# io.github.shemshallah/qtcl-mcp-server (remote · qtcl-blockchain.koyeb.app)

Agent-native post-quantum blockchain. 11 tools: send, balance, quantum oracle metrics. Flat fee.

- Trust score: 55/100 (low)
- Change this week: −3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `qtcl-blockchain.koyeb.app`: 55/100 (this document), [markdown](https://verifymcp.io/servers/shemshallah-qtcl-mcp-server/qtcl-blockchain.md), [page](https://verifymcp.io/servers/shemshallah-qtcl-mcp-server/qtcl-blockchain)

## Channel facts

- Endpoint: `https://qtcl-blockchain.koyeb.app/mcp/sse`
- Transports: `sse`
- Auth: `none`
- Version: `8.2.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 46/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 22 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS check failed: the endpoint is reachable over plaintext HTTP.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 40/100
  - Verified sse transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 78/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 2685 tokens (~103/item across 26 items; 22 tools + 4 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http shemshallah-qtcl-mcp-server https://qtcl-blockchain.koyeb.app/mcp/sse
```

### Codex

```toml
[mcp_servers.shemshallah-qtcl-mcp-server]
url = "https://qtcl-blockchain.koyeb.app/mcp/sse"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "shemshallah-qtcl-mcp-server": {
      "type": "remote",
      "url": "https://qtcl-blockchain.koyeb.app/mcp/sse",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add shemshallah-qtcl-mcp-server --url https://qtcl-blockchain.koyeb.app/mcp/sse --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  shemshallah-qtcl-mcp-server:
    url: "https://qtcl-blockchain.koyeb.app/mcp/sse"
```

### Other

```json
{
  "mcpServers": {
    "shemshallah-qtcl-mcp-server": {
      "type": "http",
      "url": "https://qtcl-blockchain.koyeb.app/mcp/sse"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 55, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 54, −2)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 56, −3)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 59, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 58, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 57)

First indexed and scored.

## MCP tools (22)

### `qtcl_create_wallet` (~89 tokens)

Create a new QTCL post-quantum wallet backed by a real HypΓ keypair (Schnorr-Γ over SL(3,p), 512-step random walk, SHA3-256² address). Returns private_key, public_key, address, and created_at. Store private_key securely — the server never retains it.

Input parameters:

- `label` (string): Optional human-readable wallet label

### `qtcl_sign_message` (~205 tokens)

Sign a 32-byte message hash with a HypΓ private key using Schnorr-Γ. To sign a transaction, compute: SHA3-256(JSON.dumps({"sender": from_addr, "recipient": to_addr, "amount": amount_float, "nonce": nonce_int}, sort_keys=True)) → pass the 64-char hex as message_hex. The nonce MUST match the nonce you will use in qtcl_send_transaction. Returns the full signature dict (with canonical R/Z matrix fields) — pass the entire JSON output as the signature field to qtcl_send_transaction. CRITICAL: use the 'signature_for_tx' field from the response as the 'signature' argument to qtcl_send_transaction — do not extract sub-fields.

Input parameters:

- `message_hex` (string, required): 64 hex chars (32-byte SHA3-256 hash of tx signing payload)
- `private_key` (string, required): HypΓ private key from qtcl_create_wallet (512-char base-4 walk)

### `qtcl_get_balance` (~62 tokens)

Check QTCL balance for any address. Returns balance in base units (qsat), UTXO count, and UTXO list. 1 QTCL = 100 qsat.

Input parameters:

- `address` (string, required): 64-char hex QTCL address

### `qtcl_get_utxos` (~70 tokens)

List unspent transaction outputs (UTXOs) for an address. Returns tx_hash, output_index, amount_base per coin.

Input parameters:

- `address` (string, required): 64-char hex QTCL address
- `limit` (integer): Max UTXOs to return (default 1000)

### `qtcl_send_transaction` (~377 tokens)

Submit a signed UTXO transaction to the QTCL network. Flat fee: 1 qsat. Finality: ~18 seconds. WORKFLOW: (1) pick nonce = int(time.time()*1000) [ms epoch]. (2) build payload = JSON.dumps({sender,recipient,amount,nonce}, sort_keys=True). (3) hash = SHA3-256(payload) as 64-char hex. (4) call qtcl_sign_message(message_hex=hash, private_key=key). (5) pass the 'signature_for_tx' field from step 4 as the 'signature' arg here, with the SAME nonce used in steps 1-4. CRITICAL: nonce must be a millisecond timestamp (>1700000000000) to avoid nonce_replay rejection. Never use sequential integers.

