pqc-audit 0.1.0__tar.gz

pqc_audit-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Aaron Vives
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

pqc_audit-0.1.0/PKG-INFO

@@ -0,0 +1,196 @@
+Metadata-Version: 2.4
+Name: pqc-audit
+Version: 0.1.0
+Summary: Scans local repositories for quantum-vulnerable cryptography and produces an exposure report with post-quantum migration targets.
+Author-email: Aaron Vives <aaronvives@icloud.com>
+License: MIT
+Project-URL: Homepage, https://github.com/rauleteee/pqc-scanner
+Project-URL: Repository, https://github.com/rauleteee/pqc-scanner
+Project-URL: Issues, https://github.com/rauleteee/pqc-scanner/issues
+Keywords: pqc,post-quantum,cryptography,security,sast,cbom
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: rich>=13.0
+Provides-Extra: mcp
+Requires-Dist: mcp>=1.2; extra == "mcp"
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
+Requires-Dist: jsonschema>=4.0; extra == "dev"
+Requires-Dist: mcp>=1.2; extra == "dev"
+Dynamic: license-file
+
+# PQC Scanner
+
+Open-source CLI that scans a local repository for cryptography vulnerable to
+quantum computing (RSA, ECC, ...) and produces an exposure report with concrete
+post-quantum migration targets.
+
+> You can't migrate what you can't see. PQC Scanner is the inventory/visibility
+> step of a post-quantum migration: it finds where quantum-vulnerable
+> cryptography lives in your code and dependencies, and tells you what to move it to.
+
+> **Status:** v1, Python only. AST detection engine, dependency-manifest
+> complement, rule base, CycloneDX CBOM output and CLI are in place.
+
+## What it detects
+
+Two static detectors feed one report:
+
+- **Source code (AST) — high signal.** Parses Python with the standard `ast`
+  module and reports *real uses* of vulnerable primitives (a crypto import **plus**
+  a matching call), so comments or variable names never trigger a finding.
+  Extracts detail: RSA/DSA/DH key size, EC curve (normalized across libraries —
+  `SECP256R1`/`P-256`/`prime256v1` → `P-256`), AES key length, PQC scheme.
+- **Dependency manifests — complement.** Parses `requirements.txt`,
+  `pyproject.toml` (PEP 621 + Poetry), `poetry.lock` and `Pipfile.lock` and flags
+  declared cryptographic libraries with their version. Low signal on its own (it
+  says a library is present, not that a primitive is used), but it seeds the CBOM.
+
+Each finding carries: location, algorithm, usage context, quantum classification
+(Shor / Grover / already-PQC), severity, origin (code location | package+version)
+and a **suggested PQC migration target** (key exchange → ML-KEM, signatures → ML-DSA).
+
+## Installation
+
+With [pipx](https://pipx.pypa.io) for an isolated CLI:
+
+```bash
+pipx install pqc-audit
+```
+
+Or from a local clone:
+
+```bash
+git clone https://github.com/rauleteee/pqc-scanner
+cd pqc-scanner
+pipx install .                  # isolated, adds the `pqc-audit` command
+```
+
+Or for development:
+
+```bash
+python -m venv .venv && source .venv/bin/activate
+pip install -e ".[dev]"
+```
+
+## Usage
+
+```bash
+pqc-audit [PATH]              # colored terminal summary (default PATH: .)
+pqc-audit [PATH] --json       # CycloneDX 1.6 CBOM to stdout
+python -m pqc_scanner [PATH]  # equivalent, without installing
+```
+
+Running it against the bundled `examples/` (Python source + a `requirements.txt`):
+
+```text
+pqc-audit 0.1.0  ·  scanned examples
+CRITICAL: 5  MEDIUM: 1  INFO: 1
+┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓
