A native MCP server that exposes 84 tools over JSON-RPC 2.0, so your agent can encrypt, sign, and verify with post-quantum cryptography natively. Built for Claude, Cursor, Cline, and any Model Context Protocol client. Launch it with qnsqy --mcp.
AI agents are no longer toy demos. They draft contracts, touch patient records, move financial data, and handle credentials on your behalf. The moment an agent works with something that needs to stay secret for decades, it inherits the same problem every human user has: classical encryption has a countdown clock, and Harvest Now, Decrypt Later is already in progress.
QNSQY gives agents a first-class way to do cryptography correctly. Every crypto operation available on the command line is exposed to the agent over the Model Context Protocol, using the same NIST post-quantum standards, the same tier enforcement, and the same air-gapped local execution. The agent does not reimplement crypto, and it does not ship your keys anywhere. It calls a tool, and the work happens locally on your machine.
Every CLI crypto operation is registered as an MCP tool: encrypt, decrypt, sign, verify, hash, key management, and more. Transport is JSON-RPC 2.0 over stdio with Content-Length framing, the standard MCP wire format.
The MCP server is not a separate codebase. It is the same qnsqy binary the CLI, GUI, and TUI use, in MCP mode. Same algorithms, same audit trail, same fail-closed defaults.
Any MCP-compatible client can connect: Claude, Cursor, Cline, and others. Point the client at the qnsqy binary with the --mcp flag and the tools appear.
The MCP server runs under the host user's tier and billing. There is no separate agent account to provision. Algorithm gating and credit accounting work exactly as they do on the CLI.
Tool calls execute on your machine. File content and private keys do not transit to QNSQY. On Linux, the same seccomp-bpf network lockdown that protects the CLI applies.
Most MCP clients read a JSON config that lists each server by command and arguments. Add an entry that runs the qnsqy binary with --mcp and your agent gains all 84 tools. Replace the command path with wherever you installed the binary.
{
"mcpServers": {
"qnsqy": {
"command": "qnsqy",
"args": ["--mcp"]
}
}
}
If qnsqy is not on your PATH, use an absolute path such as /usr/local/bin/qnsqy (Linux/macOS) or the full install path on Windows. You can also symlink the binary as qnsqy-mcp, which starts in MCP mode without the flag.
An agent is an untrusted, high-frequency caller by default. The MCP server is hardened with that assumption baked in.
Capped at 60 requests per minute. When the limit is reached, the server refuses rather than degrading silently. A runaway agent cannot turn your machine into a crypto-grinding loop.
Private key material is never returned over the wire. The agent can request signatures and decryptions, but it cannot exfiltrate the keys that produce them.
Passwords and other sensitive arguments are wrapped in zeroizing buffers, so they are scrubbed from memory after use rather than lingering.
The same tier, billing, and sandbox enforcement as the CLI applies to every tool call. The agent gets exactly the capabilities your subscription grants, no more.
Honest scope
QNSQY uses NIST-standardized post-quantum algorithms and is validated byte-for-byte against NIST ACVP test vectors (18,703 / 0). It is not FIPS 140-3 / CMVP certified; that is on the roadmap. The kernel-level network lockdown applies on the Linux CLI via seccomp-bpf. On Windows and macOS, use a physical air-gap for the strongest isolation. The MCP server inherits the host user's session and tier; it adds no separate authentication layer of its own.
Heavier post-quantum operations cost credits. Rather than forcing a human to manage a subscription for an autonomous workload, QNSQY lets an agent pay for individual operations on demand using USDC micropayments on Base L2, via the x402 / ATXP standard. The agent gets a quote, pays, and the operation unlocks. No retainer, no pre-provisioned balance required.
Tier note
Agentic commerce (x402 / ATXP USDC settlement on Base L2) is a Business tier capability. Baseline operations like encrypt, decrypt, sign, and verify with ML-KEM-512 + ML-DSA-44 cost 0 credits on every tier, so an agent doing routine quantum-safe crypto never needs to pay per call.
The strongest argument for post-quantum cryptography in 2026 is no longer just long-retention human data. It is that agents are becoming the primary thing that touches sensitive data, and they touch it constantly. An agent that signs a document, encrypts an export, or wraps a secret should be doing so with primitives that survive a cryptographically relevant quantum computer, not with whatever classical default it happened to import.
QNSQY makes the quantum-safe path the easy path for agents: native tools, per-operation accounting, keys that stay put, and a wire protocol your client already speaks. The same standards a hospital, a journalist, or a defence contractor would choose, now callable by the software working on their behalf.
Download QNSQY, then start the MCP server with qnsqy --mcp and connect your client. Read the docs for the full tool reference and the x402 / ATXP payment flow.