MCP Server

qtz-discovery-cli mcp serve starts a Model Context Protocol (MCP) server, exposing all scan commands as tools that AI assistants (Claude Desktop, Cursor, Windsurf, etc.) can call directly. Ask your AI to scan your codebase for quantum vulnerabilities without leaving your editor.

Usage

qtz-discovery-cli mcp serve [--addr ADDRESS] [--transport TYPE]

# stdio transport — default, for Claude Desktop / Cursor
qtz-discovery-cli mcp serve

# SSE transport — listen on localhost (default when --addr is set)
qtz-discovery-cli mcp serve --addr 127.0.0.1:8080

# Streamable HTTP transport — MCP 2025-03-26 spec
qtz-discovery-cli mcp serve --addr 0.0.0.0:8080 --transport streamable-http

Flags

Transport endpoints

Claude Desktop Configuration

Add the following to your Claude Desktop configuration file:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "qtz": {
      "command": "/path/to/qtz-discovery-cli",
      "args": ["mcp", "serve"],
      "env": {
        "QTZ_SERVER_URL": "https://your-portal-url",
        "QTZ_SERVER_ORG_ID": "your-org-id",
        "QTZ_SERVER_API_KEY": "your-api-key"
      }
    }
  }
}

Restart Claude Desktop after saving. You will see a qtz tool group appear in the tool picker.

Cursor / Windsurf Configuration

Add to your project's .cursor/mcp.json or .windsurf/mcp.json:

{
  "servers": {
    "qtz": {
      "type": "stdio",
      "command": "/path/to/qtz-discovery-cli",
      "args": ["mcp", "serve"]
    }
  }
}

Available MCP Tools

Tools marked experimental require --experimental when starting the server: qtz-discovery-cli mcp serve --experimental

scan_source parameters

scan_network parameters (experimental)

scan_iac parameters (experimental)

scan_infra parameters (experimental)

scan_runtime parameters (experimental)

upload_findings parameters

get_usage parameters

Example AI Prompts

Once connected, you can use natural language to drive scans:

"Scan the current project directory for quantum-vulnerable cryptography and give me the top 5 critical findings."

"Check if api.example.com:443 is using any deprecated TLS ciphers or lacks a post-quantum key exchange."

"Scan the Terraform configs in ./infra for any cryptographic resources that use deprecated algorithms."

Portal Connection

Connect the MCP server to your Quantizant portal to enable AI risk scoring, the upload_findings tool, and LLM-enhanced source analysis. Set the following environment variables or add them to your config file:

# Environment variables
export QTZ_SERVER_URL=https://your-portal-url
export QTZ_SERVER_ORG_ID=your-org-id
export QTZ_SERVER_API_KEY=your-api-key

# Config file: ~/.qtz/config.yaml
server:
  url: https://your-portal-url
  org_id: your-org-id
  api_key: your-api-key

Config files are searched in order: .qtz-discovery.yaml (current directory), config.yaml (current directory), then ~/.qtz/config.yaml.

Security Considerations

• The MCP server runs with the same filesystem permissions as the invoking user.
• HTTP transport is not authenticated by default — only expose it on localhost or behind a reverse proxy with auth.
• API keys are never logged or exposed in tool responses.
• For team environments, prefer stdio transport through a per-user install rather than a shared HTTP server.