+┃ Severity ┃ Algorithm          ┃ Usage          ┃ Location              ┃ Migrate to             ┃
+┡━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━┩
+│ CRITICAL │ RSA/ECC/DH/Ed25519 │ dependency     │ examples/requirements │ ML-KEM / ML-DSA        │
+│ CRITICAL │ RSA/ECC (OpenSSL)  │ dependency     │ examples/requirements │ ML-KEM / ML-DSA        │
+│ CRITICAL │ RSA/ECDSA (SSH)    │ dependency     │ examples/requirements │ ML-KEM / ML-DSA        │
+│ CRITICAL │ RSA-2048           │ key_generation │ examples/vulnerable_… │ ML-KEM / ML-DSA        │
+│ CRITICAL │ ECC-P-256          │ key_generation │ examples/vulnerable_… │ ML-KEM (ECDH) / ML-DSA │
+│ MEDIUM   │ AES                │ encryption     │ examples/vulnerable_… │ AES-256                │
+│ INFO     │ ML-KEM/ML-DSA      │ dependency     │ examples/requirements │ already post-quantum   │
+└──────────┴────────────────────┴────────────────┴───────────────────────┴────────────────────────┘
+Verdict: quantum-critical cryptography in use — migration needed.
+```
+
+The header count (`CRITICAL: 5  MEDIUM: 1  INFO: 1`) is the at-a-glance verdict.
+
+### JSON / CBOM output
+
+`--json` emits a **CycloneDX 1.6 CBOM** (Cryptography Bill of Materials),
+validated against the official schema. Code findings become `cryptographic-asset`
+components; dependency findings become `library` components (with `purl` and
+version). The scanner's assessment (severity, quantum classification, migration
+target) rides along as namespaced `properties`.
+
+```bash
+pqc-audit path/to/repo --json > cbom.json
+```
+
+## MCP server (for AI agents)
+
+The same engine is exposed over the [Model Context Protocol](https://modelcontextprotocol.io),
+so any MCP-capable agent (Claude, Cursor, …) can scan a local repo conversationally.
+
+```bash
+pip install ".[mcp]"     # installs the optional MCP SDK
+pqc-audit-mcp            # runs the server over stdio
+```
+
+Register it with Claude Code:
+
+```bash
+claude mcp add pqc-audit -- pqc-audit-mcp
+```
+
+Or add it to a client config (e.g. Claude Desktop `claude_desktop_config.json`):
+
+```json
+{
+  "mcpServers": {
+    "pqc-audit": { "command": "pqc-audit-mcp" }
+  }
+}
+```
+
+It exposes two tools:
+
+- **`scan_repository(path)`** — an at-a-glance verdict, severity counts, and the
+  findings, each with its location and suggested post-quantum migration target.
+- **`generate_cbom(path)`** — the full CycloneDX 1.6 CBOM.
+
+## Architecture
+
+The engine is a **library**; the interfaces are **thin wrappers**. All detection
+logic lives in the `pqc_scanner` core, exposed through a small public API:
+
+```python
+from pqc_scanner import scan, to_cbom
+findings = scan(path)          # list[Finding]  (code + dependency findings)
+cbom = to_cbom(findings)       # CycloneDX 1.6 CBOM dict
+```
+
+The CLI and the MCP server are just thin faces of the same engine (a skill is next).
+
+## Tests
+
+```bash
+pytest
+```
+
+## v1 scope
+
+- **Python** ecosystem only.
+- **Static** analysis of local files: source code (AST) + dependency manifests.
+- Outputs: colored terminal summary + JSON aligned with CycloneDX CBOM.
+
+**Known limit (by design):** the AST engine detects direct, statically-resolvable
+use; strong indirection (dependency injection, factories, dynamic `getattr`) is
+out of scope until a future data-flow/taint layer. The dependency complement is a
+presence lookup, not proof a primitive is used.
+
+See [`CLAUDE.md`](CLAUDE.md) for the full design and build plan.
+
+## License
+
+MIT — see [`LICENSE`](LICENSE).

