quantum-Safe Vault", ctx.gate.tier);
+    }
+    const { data } = await ctx.api.get(`/proxy/vault/v1/secrets/${input.secretId}`);
+    return json(data);
+}
+export const vaultListSecretsSchema = z.object({
+    limit: z.number().int().min(1).max(100).optional().describe("Max secrets to return"),
+});
+export async function vaultListSecrets(ctx, input) {
+    if (!ctx.gate.hasFeature("vaultEnabled")) {
+        return gateError("Quantum-Safe Vault", ctx.gate.tier);
+    }
+    const limit = input.limit ?? 20;
+    const { data } = await ctx.api.get(`/proxy/vault/v1/secrets?tenantId=${ctx.gate.tenantId}&limit=${limit}`);
+    return json(data);
+}
+// ── Crypto Inventory (CBOM) Tools ───────────────────────────────────────────
+export const cryptoScanSchema = z.object({
+    scope: z
+        .enum(["full", "keys", "certificates", "algorithms"])
+        .optional()
+        .describe("Scan scope (default: full)"),
+});
+export async function cryptoScan(ctx, input) {
+    const scope = input.scope ?? "full";
+    const { data } = await ctx.api.get(`/proxy/crypto/v1/discovery/jobs?tenantId=${ctx.gate.tenantId}&limit=10&scope=${encodeURIComponent(scope)}`);
+    return json(data);
+}
+export const cryptoInventorySchema = z.object({
+    limit: z.number().int().min(1).max(100).optional().describe("Max items to return"),
+});
+export async function cryptoInventory(ctx, input) {
+    const limit = input.limit ?? 50;
+    const { data } = await ctx.api.get(`/proxy/crypto/v1/discovery/jobs?tenantId=${ctx.gate.tenantId}&limit=${limit}`);
+    return json(data);
+}
+export const cryptoReadinessSchema = z.object({});
+export async function cryptoReadiness(ctx, _input) {
+    const { data } = await ctx.api.get(`/proxy/crypto/v1/readiness?tenantId=${ctx.gate.tenantId}`);
+    return json(data);
+}
+// ── Audit Tools ─────────────────────────────────────────────────────────────
+export const auditQuerySchema = z.object({
+    topic: z.string().optional().describe("Filter by event topic"),
+    sourceService: z.string().optional().describe("Filter by source service"),
+    limit: z.number().int().min(1).max(100).optional().describe("Max events to return"),
+});
+export async function auditQuery(ctx, input) {
+    const params = new URLSearchParams();
+    if (input.topic)
+        params.set("topic", input.topic);
+    if (input.sourceService)
+        params.set("sourceService", input.sourceService);
+    params.set("tenantId", ctx.gate.tenantId);
+    params.set("limit", String(input.limit ?? 20));
+    const { data } = await ctx.api.get(`/proxy/audit/v1/events?${params.toString()}`);
+    return json(data);
+}
+// ── Search Tools (SSE-X) ────────────────────────────────────────────────────
+export const searchQuerySchema = z.object({
+    query: z.string().describe("Search query text"),
+    limit: z.number().int().min(1).max(50).optional().describe("Max results (default 10)"),
+});
+export async function searchQuery(ctx, input) {
+    if (!ctx.gate.hasFeature("sseEnabled")) {
+        return gateError("Encrypted Search (SSE-X)", ctx.gate.tier);
+    }
+    const params = new URLSearchParams();
+    params.set("tenantId", ctx.gate.tenantId);
+    params.set("q", input.query);
+    params.set("limit", String(input.limit ?? 10));
+    const { data } = await ctx.api.get(`/proxy/search/v1/documents?${params.toString()}`);
+    return json(data);
+}
+// ── Tenant & Billing Info Tools ─────────────────────────────────────────────
+export const tenantInfoSchema = z.object({});
+export async function tenantInfo(ctx, _input) {
+    const { data } = await ctx.api.get(`/proxy/tenant/v1/tenants/${ctx.gate.tenantId}`);
+    return json(data);
+}
+export const billingStatusSchema = z.object({});
+export async function billingStatus(ctx, _input) {
+    return json({
+        tenantId: ctx.gate.tenantId,
+        tier: ctx.gate.tier,
+        limits: ctx.gate.limits,
+        upgradeUrl: "https://cloud.qnsp.cuilabs.io/billing",
+    });
+}
+// ── Health Tools ────────────────────────────────────────────────────────────
+export const platformHealthSchema = z.object({});
+export async function platformHealth(ctx, _input) {
+    const { data } = await ctx.api.get("/proxy/health");
+    return json(data);
+}
+//# sourceMappingURL=tools.js.map

