q-armor-proxy

The enterprise runtime of QArmor: a protection proxy that turns a silent harvest into an alert with a timestamp.

Prevention alone has a hole in it: if somebody copies your traffic today and decrypts it in 2032, nothing in your logs will ever say it happened. Canary tokens close that hole. They are bait that only a decrypted capture can lead anyone to, so the day one is visited you learn two things at once: that the capture existed, and roughly when it was read.

It sits in front of a validator and does three things:

• Injects canary tokens into the traffic, to detect HNDL harvesting.
• Blocks origins by list, at the door.
• Fires the full alert when a canary is visited: SIEM notification, key rotation and blocking, in one path.

Run it

pip install 'q-armor-cli[proxy]'
q-armor proxy --host 0.0.0.0 --port 8080

The proxy extra pulls this package and uvicorn. It is an extra on purpose: an operator who only scans does not need FastAPI installed, and the import lives inside the command so that its absence cannot break scan or vqs.

From a checkout of the workspace:

pip install -e packages/q-armor-lib -e packages/q-armor-proxy

It does not implement cryptography

It consumes q-armor-lib, the same library the CLI and the dashboard consume. A second scanner here would be another surface producing the key_establishment_class axis and diverging in silence (see docs/layer-placement.md §8).

It stays in Python rather than TypeScript for a measured reason, not out of inertia: the proxy has no cryptographic tie of its own (it imports neither ML-KEM nor ML-DSA), but migrating it would force porting the whole of q-armor-lib and would leave three implementations of the same axis instead of two.

The QArmor family

Five packages, one version, published together from a single tag.

Next

The proxy is the enterprise tier: real-time alerting, SLA and on-premise deployment. idenq.io