QScan CLI Documentation

Welcome to the official documentation for the QScan Command Line Interface. QScan is a professional enterprise-grade offline cryptographic discovery and Post-Quantum readiness scanner.

Installation

QScan CLI requires no dependencies. It is distributed as a standalone compiled executable for Windows, macOS, and Linux.

• Step 1: Navigate to the Downloads page and grab the package for your architecture.
• Step 2: Extract the archive.
• Step 3: Place the binary in your system path (e.g., /usr/local/bin on Linux/Mac, or standard PATH on Windows).

Quick Start

To run a complete cryptographic audit on your current directory, execute:

qscan scan .

The scanner recursively analyzes all valid source code files, configuration files, and assets within the target directory. When complete, it generates two files in the execution directory.

CLI Commands

The primary command is scan. It takes a single positional argument: the target path.

Syntax

qscan scan <target_directory>

Behavior:

• Recursive Scanning: Traverses all folders dynamically.
• Intelligent Ignoring: Automatically skips standard build directories like node_modules, .git, venv, and binary extensions (e.g., .jpg, .exe).
• Offline Execution: No network calls are made during the scanning phase.

Examples

Scan a specific backend repository:

qscan scan ./backend

Scan a user document directory:

qscan scan ~/Documents/project

Scan an absolute path on Windows:

qscan scan C:\Projects\App

Output Structure

QScan outputs two primary artifacts by default:

• qscan_report.html: Interactive HTML Executive Dashboard.
• qscan_cbom.json: Machine-readable CycloneDX Cryptographic Bill of Materials.

Generated Reports

1. The HTML Executive Report

Designed for CISOs and Security Architects. It includes:

• Overall Crypto Health Score: Evaluated based on NIST compliance and current migration priorities.
• Executive Dashboards: High-level metrics of critical and high-risk findings.
• Evidence Explorer: Detailed table listing the exact File, Path, Line Number, Code Snippet, and identified Algorithm for every finding.

2. The JSON CBOM

The CBOM follows the CycloneDX 1.4+ standard for cryptographic assets. It provides a structured inventory of algorithms, versions, NIST mapping, migration recommendations, and quantum readiness.

Supported Algorithms

The engine actively maps algorithms into an enriched taxonomy, ensuring correct NIST status and quantum risk mapping.

• Symmetric: AES (GCM, CBC, ECB), ChaCha20, DES, 3DES, RC4, Camellia, ARIA, SM4
• Asymmetric: RSA, ECC (secp256k1, secp256r1, x25519, ed25519)
• Post-Quantum (NIST FIPS 203/204/205): Kyber, ML-KEM, Dilithium, ML-DSA, Falcon, SPHINCS+, SLH-DSA
• Hashing: SHA-1, SHA-256, SHA-3, MD5
• Artifacts: Private Keys (PEM), Public Keys, Certificates (X.509), JWT Tokens
• Protocols: SSLv3, TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3, SSH

FAQ

Is my source code uploaded anywhere?
No. QScan CLI operates entirely locally. Your code never leaves your machine.

How does QScan handle large mono-repos?
QScan is optimized for enterprise scale. It reads files line-by-line using buffered streams, keeping memory footprint low regardless of repository size.

Can I use it in an air-gapped environment?
Yes. The standalone binaries are completely self-contained.