{"serverId":"mcp-registry/io.github.quantakrypto/pqc-tools","tools":[{"name":"apply_verified_patch","fixed":{"name":"apply_verified_patch","description":"Deterministically VERIFY a proposed fix before writing it — runs the same patch-policy + verify_fix + blast-radius gates as `qremediate` (offline, no key, no network). Give the finding, the file's current content, and your proposed FULL corrected content; returns approved:true only if the patch is in-policy, clears the finding, adds no new finding, introduces no network/exec sink, and is bounded in size. This does NOT write the file — you write it, only when approved, and never auto-merge.","inputSchema":{"type":"object","required":["finding","originalContent","newContent"],"properties":{"finding":{"type":"object","description":"The scan finding being fixed (needs a string ruleId and location.file)."},"newContent":{"type":"string","description":"Your proposed full corrected file content."},"originalContent":{"type":"string","description":"The file's current full content."}},"additionalProperties":false},"annotations":{"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: false, destructiveHint: false, idempotentHint: false (inferred from the name).","verify":true}],"tokensBefore":268,"tokensAfter":268},{"name":"check_dependency","fixed":{"name":"check_dependency","description":"Check whether a package is in quantakrypto's known quantum-vulnerable dependency database (the classical crypto it exposes). Provide 'name' and optional 'ecosystem' (default npm).","inputSchema":{"type":"object","required":["name"],"properties":{"name":{"type":"string","description":"Package name to look up (e.g. 'node-forge', 'jsonwebtoken')."},"ecosystem":{"type":"string","description":"Package ecosystem. Default: npm."}},"additionalProperties":false},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":139,"tokensAfter":139},{"name":"explain_finding","fixed":{"name":"explain_finding","description":"Explain a quantakrypto finding and its post-quantum remediation. Provide a ruleId (e.g. 'forge-rsa-keygen', 'elliptic-ec', 'node-rsa', 'pem-ec-private-key') and/or an algorithm (e.g. 'RSA', 'ECDSA'). The ruleId is resolved against the core detector set, so library and config rules explain correctly.","inputSchema":{"type":"object","properties":{"ruleId":{"type":"string","description":"The finding's rule id, matching a detector id prefix."},"algorithm":{"type":"string","description":"The classical algorithm family involved (e.g. RSA, ECDH, ECDSA)."}},"additionalProperties":false},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":175,"tokensAfter":175},{"name":"get_fix_examples","fixed":{"name":"get_fix_examples","description":"Return before/after code examples for migrating a classical algorithm to a post-quantum / hybrid replacement. Provide an 'algorithm' (RSA, ECDH, ECDSA, …) or a 'ruleId' from a finding.","inputSchema":{"type":"object","properties":{"ruleId":{"type":"string","description":"A finding's ruleId (resolved to its algorithm)."},"algorithm":{"type":"string","description":"Classical algorithm family to migrate away from."}},"additionalProperties":false},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":137,"tokensAfter":137},{"name":"list_rules","fixed":{"name":"list_rules","description":"List the quantakrypto detector catalog: every detector id and what it looks for.","inputSchema":{"type":"object","properties":{},"additionalProperties":false},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":55,"tokensAfter":55},{"name":"remediate_findings","fixed":{"name":"remediate_findings","description":"Produce a deterministic remediation REQUEST bundle (rubric + fix schema + per-finding metadata + fingerprints) for YOU (the host agent) to fix. This tool calls no model and needs no key. For each finding, propose the corrected FULL file content, then VERIFY with verify_fix and keep only fixes that clear the finding. Never touch files with secrets; never auto-merge. Pass 'findings' from scan_path --format json.","inputSchema":{"type":"object","required":["findings"],"properties":{"findings":{"type":"array","items":{"type":"object","required":["ruleId","location"],"properties":{"cwe":{"type":"string","description":"e.g. \"CWE-327\"."},"hndl":{"type":"boolean","description":"Exposed to harvest-now-decrypt-later."},"title":{"type":"string"},"ruleId":{"type":"string","description":"Stable rule id, e.g. \"rsa-keygen\"."},"message":{"type":"string"},"category":{"type":"string"},"location":{"type":"object","required":["file"],"properties":{"file":{"type":"string"},"line":{"type":"number"}},"description":"Where the finding is."},"severity":{"type":"string","description":"critical | high | medium | low | info."},"algorithm":{"type":"string","description":"Classical algorithm family, when applicable."},"confidence":{"type":"string"},"remediation":{"type":"string"}},"description":"A single finding from `scan_path --format json`."},"description":"Findings from a scan's JSON output."}},"additionalProperties":false},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":409,"tokensAfter":409},{"name":"triage_findings","fixed":{"name":"triage_findings","description":"Produce a deterministic triage REQUEST bundle (rubric + verdict schema + per-finding metadata) for YOU (the host agent) to reason over. This tool does NOT call any model and needs no API key. Assess each finding's real-world exposure, then call apply_triage with your verdicts. Pass 'findings' as an array from scan_path --format json.","inputSchema":{"type":"object","required":["findings"],"properties":{"findings":{"type":"array","items":{"type":"object","required":["ruleId","location"],"properties":{"cwe":{"type":"string","description":"e.g. \"CWE-327\"."},"hndl":{"type":"boolean","description":"Exposed to harvest-now-decrypt-later."},"title":{"type":"string"},"ruleId":{"type":"string","description":"Stable rule id, e.g. \"rsa-keygen\"."},"message":{"type":"string"},"category":{"type":"string"},"location":{"type":"object","required":["file"],"properties":{"file":{"type":"string"},"line":{"type":"number"}},"description":"Where the finding is."},"severity":{"type":"string","description":"critical | high | medium | low | info."},"algorithm":{"type":"string","description":"Classical algorithm family, when applicable."},"confidence":{"type":"string"},"remediation":{"type":"string"}},"description":"A single finding from `scan_path --format json`."},"description":"Findings from a scan's JSON output."}},"additionalProperties":false},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":386,"tokensAfter":386}],"toolsChanged":7,"tokensSaved":0,"todo":[],"note":"Deterministic fixes. Changes marked verify need a human look before shipping (renames, inferred annotations, inferred types, removed text). Parameter descriptions in `todo` need to be written by someone who knows the API."}