pqc_audit-0.1.0/README.md

@@ -0,0 +1,162 @@
+# PQC Scanner
+
+Open-source CLI that scans a local repository for cryptography vulnerable to
+quantum computing (RSA, ECC, ...) and produces an exposure report with concrete
+post-quantum migration targets.
+
+> You can't migrate what you can't see. PQC Scanner is the inventory/visibility
+> step of a post-quantum migration: it finds where quantum-vulnerable
+> cryptography lives in your code and dependencies, and tells you what to move it to.
+
+> **Status:** v1, Python only. AST detection engine, dependency-manifest
+> complement, rule base, CycloneDX CBOM output and CLI are in place.
+
+## What it detects
+
+Two static detectors feed one report:
+
+- **Source code (AST) — high signal.** Parses Python with the standard `ast`
+  module and reports *real uses* of vulnerable primitives (a crypto import **plus**
+  a matching call), so comments or variable names never trigger a finding.
+  Extracts detail: RSA/DSA/DH key size, EC curve (normalized across libraries —
+  `SECP256R1`/`P-256`/`prime256v1` → `P-256`), AES key length, PQC scheme.
+- **Dependency manifests — complement.** Parses `requirements.txt`,
+  `pyproject.toml` (PEP 621 + Poetry), `poetry.lock` and `Pipfile.lock` and flags
+  declared cryptographic libraries with their version. Low signal on its own (it
+  says a library is present, not that a primitive is used), but it seeds the CBOM.
+
+Each finding carries: location, algorithm, usage context, quantum classification
+(Shor / Grover / already-PQC), severity, origin (code location | package+version)
+and a **suggested PQC migration target** (key exchange → ML-KEM, signatures → ML-DSA).
+
+## Installation
+
+With [pipx](https://pipx.pypa.io) for an isolated CLI:
+
+```bash
+pipx install pqc-audit
+```
+
+Or from a local clone:
+
+```bash
+git clone https://github.com/rauleteee/pqc-scanner
+cd pqc-scanner
+pipx install .                  # isolated, adds the `pqc-audit` command
+```
+
+Or for development:
+
+```bash
+python -m venv .venv && source .venv/bin/activate
+pip install -e ".[dev]"
+```
+
+## Usage
+
+```bash
+pqc-audit [PATH]              # colored terminal summary (default PATH: .)
+pqc-audit [PATH] --json       # CycloneDX 1.6 CBOM to stdout
+python -m pqc_scanner [PATH]  # equivalent, without installing
+```
+
+Running it against the bundled `examples/` (Python source + a `requirements.txt`):
+
+```text
+pqc-audit 0.1.0  ·  scanned examples
+CRITICAL: 5  MEDIUM: 1  INFO: 1
+┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓
+┃ Severity ┃ Algorithm          ┃ Usage          ┃ Location              ┃ Migrate to             ┃
+┡━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━┩
+│ CRITICAL │ RSA/ECC/DH/Ed25519 │ dependency     │ examples/requirements │ ML-KEM / ML-DSA        │
+│ CRITICAL │ RSA/ECC (OpenSSL)  │ dependency     │ examples/requirements │ ML-KEM / ML-DSA        │
+│ CRITICAL │ RSA/ECDSA (SSH)    │ dependency     │ examples/requirements │ ML-KEM / ML-DSA        │
+│ CRITICAL │ RSA-2048           │ key_generation │ examples/vulnerable_… │ ML-KEM / ML-DSA        │
+│ CRITICAL │ ECC-P-256          │ key_generation │ examples/vulnerable_… │ ML-KEM (ECDH) / ML-DSA │
+│ MEDIUM   │ AES                │ encryption     │ examples/vulnerable_… │ AES-256                │
+│ INFO     │ ML-KEM/ML-DSA      │ dependency     │ examples/requirements │ already post-quantum   │
+└──────────┴────────────────────┴────────────────┴───────────────────────┴────────────────────────┘
+Verdict: quantum-critical cryptography in use — migration needed.
+```
+
+The header count (`CRITICAL: 5  MEDIUM: 1  INFO: 1`) is the at-a-glance verdict.
+
+### JSON / CBOM output
+
+`--json` emits a **CycloneDX 1.6 CBOM** (Cryptography Bill of Materials),
+validated against the official schema. Code findings become `cryptographic-asset`
+components; dependency findings become `library` components (with `purl` and
+version). The scanner's assessment (severity, quantum classification, migration
+target) rides along as namespaced `properties`.
+
+```bash
+pqc-audit path/to/repo --json > cbom.json
+```
+
+## MCP server (for AI agents)
+
+The same engine is exposed over the [Model Context Protocol](https://modelcontextprotocol.io),
+so any MCP-capable agent (Claude, Cursor, …) can scan a local repo conversationally.
+
+```bash
+pip install ".[mcp]"     # installs the optional MCP SDK
+pqc-audit-mcp            # runs the server over stdio
+```
+
+Register it with Claude Code:
+
+```bash
+claude mcp add pqc-audit -- pqc-audit-mcp
+```
+
+Or add it to a client config (e.g. Claude Desktop `claude_desktop_config.json`):
+
+```json
+{
+  "mcpServers": {
+    "pqc-audit": { "command": "pqc-audit-mcp" }
+  }
+}
+```
+
+It exposes two tools:
+
+- **`scan_repository(path)`** — an at-a-glance verdict, severity counts, and the
+  findings, each with its location and suggested post-quantum migration target.
+- **`generate_cbom(path)`** — the full CycloneDX 1.6 CBOM.
+
+## Architecture
+
+The engine is a **library**; the interfaces are **thin wrappers**. All detection
+logic lives in the `pqc_scanner` core, exposed through a small public API:
+
+```python
+from pqc_scanner import scan, to_cbom
+findings = scan(path)          # list[Finding]  (code + dependency findings)
+cbom = to_cbom(findings)       # CycloneDX 1.6 CBOM dict
+```
+
+The CLI and the MCP server are just thin faces of the same engine (a skill is next).
+
+## Tests
+
+```bash
+pytest
+```
+
+## v1 scope
+
+- **Python** ecosystem only.
+- **Static** analysis of local files: source code (AST) + dependency manifests.
+- Outputs: colored terminal summary + JSON aligned with CycloneDX CBOM.
+
+**Known limit (by design):** the AST engine detects direct, statically-resolvable
+use; strong indirection (dependency injection, factories, dynamic `getattr`) is
+out of scope until a future data-flow/taint layer. The dependency complement is a
+presence lookup, not proof a primitive is used.
+
+See [`CLAUDE.md`](CLAUDE.md) for the full design and build plan.
+
+## License
+
+MIT — see [`LICENSE`](LICENSE).