package/dist/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB,SAAS,IAAI,CAAC,KAAa;IAC1B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,IAAY;IAC/C,OAAO;QACN,OAAO,EAAE;YACR;gBACC,IAAI,EAAE,MAAM;gBACZ,IAAI,EACH,sDAAsD,IAAI,IAAI;oBAC9D,8DAA8D,OAAO,GAAG;aACzE;SACD;QACD,OAAO,EAAE,IAAI;KACb,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,CACR,qFAAqF,CACrF;IACF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IACjE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;CACnF,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,GAAgB,EAChB,KAA2C;IAE3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE;QACzD,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ;QAC3B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE;QACzC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;KAC9B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;CAC9F,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,GAAgB,EAChB,KAAwC;IAExC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;IAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CACjC,+BAA+B,GAAG,CAAC,IAAI,CAAC,QAAQ,UAAU,KAAK,EAAE,CACjE,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,GAAgB,EAChB,KAAsC;IAEtC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CACjC,sBAAsB,KAAK,CAAC,KAAK,aAAa,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CACjE,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,GAAgB,EAChB,KAAyC;IAEzC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,KAAK,SAAS,EAAE;QAC/E,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ;QAC3B,MAAM,EAAE,cAAc;KACtB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC/D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IAC/D,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;CACjF,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,GAAgB,EAChB,KAA8C;IAE9C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC,oBAAoB,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE;QAC9D,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ;QAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;KAC9B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;CACjD,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,GAAgB,EAChB,KAA2C;IAE3C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC,oBAAoB,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,2BAA2B,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;CACpF,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,GAAgB,EAChB,KAA6C;IAE7C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC,oBAAoB,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;IAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CACjC,oCAAoC,GAAG,CAAC,IAAI,CAAC,QAAQ,UAAU,KAAK,EAAE,CACtE,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;SACpD,QAAQ,EAAE;SACV,QAAQ,CAAC,4BAA4B,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,GAAgB,EAChB,KAAuC;IAEvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CACjC,4CAA4C,GAAG,CAAC,IAAI,CAAC,QAAQ,mBAAmB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAC3G,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;CAClF,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,GAAgB,EAChB,KAA4C;IAE5C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;IAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CACjC,4CAA4C,GAAG,CAAC,IAAI,CAAC,QAAQ,UAAU,KAAK,EAAE,CAC9E,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,GAAgB,EAChB,MAA6C;IAE7C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,uCAAuC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAC9D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IACzE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;CACnF,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,GAAgB,EAChB,KAAuC;IAEvC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,aAAa;QAAE,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1E,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,0BAA0B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;CACtF,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,GAAgB,EAChB,KAAwC;IAExC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC,0BAA0B,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,8BAA8B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACtF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE7C,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,GAAgB,EAChB,MAAwC;IAExC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,4BAA4B,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,GAAgB,EAChB,MAA2C;IAE3C,OAAO,IAAI,CAAC;QACX,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ;QAC3B,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;QACnB,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM;QACvB,UAAU,EAAE,uCAAuC;KACnD,CAAC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,GAAgB,EAChB,MAA4C;IAE5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC"}

package/package.json

@@ -0,0 +1,93 @@
+{
+  "name": "@heossi/qnsi-mcp",
+  "version": "0.1.4",
+  "description": "QNSP MCP Server: post-quantum cryptography tools for AI assistants. Manage PQC keys, encrypted vault, crypto inventory, and compliance — all tier-gated via QNSP billing.",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "license": "Apache-2.0",
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "bin": {
+    "qnsi-mcp": "./dist/index.js"
+  },
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./tools": {
+      "import": "./dist/tools.js",
+      "types": "./dist/tools.d.ts"
+    },
+    "./session": {
+      "import": "./dist/session.js",
+      "types": "./dist/session.d.ts"
+    },
+    "./api-client": {
+      "import": "./dist/api-client.js",
+      "types": "./dist/api-client.d.ts"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "zod": "^4.3.6",
+    "@heossi/qnsi": "0.3.2"
+  },
+  "devDependencies": {
+    "@types/node": "^25.5.2",
+    "typescript": "^6.0.2",
+    "vitest": "4.1.2"
+  },
+  "keywords": [
+    "qnsp",
+    "mcp",
+    "model-context-protocol",
+    "pqc",
+    "post-quantum",
+    "post-quantum-cryptography",
+    "ml-kem",
+    "ml-dsa",
+    "kyber",
+    "dilithium",
+    "sphincs",
+    "falcon",
+    "cryptography",
+    "kms",
+    "key-management",
+    "vault",
+    "secrets",
+    "audit",
+    "quantum-safe",
+    "zero-trust",
+    "fips-203",
+    "fips-204",
+    "fips-205",
+    "nist",
+    "compliance",
+    "ai-tools",
+    "smithery"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/heossi-hq/qnsp-public",
+    "directory": "packages/mcp-server"
+  },
+  "homepage": "https://cloud.qnsp.cuilabs.io",
+  "bugs": {
+    "url": "https://github.com/heossi-hq/qnsp-public/issues"
+  },
+  "scripts": {
+    "build": "tsc --project tsconfig.build.json",
+    "lint": "biome check .",
+    "test": "vitest run"
+  }
+}