# QNSQY (npm · qnsqy)

Linux only, local: post-quantum CBOM scan, encrypt to public keys, verify. Takes no secrets

- Trust score: 61/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-04

## Components

- npm · `qnsqy`: 61/100 (this document), [markdown](https://verifymcp.io/servers/quantumsequrity-qnsqy/qnsqy.md), [page](https://verifymcp.io/servers/quantumsequrity-qnsqy/qnsqy)

## Channel facts

- Registry: `npm`
- Package: `qnsqy`
- Version: `7.2.51`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-04.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 0 of 3 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 10/100
  - Repository check failed: no source repository is declared.
  - Provenance check failed: no build-provenance attestation is published.
  - Licence could not be checked: the licence is shipped as a file inside the package, not declared as a standard (SPDX) licence identifier, so we cannot tell whether it is OSI-approved.
  - Actively maintained (last published 1 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 63/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 1278 tokens (~127/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 10/100
  - Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 10 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 11 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the QNSQY MCP server?

QNSQY runs locally as an npm package, launched with npx -y qnsqy. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add quantumsequrity-qnsqy -- npx -y qnsqy
```

### Cursor

```json
{
  "mcpServers": {
    "quantumsequrity-qnsqy": {
      "command": "npx",
      "args": [
        "-y",
        "qnsqy"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "quantumsequrity-qnsqy": {
      "command": "npx",
      "args": [
        "-y",
        "qnsqy"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add quantumsequrity-qnsqy -- npx -y qnsqy
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "quantumsequrity-qnsqy": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "qnsqy"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add quantumsequrity-qnsqy --command npx --arg -y --arg qnsqy
```

### Hermes

```yaml
mcp_servers:
  quantumsequrity-qnsqy:
    command: "npx"
    args: ["-y", "qnsqy"]
```

### Netclaw

```json
{
  "McpServers": {
    "quantumsequrity-qnsqy": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "qnsqy"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add quantumsequrity-qnsqy -t stdio -c npx -a -y qnsqy
```

### Other

```json
{
  "mcpServers": {
    "quantumsequrity-qnsqy": {
      "command": "npx",
      "args": [
        "-y",
        "qnsqy"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-03 (score 61, +16)

- [security improvement] Malware scan: unverified → pass

### 2026-11-02 (score 45, −15)

- [security regression] Malware scan: pass → unverified
- [functional] Package version: 7.2.49 → 7.2.51
- [functional] Package version: 7.2.49 → 7.2.50

### 2026-11-01 (score 60)

First indexed and scored.

## MCP tools (10)

### `qnsqy_encrypt` (~213 tokens)

Encrypt a file

Encrypt a file with quantum-safe encryption. Free algorithms (0 credits, no file limit): ML-KEM-512 on all tiers, ML-KEM-768 on Pro+, everything on Business. Strict profile: this tool takes no password, passphrase, private key, API key or payment token.

Input parameters:

- `algorithm` (string): AEAD: aes256-gcm (default) or xchacha20-poly1305 (Pro+)
- `compress` (boolean): Compress before encrypting
- `file` (string, required): Path to input file
- `kem` (string): KEM algorithm: ml-kem512 (free), ml-kem768, ml-kem1024, hqc-128/192/256
- `output` (string): Output path (default: {file}.qs)
- `paranoid` (boolean): Size sealing: hide the exact size (padding to a Padme bucket of at least 1 KiB)
- `recipient` (string, required): Recipient public key file path

### `qnsqy_verify` (~42 tokens)

Verify a signature

Verify file signature. Always FREE.

Input parameters:

- `file` (string, required): File to verify (.qs with embedded signature)
- `key` (string, required): Public key file

### `qnsqy_verify_release` (~115 tokens)

Verify a release signature

Verify a QNSQY release artifact's detached ML-DSA-87 signature against QNSQY's release public key. Always FREE. Strict profile: this tool takes no password, passphrase, private key, API key or payment token.

Input parameters:

- `artifact` (string, required): Path to the signed artifact (e.g. checksums.txt); verified byte-for-byte
- `signature` (string, required): Path to the ML-DSA-87 signature file (raw bytes or hex, typically <artifact>.sig)

### `qnsqy_hash` (~106 tokens)

Hash a file

Compute file hash (BLAKE3/SHA3/SHA256/etc). Always FREE.

