Qorex

Scan your codebase for quantum-vulnerable cryptography and get NIST PQC migration guidance.

Government mandates (CNSA 2.0, CMMC) require organizations to migrate away from quantum-vulnerable cryptography by 2030. Qorex finds the vulnerable code for you and tells you exactly what to replace it with.

Install

pip install qorex

Usage

# Scan a directory
qorex scan ./my-project

# Scan current directory
qorex scan

# Export full JSON report with migration guidance
qorex scan ./my-project --report json --output report.json

What it detects

Languages supported: Python, C, C++, Go, Java

Example output

qorex — scanned ./my-project

 Risk       Algorithm   File                          Line   Match
 ────────── ─────────── ───────────────────────────── ────── ──────────────────────
 CRITICAL   RSA         src/auth/keys.py               12    rsa.generate_private_key
 CRITICAL   ECDSA       src/crypto/sign.go             34    ecdsa.Sign
 HIGH       SHA-256     src/utils/hash.java            8     SHA-256

3 finding(s) — run with --report json for full details and migration guidance.

JSON report

qorex scan . --report json --output report.json

Each finding includes the file, line, algorithm, risk level, plain-English explanation, NIST replacement algorithm, and migration guidance.

Roadmap

• CBOM (Cryptographic Bill of Materials) export
• CNSA 2.0 / CMMC compliance reports
• CI/CD integrations (GitHub Actions, GitLab CI)
• Tree-sitter AST scanning for C/C++

Contributing

Issues and PRs welcome. See CONTRIBUTING.md for guidelines.

License

MIT — see LICENSE.