A native MCP server that exposes up to 108 tools (52 on Free, 83 on Pro, all 108 on Business) over JSON-RPC 2.0, so your agent can encrypt, sign, and verify with post-quantum cryptography natively. Built for Claude, Cursor, Cline, and any Model Context Protocol client. Launch it with qnsqy --mcp.
This page describes the MCP server of the Standard edition. In the Approved Mode edition (not released) it offers only the tools of approved commands; in the CNSA 2.0 edition it runs only the tools that need no Crypto Officer secret. The three editions.
AI agents are no longer toy demos. They draft contracts, touch patient records, move financial data, and handle credentials on your behalf. The moment an agent works with something that needs to stay secret for decades, it inherits the same problem every human user has: classical encryption has a countdown clock, and Harvest Now, Decrypt Later is already in progress.
QNSQY gives agents a first-class way to do cryptography correctly. The crypto operations of the command line are exposed to the agent over the Model Context Protocol, using the same NIST post-quantum standards, the same tier enforcement, and the same local execution. The agent does not reimplement crypto, and it does not ship your keys anywhere. It calls a tool, and the work happens locally on your machine.
The command line's operations are registered as MCP tools: encrypt, decrypt, sign, verify, hash, key management, and more. Transport is JSON-RPC 2.0 over stdio, one JSON message per line, the standard MCP stdio transport; Content-Length framing is also accepted.
The MCP server is not a separate codebase. It is the same qnsqy binary the CLI, GUI, and TUI use, in MCP mode. Same algorithms, same audit trail, same fail-closed defaults.
Any MCP-compatible client can connect: Claude, Cursor, Cline, and others. Point the client at the qnsqy binary with the --mcp flag and the tools appear.
The MCP server runs under the host user's tier and billing. There is no separate agent account to provision. Plan checks work exactly as they do on the command line.
Tool calls execute on your machine. File content and private keys do not transit to QNSQY. On Linux, the same seccomp-bpf network lockdown that protects the CLI applies.
Most MCP clients read a JSON config that lists each server by command and arguments. Add an entry that runs the qnsqy binary with --mcp and your agent gains every tool your plan includes. Replace the command path with wherever you installed the binary.
{
"mcpServers": {
"qnsqy": {
"command": "qnsqy",
"args": ["--mcp"]
}
}
}
If qnsqy is not on your PATH, use an absolute path such as /usr/bin/qnsqy (where the Linux .deb and .rpm packages install it) or the full install path on Windows. You can also symlink the binary as qnsqy-mcp, which starts in MCP mode without the flag.
An agent is an untrusted, high-frequency caller by default. The MCP server is hardened with that assumption baked in.
Capped at 60 requests per minute. When the limit is reached, the server refuses rather than degrading silently. A runaway agent cannot turn your machine into a crypto-grinding loop.
Private key material is never returned over the wire. The agent can request signatures and decryptions, but it cannot exfiltrate the keys that produce them.
Passwords and other sensitive arguments are wrapped in zeroizing buffers, so they are scrubbed from memory after use rather than lingering.
The same tier, billing, and sandbox enforcement as the CLI applies to every tool call. The agent gets exactly the capabilities your subscription grants, no more.
Honest scope
QNSQY uses NIST-standardized post-quantum algorithms; the open-source libraries it ships are tested byte-for-byte against NIST ACVP test vectors (19,769 / 0). It is not FIPS 140-3 validated and holds no CMVP certificate. On Linux, the kernel-level network lock (seccomp-bpf) applies to every tool call. On Windows, run as administrator, a firewall rule blocks QNSQY's outbound traffic during each operation; for the strongest isolation, disconnect the network. There is no macOS build. The MCP server inherits the host user's session and tier; it adds no separate authentication layer of its own.
Not available yet. The pay-per-operation tools are built, but our billing server does not take payments yet: a quote request currently answers "Payment service not configured". When it opens, an agent will pay for individual operations with USDC micropayments on Base L2, through QNSQY's own quote, pay and verify flow (ATXP), with no subscription to manage. Until then, an agent uses the plan of the account that runs the MCP server.
How it will work:
Free operations
Encrypt, decrypt, sign and verify with ML-KEM-512 and ML-DSA-44 are free on every plan, so routine quantum-safe work never needs a payment.
The strongest argument for post-quantum cryptography in 2026 is no longer just long-retention human data. It is that agents are becoming the primary thing that touches sensitive data, and they touch it constantly. An agent that signs a document, encrypts an export, or wraps a secret should be doing so with primitives that survive a cryptographically relevant quantum computer, not with whatever classical default it happened to import.
QNSQY makes the quantum-safe path the easy path for agents: native tools, per-operation accounting, keys that stay put, and a wire protocol your client already speaks. The same standards a hospital, a journalist, or a defence contractor would choose, now callable by the software working on their behalf.
Download QNSQY, then start the MCP server with qnsqy --mcp and connect your client. Read the docs for the full tool reference and the ATXP payment flow.