AI agent integration

Give your agent PostQ tools

postq-mcp connects GitHub Copilot, VS Code, Claude, Cursor, and compatible MCP clients to the same scanners and hybrid-signing controls available in the PostQ CLI.

Configure itView source
Local stdio transport•Pure Go•Four bounded tools•No runtime dependencies
Tools

Discover, sign, and verify from chat

Offline scans need no PostQ credential. Uploaded URL scans and signing tools use the API key saved by postq auth login.

scan_url

Runs a live TLS handshake, reports vulnerable certificate keys, signatures, and key exchange, and persists the result by default.

API key by default · upload=false offline

scan_code

Reads a local path and detects weak RNG, signing hashes, JWT alg:none, AES-ECB, hardcoded keys, and classical-only signing.

Local files · no API key

sign

Signs UTF-8 data with a managed ML-DSA + classical hybrid key.

PostQ API key

verify

Verifies both halves of a PostQ hybrid signature and returns the complete verdict.

PostQ API key

Quickstart

Install both static binaries

Homebrew installs postq and postq-mcp. Go and release-archive installs are also supported.

brew install PostQDev/tap/postq

# Or install with Go:
go install github.com/postqdev/postq-cli/cmd/postq@latest
go install github.com/postqdev/postq-cli/cmd/postq-mcp@latest

# Optional: authenticate once for sign and verify
postq auth login

VS Code and GitHub Copilot

Run MCP: Add Server and choose stdio, or save this as .vscode/mcp.json. Start the server, then enable its tools from Chat's Configure Tools menu.

{
  "servers": {
    "postq": {
      "type": "stdio",
      "command": "postq-mcp",
      "env": { "POSTQ_BIN": "postq" }
    }
  }
}

Claude Desktop or Cursor

Add the server to the client's MCP configuration. Absolute paths pin the exact trusted binaries that the client executes.

{
  "mcpServers": {
    "postq": {
      "command": "/absolute/path/to/postq-mcp",
      "env": { "POSTQ_BIN": "/absolute/path/to/postq" }
    }
  }
}
Security boundary

Local and deliberately bounded

  • The server invokes the pinned CLI directly—never through a shell.
  • Frames, signed payloads, subprocess output, and execution time are capped.
  • scan_code reads only the path approved in the tool call.
  • scan_url makes an outbound TLS connection to the requested host.
  • URL scans upload by default; an approved tool call can explicitly set upload=false for local-only execution.
  • This is a local stdio server, not a hosted remote MCP endpoint.
Troubleshooting

Fast checks

command -v postq
command -v postq-mcp
postq version

# Raw handshake and tool discovery
printf '%s\n' \
  '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{}}}' \
  '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' \
  | postq-mcp

For timeouts, set POSTQ_MCP_TIMEOUT=5m. The accepted range is one second to ten minutes.

Ask an agent to run the first scan

“Use PostQ to scan example.com and explain which cryptography must migrate before a cryptographically relevant quantum computer.”

Read the integration reference