pqc_audit-0.1.0/pyproject.toml

@@ -0,0 +1,56 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "pqc-audit"
+version = "0.1.0"
+description = "Scans local repositories for quantum-vulnerable cryptography and produces an exposure report with post-quantum migration targets."
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "MIT" }
+authors = [{ name = "Aaron Vives", email = "aaronvives@icloud.com" }]
+keywords = ["pqc", "post-quantum", "cryptography", "security", "sast", "cbom"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Operating System :: OS Independent",
+    "Topic :: Security :: Cryptography",
+    "Topic :: Software Development :: Quality Assurance",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+]
+dependencies = [
+    "rich>=13.0",
+]
+
+[project.optional-dependencies]
+mcp = [
+    "mcp>=1.2",  # Model Context Protocol SDK, for the MCP server interface
+]
+dev = [
+    "pytest>=7.0",
+    "jsonschema>=4.0",  # validates CBOM output against the CycloneDX schema
+    "mcp>=1.2",  # exercised by the MCP interface tests
+]
+
+[project.urls]
+Homepage = "https://github.com/rauleteee/pqc-scanner"
+Repository = "https://github.com/rauleteee/pqc-scanner"
+Issues = "https://github.com/rauleteee/pqc-scanner/issues"
+
+[project.scripts]
+pqc-audit = "pqc_scanner.interfaces.cli:main"
+pqc-audit-mcp = "pqc_scanner.interfaces.mcp_server:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+include = ["pqc_scanner*"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