Input parameters:

- `algorithm` (string): blake3 (default), blake2b, blake2s, sha256, sha512, sha3-256, sha3-512, shake256
- `file` (string, required): File or directory to hash
- `format` (string): hex (default) or base64
- `recursive` (boolean): Hash directory recursively

### `qnsqy_hash_verify` (~58 tokens)

Check a file against a hash

Verify file hash. Always FREE.

Input parameters:

- `algorithm` (string): Hash algorithm (default: blake3)
- `file` (string, required): File to verify
- `hash` (string, required): Expected hash value (hex or base64)

### `qnsqy_verify_integrity` (~35 tokens)

Check an encrypted file's integrity

Check .qs file integrity without password. Always FREE.

Input parameters:

- `file` (string, required): .qs file to check

### `qnsqy_scan` (~521 tokens)

Scan for quantum-vulnerable cryptography

Find classical crypto files; `format: cyclonedx` gives a CycloneDX 1.7 CBOM (JSON) of the cryptographic material found in files (not crypto in source code, binaries or network traffic), stating only what the scanner read: algorithms it assumes from a file type are marked as assumed. Inline results are cut at 10 KB, and a longer JSON report or CBOM is refused with an error: pass `output` to write the whole report to a file. `format: omb-csv|omb-xlsx|omb-json` writes the OMB M-23-02 inventory report of one system (the memo's nine items; omb-xlsx needs `output`; the memo excludes national security systems), with the system profile `omb_profile` and the omb_* values that override it. Free on all tiers (an account is needed). Strict profile: this tool takes no password, passphrase, private key, API key or payment token.

Input parameters:

- `directory` (string, required): Directory to scan
- `format` (string): text (default), json, csv, html, markdown, cyclonedx (CycloneDX 1.7 CBOM, JSON), omb-csv, omb-xlsx, omb-json (OMB M-23-02 inventory report)
- `min_risk` (string): Minimum risk level: safe, low, medium, high, critical
- `omb_data_types` (string): OMB M-23-02 item 8: types of data
- `omb_fips199` (string): OMB M-23-02 item 2: low, moderate or high
- `omb_fisma_id` (string): OMB M-23-02 item 1: FISMA system identifier (an identifier only)
- `omb_hva_id` (string): OMB M-23-02 item 3: HVA identifier
- `omb_notes` (string): OMB M-23-02 item 9: additional notes
- `omb_profile` (string): OMB M-23-02 report: the system profile (TOML file)
- `omb_time_to_live` (string): OMB M-23-02 item 8: time to live
- `output` (string): Write the report to this file instead of returning it inline (inline results are limited to 10 KB)
- `recursive` (boolean): Scan subdirectories (default: true)

### `qnsqy_version` (~29 tokens)

Show the QNSQY version

Version info. Always FREE.

Input parameters:

- `verbose` (boolean): Show extended algorithm/feature info

### `qnsqy_status` (~18 tokens)

Show account and plan status

Account & tier status. Always FREE.

### `qnsqy_usage` (~17 tokens)

Show usage

Credit usage info. Always FREE.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/quantumsequrity-qnsqy/qnsqy#diagnostics

## Score history

- 2026-11-04: 61
- 2026-11-03: 61
- 2026-11-02: 45
- 2026-11-01: 60

## Common questions

### What is the QNSQY MCP server?

QNSQY is an MCP server listed in the public MCP registry as io.github.quantumsequrity/qnsqy. Linux only, local: post-quantum CBOM scan, encrypt to public keys, verify. Takes no secrets. This page covers its npm package (qnsqy).

### Is the QNSQY MCP server safe to use?

QNSQY scores 61 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the QNSQY MCP server expose?

QNSQY exposes 10 tools: qnsqy_encrypt, qnsqy_verify, qnsqy_verify_release, qnsqy_hash, qnsqy_hash_verify, and 5 more. Their descriptions and schemas cost roughly 1,154 tokens of context every time the server is loaded.

### Is the QNSQY MCP server still maintained?

QNSQY is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- npm package: https://www.npmjs.com/package/qnsqy
- Socket report: https://socket.dev/npm/package/qnsqy
- Changelog RSS feed: https://verifymcp.io/servers/quantumsequrity-qnsqy/qnsqy.xml
- Changelog JSON feed: https://verifymcp.io/servers/quantumsequrity-qnsqy/qnsqy.json
- HTML version of this page: https://verifymcp.io/servers/quantumsequrity-qnsqy/qnsqy