Scan and migrate classical cryptography to NIST post-quantum standards (ML-KEM, ML-DSA, SLH-DSA)
Migrate your codebase from classical cryptography to NIST post-quantum standards. Supports any programming language.
The user invoked this with: $ARGUMENTS
Parse the arguments as follows:
full: Run the complete pipeline (scan → migrate → validate)scan: Run only the scanner agent -- find classical crypto, produce a reportscan [path]: Scan a specific directory or filemigrate: Run only the migrator agent (requires a prior scan report in the conversation)validate: Run only the validator agent (requires a prior migration in the conversation)full [path]: Run the complete pipeline on a specific pathThree algorithms replace all classical public-key cryptography:
| Standard | Algorithm | Replaces |
|---|---|---|
| FIPS 203 | ML-KEM | RSA key exchange, ECDH, DH, X25519 |
| FIPS 204 | ML-DSA | RSA signatures, ECDSA, EdDSA, DSA |
| FIPS 205 | SLH-DSA | Same as ML-DSA (conservative hash-based fallback) |
Additionally flags AES-128 (→ AES-256), broken hashes (MD5, SHA-1 → SHA-256+), and deprecated ciphers (DES, 3DES, RC4 → AES-256-GCM).
scanLaunch the scanner agent with the following prompt:
Scan the codebase at
[path or current working directory]for classical cryptographic usage vulnerable to quantum attacks. Follow your scanning procedure to identify all instances of RSA, ECC, DH, DSA, weak symmetric ciphers, and broken hashes across all programming languages present. Produce a structured Quantum Vulnerability Scan Report.
The scanner agent is read-only and safe to run on any codebase. It will:
After the scan completes, display the report to the user. If running in full mode, proceed to migration.
migrateLaunch the migrator agent with the following prompt:
Using the scan report below, migrate all classical cryptographic code to NIST post-quantum alternatives. For each finding, check the library matrix to determine the best PQC library for the target language. Use existing libraries when available; write FFI bindings to liboqs for languages without native PQC libraries. Use hybrid mode (classical + PQC) for TLS/protocol contexts. Produce a structured Quantum Migration Report.
Scan Report: [paste the scanner's output]
The migrator agent will:
After migration completes, display the report to the user. If running in full mode, proceed to validation.
validateLaunch the validator agent with the following prompt:
Validate the post-quantum migration using the migration report below. Re-scan for remaining classical crypto, verify dependencies resolve, attempt to build the project, run existing tests, and check all custom implementations. Produce a structured Quantum Migration Validation Report.
Migration Report: [paste the migrator's output]
The validator agent will:
full (default)Execute all three phases in sequence:
Between phases, briefly summarize the results to the user before proceeding to the next phase.
Every day that classical cryptography remains in your codebase is another day that encrypted data can be harvested for future quantum decryption. NIST finalized these standards in August 2024. The migration window is now. Run /quantum-secure scan today to understand your exposure.