Input parameters:

- `amount` (number, required): Amount in QTCL (not qsat). 1 QTCL = 100 qsat.
- `from_address` (string, required): Sender's 64-char hex QTCL address
- `memo` (string): Optional transaction memo (max 256 chars)
- `nonce` (integer): Replay-prevention nonce — MUST be a millisecond epoch timestamp (int(time.time()*1000), e.g. ~1779000000000). Must match the nonce used in the signing payload. Auto-generated as ms timestamp if omitt…
- `public_key` (string): HypΓ public key hex from qtcl_create_wallet
- `signature` (string): Use the 'signature_for_tx' value from qtcl_sign_message output — it is the full canonical sig JSON string with R, Z, c_full, challenge fields. Do NOT extract sub-fields. Pass signature_for_tx verbati…
- `to_address` (string, required): Recipient's 64-char hex QTCL address

### `qtcl_get_transaction` (~49 tokens)

Look up a QTCL transaction by its SHA3-256 hash. Returns full tx details, status, and block height.

Input parameters:

- `tx_hash` (string, required): 64-char hex transaction hash

### `qtcl_get_chain_info` (~33 tokens)

Current blockchain state: height, latest block hash, mempool depth, oracle status, and system health vector.

### `qtcl_get_block` (~64 tokens)

Retrieve a block by height (integer) or hash (hex string). Omit both for the latest block.

Input parameters:

- `hash` (string): Block hash hex (takes priority over height)
- `height` (integer): Block height (0 = genesis; omit for latest)

### `qtcl_get_recent_transactions` (~64 tokens)

List recent transactions, optionally filtered by address. Returns newest first. Max 50 per call.

Input parameters:

- `address` (string): Optional: filter by sender or receiver address
- `per_page` (integer): Results per page (default 20, max 50)

### `qtcl_get_quantum_metrics` (~59 tokens)

Live quantum coherence metrics: W-state fidelity (≥0.75 healthy), entanglement witness (NPT criterion), oracle consensus round, Mermin inequality test, and kappa=0.11 non-Markovian coherence score.

### `qtcl_get_oracle_registry` (~52 tokens)

List registered quantum oracle nodes participating in 5-oracle Byzantine consensus (3-of-5 majority).

Input parameters:

- `limit` (integer): Max oracles to return (default 10, max 100)

### `qtcl_get_peers` (~43 tokens)

List active P2P peers in the QTCL Kademlia DHT network.

Input parameters:

- `limit` (integer): Max peers to return (default 20)

### `qtcl_get_price` (~48 tokens)

QTCL network quantum coherence metrics and valuation signals. Note: QTCL has no public USD exchange. Returns W-state fidelity, entanglement witness, and oracle coherence as network health proxy.

### `qtcl_retro_settle` (~60 tokens)

Retroactively settle all blocks whose UTXOs are missing from address_utxos. Safe to call repeatedly — idempotent. Returns counts of settled/skipped/error blocks. Use this when miner balance is lower than expected after mining blocks.

### `qtcl_repair_utxos` (~78 tokens)

Nuclear UTXO repair: bypasses settlement machinery and directly inserts missing UTXOs from the transactions table. Use when qtcl_retro_settle reports success but UTXOs are still missing. Commits per-UTXO for maximum isolation. Returns repaired_blocks, repaired_utxos, recomputed_wallets counts.

### `qtcl_submit_block` (~419 tokens)

Submit a fully PoW-solved and HypΓ-signed block to the chain. This is the unified miner submission path. The miner client performs PoW locally, signs the block header, then calls this with the complete payload. Required: height, block_hash, parent_hash, merkle_root, timestamp, nonce, miner_address, difficulty_bits, w_entropy_hash, hyp_signature, miner_public_key_hex. Optional: transactions (JSON array), w_state_fidelity, pq0, pq_curr, pq_last, mermin_value, mermin_violated, quantum_field_16x16x16. Returns: {status, height, block_hash, next_height, miner_reward_qtcl}.

Input parameters:

- `block_hash` (string, required): Block hash hex
- `difficulty_bits` (integer, required): Difficulty bits
- `height` (integer, required): Block height
- `hyp_signature` (string, required): HypΓ block signature
- `merkle_root` (string, required): Merkle root hex
- `mermin_value` (number): Mermin inequality value (default 0.0)
- `mermin_violated` (boolean): Mermin violation flag (default false)
- `miner_address` (string, required): Miner's QTCL address
- `miner_public_key_hex` (string, required): Miner's public key hex
- `nonce` (integer, required): PoW nonce
- `parent_hash` (string, required): Parent block hash hex
- `pq0` (integer): Initial oracle PQ counter (default 0)
- `pq_curr` (integer): Current oracle PQ counter (default 0)
- `pq_last` (integer): Last oracle PQ counter (default 0)
- `quantum_field_16x16x16` (string): Quantum field data (default empty)
- `timestamp` (integer, required): Block timestamp (epoch seconds)
- `transactions` (string): JSON array string of transactions (default [])
- `w_entropy_hash` (string, required): W-state entropy hash
- `w_state_fidelity` (number): W-state fidelity (default 0.75)