pqc_audit-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

pqc_audit-0.1.0/src/pqc_audit.egg-info/PKG-INFO

@@ -0,0 +1,196 @@
+Metadata-Version: 2.4
+Name: pqc-audit
+Version: 0.1.0
+Summary: Scans local repositories for quantum-vulnerable cryptography and produces an exposure report with post-quantum migration targets.
+Author-email: Aaron Vives <aaronvives@icloud.com>
+License: MIT
+Project-URL: Homepage, https://github.com/rauleteee/pqc-scanner
+Project-URL: Repository, https://github.com/rauleteee/pqc-scanner
+Project-URL: Issues, https://github.com/rauleteee/pqc-scanner/issues
+Keywords: pqc,post-quantum,cryptography,security,sast,cbom
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: rich>=13.0
+Provides-Extra: mcp
+Requires-Dist: mcp>=1.2; extra == "mcp"
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
+Requires-Dist: jsonschema>=4.0; extra == "dev"
+Requires-Dist: mcp>=1.2; extra == "dev"
+Dynamic: license-file
+
+# PQC Scanner
+
+Open-source CLI that scans a local repository for cryptography vulnerable to
+quantum computing (RSA, ECC, ...) and produces an exposure report with concrete
+post-quantum migration targets.
+
+> You can't migrate what you can't see. PQC Scanner is the inventory/visibility
+> step of a post-quantum migration: it finds where quantum-vulnerable
+> cryptography lives in your code and dependencies, and tells you what to move it to.
+
+> **Status:** v1, Python only. AST detection engine, dependency-manifest
+> complement, rule base, CycloneDX CBOM output and CLI are in place.
+
+## What it detects
+
+Two static detectors feed one report:
+
+- **Source code (AST) — high signal.** Parses Python with the standard `ast`
+  module and reports *real uses* of vulnerable primitives (a crypto import **plus**
+  a matching call), so comments or variable names never trigger a finding.
+  Extracts detail: RSA/DSA/DH key size, EC curve (normalized across libraries —
+  `SECP256R1`/`P-256`/`prime256v1` → `P-256`), AES key length, PQC scheme.
+- **Dependency manifests — complement.** Parses `requirements.txt`,
+  `pyproject.toml` (PEP 621 + Poetry), `poetry.lock` and `Pipfile.lock` and flags
+  declared cryptographic libraries with their version. Low signal on its own (it
+  says a library is present, not that a primitive is used), but it seeds the CBOM.
+
+Each finding carries: location, algorithm, usage context, quantum classification
+(Shor / Grover / already-PQC), severity, origin (code location | package+version)
+and a **suggested PQC migration target** (key exchange → ML-KEM, signatures → ML-DSA).
+
+## Installation
+
+With [pipx](https://pipx.pypa.io) for an isolated CLI:
+
+```bash
+pipx install pqc-audit
+```
+
+Or from a local clone:
+
+```bash
+git clone https://github.com/rauleteee/pqc-scanner
+cd pqc-scanner
+pipx install .                  # isolated, adds the `pqc-audit` command
+```
+
+Or for development:
+
+```bash
+python -m venv .venv && source .venv/bin/activate
+pip install -e ".[dev]"
+```
+
+## Usage
+
+```bash
+pqc-audit [PATH]              # colored terminal summary (default PATH: .)
+pqc-audit [PATH] --json       # CycloneDX 1.6 CBOM to stdout
+python -m pqc_scanner [PATH]  # equivalent, without installing
+```
+
+Running it against the bundled `examples/` (Python source + a `requirements.txt`):
+
+```text
+pqc-audit 0.1.0  ·  scanned examples
+CRITICAL: 5  MEDIUM: 1  INFO: 1
+┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓
+┃ Severity ┃ Algorithm          ┃ Usage          ┃ Location              ┃ Migrate to             ┃
+┡━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━┩
+│ CRITICAL │ RSA/ECC/DH/Ed25519 │ dependency     │ examples/requirements │ ML-KEM / ML-DSA        │
+│ CRITICAL │ RSA/ECC (OpenSSL)  │ dependency     │ examples/requirements │ ML-KEM / ML-DSA        │
+│ CRITICAL │ RSA/ECDSA (SSH)    │ dependency     │ examples/requirements │ ML-KEM / ML-DSA        │
+│ CRITICAL │ RSA-2048           │ key_generation │ examples/vulnerable_… │ ML-KEM / ML-DSA        │
+│ CRITICAL │ ECC-P-256          │ key_generation │ examples/vulnerable_… │ ML-KEM (ECDH) / ML-DSA │
+│ MEDIUM   │ AES                │ encryption     │ examples/vulnerable_… │ AES-256                │
+│ INFO     │ ML-KEM/ML-DSA      │ dependency     │ examples/requirements │ already post-quantum   │
+└──────────┴────────────────────┴────────────────┴───────────────────────┴────────────────────────┘
+Verdict: quantum-critical cryptography in use — migration needed.
+```
+
+The header count (`CRITICAL: 5  MEDIUM: 1  INFO: 1`) is the at-a-glance verdict.
+
+### JSON / CBOM output
+
+`--json` emits a **CycloneDX 1.6 CBOM** (Cryptography Bill of Materials),
+validated against the official schema. Code findings become `cryptographic-asset`
+components; dependency findings become `library` components (with `purl` and
+version). The scanner's assessment (severity, quantum classification, migration
+target) rides along as namespaced `properties`.
+
+```bash
+pqc-audit path/to/repo --json > cbom.json
+```
+
+## MCP server (for AI agents)
+
+The same engine is exposed over the [Model Context Protocol](https://modelcontextprotocol.io),
+so any MCP-capable agent (Claude, Cursor, …) can scan a local repo conversationally.
+
+```bash
+pip install ".[mcp]"     # installs the optional MCP SDK
+pqc-audit-mcp            # runs the server over stdio
+```
+
+Register it with Claude Code:
+
+```bash
+claude mcp add pqc-audit -- pqc-audit-mcp
+```
+
+Or add it to a client config (e.g. Claude Desktop `claude_desktop_config.json`):
+
+```json
+{
+  "mcpServers": {
+    "pqc-audit": { "command": "pqc-audit-mcp" }
+  }
+}
+```
+
+It exposes two tools:
+
+- **`scan_repository(path)`** — an at-a-glance verdict, severity counts, and the
+  findings, each with its location and suggested post-quantum migration target.
+- **`generate_cbom(path)`** — the full CycloneDX 1.6 CBOM.
+
+## Architecture
+
+The engine is a **library**; the interfaces are **thin wrappers**. All detection
+logic lives in the `pqc_scanner` core, exposed through a small public API:
+
+```python
+from pqc_scanner import scan, to_cbom
+findings = scan(path)          # list[Finding]  (code + dependency findings)
+cbom = to_cbom(findings)       # CycloneDX 1.6 CBOM dict
+```
+
+The CLI and the MCP server are just thin faces of the same engine (a skill is next).
+
+## Tests
+
+```bash
+pytest
+```
+
+## v1 scope
+
+- **Python** ecosystem only.
+- **Static** analysis of local files: source code (AST) + dependency manifests.
+- Outputs: colored terminal summary + JSON aligned with CycloneDX CBOM.
+
+**Known limit (by design):** the AST engine detects direct, statically-resolvable
+use; strong indirection (dependency injection, factories, dynamic `getattr`) is
+out of scope until a future data-flow/taint layer. The dependency complement is a
+presence lookup, not proof a primitive is used.
+
+See [`CLAUDE.md`](CLAUDE.md) for the full design and build plan.
+
+## License
+
+MIT — see [`LICENSE`](LICENSE).

