MCP server for post-quantum TLS checks

Connect it

Add the URL above as a remote MCP server (also called a custom connector) in any client that supports the Streamable HTTP transport. No authentication is needed.

Claude (web and desktop)

In Settings, open Connectors, choose Add custom connector, name it “CRYPTAGION” and paste https://www.cryptagion.io/mcp. Then enable it in a conversation from the tools menu.

Claude Code

claude mcp add --transport http cryptagion https://www.cryptagion.io/mcp

ChatGPT

Custom MCP connectors are available in ChatGPT’s developer mode (Settings → Apps & Connectors). Create a connector with the URL above and no authentication.

Cursor

In ~/.cursor/mcp.json (or .cursor/mcp.json in a project):

{
  "mcpServers": {
    "cryptagion": { "url": "https://www.cryptagion.io/mcp" }
  }
}

VS Code (agent mode)

In .vscode/mcp.json:

{
  "servers": {
    "cryptagion": { "type": "http", "url": "https://www.cryptagion.io/mcp" }
  }
}

Things to ask

Is www.example.com ready for post-quantum TLS?
Check our three customer portals for hybrid ML-KEM and TLS 1.0 support, and summarise in a table.
How many European banks’ websites accept hybrid ML-KEM, according to CRYPTAGION’s study?
Our site is behind a CDN and accepts ML-KEM. What does that not cover?

Tools

Tool	Input	What it returns
`check_tls_quantum_readiness`	`domain`: a public hostname (a pasted URL is accepted; only the hostname is used)	Whether the server accepts hybrid ML-KEM (X25519MLKEM768), the TLS version, cipher and key-exchange group negotiated by default, whether TLS 1.0/1.1 are still accepted, and the leaf certificate (key type and size, signature algorithm, issuer, expiry). The same check as our TLS quantum checker.
`get_eu_ml_kem_study`	none	The aggregates of our EU ML-KEM adoption study: overall, by segment, by hosting provider and by country. No organisation is named.

Each tool answers with a short text summary for the assistant and the full JSON result as structuredContent. Both tools are read-only and declared as such (readOnlyHint).

Limits and privacy

What the check does: at most three TLS handshakes to the domain on port 443. No web page is requested and no data is sent to the server. Only what the public server exposes is visible: not internal systems, APIs behind it, or code.
Public targets only: IP addresses, local and internal names, and any domain that resolves to a private or reserved address are refused before a connection is made.
Rate limits: about 12 checks per 10 minutes per client, and 3 live checks per domain per 10 minutes; results are cached for up to 10 minutes. Limits are best effort per server instance.
Privacy: the domain is used only to run the check and is kept in memory for up to 10 minutes; your IP address is used only for rate limiting, as a one-way hash. Nothing is logged by our code. Details in the privacy policy.

The check covers your public website. For the cryptography in your code, certificates and internal endpoints, see the Pilot & Discovery.

Protocol details

Transport: Streamable HTTP. JSON-RPC 2.0 requests by POST; responses are application/json. There is no server-sent event stream (GET returns 405) and no session id: the server is stateless.
Protocol versions: 2025-11-25, 2025-06-18, 2025-03-26 and 2024-11-05. Capabilities: tools only.
Tool errors (invalid domain, private address, timeout, rate limit) come back as a tool result with isError: true and a plain explanation.

Try it from a terminal:

curl -s https://www.cryptagion.io/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
       "params":{"name":"check_tls_quantum_readiness",
                 "arguments":{"domain":"www.cryptagion.io"}}}'

Prefer a web page? The same check runs in your browser, and the study explains what the results mean.

Open the TLS checker → Read the study

← Home · FAQ · Trust center

Ask your AI assistant if a website is quantum-safe