Quantum Readiness Copilot

The description states that Quantum Readiness Copilot:

• Scans local repositories, public GitHub repositories, or ZIP archives for cryptographic implementations and dependencies
• Groups findings into actionable cryptographic assets
• Distinguishes confidentiality risks from authenticity and signature risks
• Calculates an explainable readiness score
• Evaluates harvest-now-decrypt-later exposure using the Mosca inequality
• Builds a dependency-aware migration plan
• Validates repository-owned evidence for ML-KEM, ML-DSA, SLH-DSA, and hybrid constructions
• Uses GPT-5.6 through Codex to explain risks and prioritize work
• Generates reviewable patches for selected findings
• Applies proposed patches only to an isolated copy, rescans it, and reports impact without modifying the original repository
• Exports Markdown and SARIF evidence for review and CI workflows

The tool is described as a "local Node.js developer-security tool with a browser-based dashboard" that uses deterministic rules for repository traversal, cryptographic discovery, evidence grouping, scoring, policy enforcement, and SARIF generation.

Inference The product appears to be a proof-of-concept or early-stage prototype rather than a production-ready tool. It's built as a local application with no mention of cloud deployment, multi-user support, or enterprise features.

The description states that the author built Quantum Readiness Copilot to "connect that strategic question to repository-level evidence" and to give developers "a practical and technically honest starting point for planning the transition."

The tool is positioned as:

• A bridge between strategic post-quantum cryptography planning and repository-level evidence
• Not a tool to label codebases as "quantum-safe"
• A way to provide developers with actionable findings rather than broad certification claims

Inference The positioning suggests this is an early-stage developer tool aimed at helping teams understand their current cryptographic posture before making migration decisions. It's positioned as a planning and evidence-gathering tool rather than a certification or compliance tool.

The description states that Quantum Readiness Copilot is built for:

• Developers working with cryptographic implementations
• Teams needing to plan post-quantum cryptography migrations
• Organizations wanting to understand their current cryptographic posture

It's described as a "local developer-security tool" and "browser-based dashboard," suggesting it targets individual developers or small teams rather than large enterprises.

Inference The target customer appears to be technical teams within organizations that have existing codebases with cryptographic dependencies, particularly those considering post-quantum cryptography migration. The tool seems designed for early-stage planning rather than production deployment.

Not evidenced.

The description does not contain any information about pricing models, revenue streams, or business model assumptions. There's no mention of commercial licensing, subscription fees, or monetization strategies.

The description states that:

• The application is built as a local Node.js developer-security tool with a browser-based dashboard
• It uses deterministic rules for repository traversal, cryptographic discovery, evidence grouping, scoring, policy enforcement, and SARIF generation
• Static call-site analysis, repository-owned migration policies, baseline tracking, exposure-horizon modelling, and dependency graph are included
• Model responses are constrained by structured schemas and checked against deterministic evidence before acceptance
• The scanner remains the source of observed facts; GPT-5.6 adds context but cannot silently change scores or claim completion
• Codex runs in a read-only repository context with generated changes remaining proposals until user review
• Implementation includes reproducible Node and Python interoperability checks covering ML-KEM-768, ML-DSA-65, and X25519 + ML-KEM-768 hybrid
• The tool includes automated suite covering scanner, exposure logic, redaction, repository intake, model schemas, patch verification, network failures, and HTTP behaviour

Inference The technical approach appears to be a hybrid deterministic/static analysis + AI reasoning system. The tool is designed with safety mechanisms to prevent AI from overriding factual evidence, suggesting a cautious approach to AI integration.

Not evidenced.

The description contains no information about:

• Revenue or funding
• Customer adoption or usage metrics
• Product deployment or operational history
• Market traction or user feedback
• Any form of commercial success or market validation

Not evidenced.

The description does not contain any information about:

• Direct competitors in the post-quantum cryptography scanning space
• Market positioning relative to existing tools
• Competitive advantages or differentiators
• Industry benchmarks or standards

1. What specific cryptographic assets does the tool identify, and how does it distinguish between different types of risks?
2. How does the tool handle false positives in its static analysis?
3. What is the accuracy rate of the GPT-5.6 model-assisted explanations compared to manual verification?
4. Has the tool been tested on real-world repositories beyond the author's own benchmark?
5. What are the limitations of the current implementation that would prevent it from being used at scale?
6. How does the tool handle edge cases in cryptographic implementations or complex dependency chains?
7. What is the expected timeline for moving from this prototype to a production-ready version?
8. How does the tool integrate with existing CI/CD pipelines and security platforms?