pqc_audit-0.1.0/src/pqc_audit.egg-info/SOURCES.txt

@@ -0,0 +1,32 @@
+LICENSE
+README.md
+pyproject.toml
+src/pqc_audit.egg-info/PKG-INFO
+src/pqc_audit.egg-info/SOURCES.txt
+src/pqc_audit.egg-info/dependency_links.txt
+src/pqc_audit.egg-info/entry_points.txt
+src/pqc_audit.egg-info/requires.txt
+src/pqc_audit.egg-info/top_level.txt
+src/pqc_scanner/__init__.py
+src/pqc_scanner/__main__.py
+src/pqc_scanner/core.py
+src/pqc_scanner/findings.py
+src/pqc_scanner/rules.py
+src/pqc_scanner/detectors/__init__.py
+src/pqc_scanner/detectors/ast_engine.py
+src/pqc_scanner/detectors/dependencies.py
+src/pqc_scanner/detectors/discovery.py
+src/pqc_scanner/interfaces/__init__.py
+src/pqc_scanner/interfaces/cli.py
+src/pqc_scanner/interfaces/mcp_server.py
+src/pqc_scanner/outputs/__init__.py
+src/pqc_scanner/outputs/cbom.py
+src/pqc_scanner/outputs/report.py
+tests/test_ast_engine.py
+tests/test_cbom.py
+tests/test_cli.py
+tests/test_dependencies.py
+tests/test_discovery.py
+tests/test_mcp.py
+tests/test_report.py
+tests/test_smoke.py

pqc_audit-0.1.0/src/pqc_audit.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

pqc_audit-0.1.0/src/pqc_audit.egg-info/entry_points.txt

@@ -0,0 +1,3 @@
+[console_scripts]
+pqc-audit = pqc_scanner.interfaces.cli:main
+pqc-audit-mcp = pqc_scanner.interfaces.mcp_server:main