Uilcol published OmniUil AI, a post-quantum cryptographic security scanner that runs entirely on your infrastructure. The tool statically analyzes codebases for algorithms that quantum computers will break by the end of the decade, then generates a deterministic risk score and migration plan. The core engine is written in Rust and licensed under Apache 2.0.

The Problem It Solves

NIST published the first post-quantum cryptography standards in 2024 under FIPS 203 and 204. CNSA 2.0 compliance becomes mandatory in 2027. Meanwhile, the "harvest now, decrypt later" attack model means adversaries are already capturing encrypted traffic with the expectation of decrypting it once quantum hardware matures. RSA, ECDSA, and Diffie-Hellman protect roughly 99% of internet communications today, and all three are vulnerable to Shor's algorithm on a sufficiently powerful quantum computer.

The scanner identifies 14 rule categories covering quantum-vulnerable algorithms. Critical severity rules flag RSA in any form, ECDSA and elliptic curve cryptography, classic Diffie-Hellman, RC4, JWT algorithms using "none," JWT signed with RSA, and hardcoded private keys in PEM format. High severity rules catch MD5, SHA-1, AES in ECB mode, DES and 3DES, hardcoded secrets, and predictable random seeds.

Taint Analysis for Cryptographic Injection

The scanner goes beyond pattern matching. It tracks data flow from external sources like HTTP requests and environment variables through to cryptographic operations. This catches parameter injection attacks where an attacker manipulates which algorithm gets used. The canonical example is JWT algorithm injection, where an HTTP request parameter controls the algorithm argument passed to jwt.encode. The scanner flags this as a critical finding because the attacker can send {"alg":"none"} and bypass authentication entirely.

The taint engine works across five languages: Python (PyCertdome, hashlib, passlib, Flask-JWT), Java (JCE, Bouncy Castle, Spring Security, JSSE), C# (System.Security.Cryptography, BouncyCastle .NET), Go (crypto/rsa, crypto/ecdsa, crypto/md5, x/crypto), and JavaScript or TypeScript (Node.js crypto, jsonwebtoken, CryptoJS). Custom rules can be added through YAML configuration without recompiling the scanner.

Real-World Findings

The README includes case studies showing the scanner applied to actual codebases. One scan produced 51 findings with 13 critical and 38 high, including JWT alg:none, RSA-2048, MD5 in password hashing, and hardcoded secrets. Another codebase yielded 443 findings with 382 critical, exposing RSA as the default key provider across the entire application. A third scan found 437 findings with 393 critical, requiring a complete migration plan to meet CNSA 2.0 deadlines.

The volume of findings in these examples is the point. Most codebases have no idea how deeply quantum-vulnerable cryptography is embedded in their dependency trees. The scanner makes the scope visible, then provides a deterministic Quantum Risk Score from 0 to 100 that is auditable by boards, auditors, and regulators including BACEN, ANPD, and TCU.

Autonomous Agents and Enterprise Features

The commercial tier adds five AI agents that run locally on your infrastructure. ScannerAgent autonomously scans projects. AnalysisAgent computes the Quantum Risk Score. RemediationAgent suggests specific fixes per vulnerability. MonitoringAgent detects cryptographic regressions between scans, triggering alerts if a developer merges a PR that reintroduces RSA. IncidentAgent responds to critical alerts automatically using a local Ollama instance.

The enterprise package includes a REST API with 22 endpoints covering authentication, async scanning, full audits, SBOM generation in CycloneDX 1.5, PQC-JWT issuance and verification, key rotation, and a web dashboard. Output formats include human-readable text, JSON for CI/CD pipelines, and SARIF 2.1.0 for GitHub Code Scanning integration. A GitHub Actions workflow is provided: the scanner runs, produces SARIF output, and uploads it directly to the repository's Security tab.

Licensing and Deployment

The split licensing is deliberate. The Rust engine (qsec-rust) is Apache 2.0, free for any use. The Python-based enterprise layer (qsec-enterprise) and AI agents (qsec-agents) carry a commercial license. Everything runs self-hosted. No code leaves the machine. The Docker-based deployment spins up the dashboard on localhost:8080, and the CLI can scan projects directly from the terminal.

The SBOM and LGPD compliance angle matters for Brazilian organizations specifically. The scanner generates CycloneDX 1.5 software bills of materials and keeps all data local, which satisfies ANPD data residency requirements. For teams subject to CNSA 2.0 timelines, the tool provides both the evidence of exposure and the migration roadmap in a single pass.