### `qtcl_quantum_encrypt` (~217 tokens)

Quantum-bound encryption via IBM QLDPC hardware (ibm_marrakesh/ibm_kingston). Two modes:
  quantum_bound (async=false, default): XOR-masks the encapsulated key with a hardware-derived quantum key. Runs synchronously with 8192 shots for deterministic results. Recipient MUST use qtcl_quantum_decrypt to recover the key.
  attestation (async=true): Leaves encapsulated key unchanged, runs hardware in background. Attaches quantum_commitment as metadata. Classical decrypt still works.
Returns: Ciphertext dict with quantum_commitment, quantum_status, quantum_mode, quantum_hardened, and all standard encryption fields.

Input parameters:

- `async` (boolean): True for attestation mode, false for quantum-bound (default false)
- `ibm_token` (string): Per-request IBM Quantum API token (optional — uses server env var if blank)
- `plaintext_hex` (string, required): Hex-encoded plaintext bytes to encrypt
- `public_key` (string, required): Recipient's public key (hex)

### `qtcl_quantum_decrypt` (~155 tokens)

Decrypt quantum-bound or quantum-assisted ciphertext. Auto-detects mode from the ciphertext dict:
  quantum_bound → runs QLDPC pipeline on masked key, XOR-unmasks, decrypts
  attestation   → tries classical first, falls back to quantum-assisted recovery
  classical     → pure classical decrypt
Returns: Plaintext (hex), plaintext_length, quantum_assisted flag, quantum_mode.

Input parameters:

- `ciphertext` (string, required): JSON string of the ciphertext dict from qtcl_quantum_encrypt (must include quantum_commitment, quantum_mode, etc.)
- `ibm_token` (string): Per-request IBM Quantum API token (optional)
- `private_key` (string, required): Recipient's private key (hex)

### `qtcl_quantum_pipeline` (~148 tokens)

Run the full QLDPC pipeline directly on IBM quantum hardware. Encodes ciphertext bytes into a hyperbolic QLDPC code, runs on real IBM hardware (8192 shots), decodes syndromes via BP+OSD, and returns the recovered key fragment. Returns: Pipeline result with recovered_key_hex, residual, status, job_id, backend.

Input parameters:

- `ciphertext_hex` (string, required): Hex-encoded bytes to use as key fragment input
- `genus` (integer): Hyperbolic surface genus (default 1)
- `ibm_token` (string): Per-request IBM Quantum API token (optional)
- `shots` (integer): Measurement shots (default 8192)

### `qtcl_create_hybrid_wallet` (~105 tokens)

Create a new QTCL wallet with HYBRID post-quantum keys: Falcon-512 (NIST FIPS 206, 128-bit PQ security) + SL(3,p) (~70-bit classical). Returns full keypair dict with both Falcon and SL(3,p) components. Server does NOT retain secret keys. This is the v3 recommended wallet type — quantum-safe by default.

Input parameters:

- `label` (string): Optional human-readable wallet label

### `qtcl_sign_message_hybrid` (~163 tokens)

Sign a 32-byte message hash with HYBRID PQC (Falcon-512 + SL(3,p)). Both Falcon and SL(3,p) signatures are computed independently — verification requires BOTH to be valid. message_hex must be 64 hex chars (SHA3-256 of signing payload). private_key_json must be the full JSON output from qtcl_create_hybrid_wallet. Returns hybrid signature dict — pass verbatim as 'signature' to qtcl_send_transaction.

Input parameters:

- `message_hex` (string, required): 64 hex chars (32-byte SHA3-256 hash of tx signing payload)
- `private_key_json` (string, required): Full JSON string from qtcl_create_hybrid_wallet (contains both Falcon and SL(3,p) secret keys)

### `qtcl_get_pqc_status` (~51 tokens)

Return PQC module status — shows whether Falcon-512 is available, key/signature sizes, security level, and hybrid signature overhead. Use to check if the server supports full hybrid PQ signatures.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/shemshallah-qtcl-mcp-server/qtcl-blockchain#diagnostics

## Score history

- 2026-08-03: 55
- 2026-08-02: 54
- 2026-08-01: 54
- 2026-07-31: 54
- 2026-07-30: 56
- 2026-07-29: 59
- 2026-07-28: 58
- 2026-07-27: 58
- 2026-07-26: 57

## Links

- Remote endpoint: https://qtcl-blockchain.koyeb.app/mcp/sse
- Repository: https://github.com/shemshallah/qtcl-mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/shemshallah-qtcl-mcp-server/qtcl-blockchain/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/shemshallah-qtcl-mcp-server/qtcl-blockchain/changelog.json
- HTML version of this page: https://verifymcp.io/servers/shemshallah-qtcl-mcp-server/qtcl-blockchain