MCP Server

QuantumLock embeds a Model Context Protocol (MCP) server directly in the API — there is nothing separate to install or run. AI agents speak JSON-RPC 2.0 to a single endpoint:

POST https://quantumlock.softquantus.com/v1/mcp

Tools are auto-generated from the live OpenAPI document at startup, so the tool list always matches what the API actually serves: withdrawn endpoints cannot appear as tools, because they are not in the spec.

Protocol

Standard MCP JSON-RPC methods are supported (protocolVersion: 2024-11-05):

Method	Behavior
`initialize`	Returns server info (`quantumlock`) and capabilities (`tools`)
`notifications/initialized`	Acknowledged
`tools/list`	Returns the curated tool list
`tools/call`	Executes the tool by reconstructing the matching REST call

Example, by hand:

curl -X POST https://quantumlock.softquantus.com/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/list"}'

Authentication

Tool calls are executed as real REST requests against the API, so each tool carries its endpoint’s own auth requirements (scopes). The MCP handler forwards the Authorization header from your MCP request to the underlying REST call verbatim; when no Authorization header is present, a server-configured API key (if any) is used as X-API-Key.

The REST API authenticates with the x-api-key header, not Authorization: Bearer. Tools that hit public endpoints (health, readiness, legal, quantum health) work without credentials; tools that hit authenticated endpoints succeed only when the executing request ends up carrying a credential the API accepts.

The curated tool set

By default the server exposes a curated subset of the generated tools (the deployment can opt into exposing all of them). Tool names encode the REST operation: quantumlock_<verb>_<path with / and - replaced by _>.

Tool	REST operation
`quantumlock_get_health`	`GET /health`
`quantumlock_get_ready`	`GET /ready`
`quantumlock_get_legal`	`GET /legal`
`quantumlock_get_api_v1_doctor`	`GET /api/v1/doctor`
`quantumlock_post_api_v1_licenses_generate`	`POST /api/v1/licenses/generate`
`quantumlock_post_api_v1_licenses_validate`	`POST /api/v1/licenses/validate`
`quantumlock_get_api_v1_licenses`	`GET /api/v1/licenses/`
`quantumlock_get_api_v1_customers_me`	`GET /api/v1/customers/me`
`quantumlock_get_api_v1_customers_plans`	`GET /api/v1/customers/plans`
`quantumlock_get_api_v1_quantum_health`	`GET /api/v1/quantum/health`
`quantumlock_post_api_v1_quantum_entropy`	`POST /api/v1/quantum/entropy`
`quantumlock_post_api_v1_quantum_crypto_encrypt`	`POST /api/v1/quantum/crypto/encrypt` (endpoint answers `501` — disabled)
`quantumlock_post_api_v1_quantum_crypto_sign`	`POST /api/v1/quantum/crypto/sign` (endpoint answers `501` — disabled)
`quantumlock_post_api_v1_quantum_crypto_verify`	`POST /api/v1/quantum/crypto/verify` (endpoint answers `501` — disabled)
`quantumlock_post_api_v1_v2_artifacts`	`POST /api/v1/v2/artifacts`
`quantumlock_post_api_v1_v2_validate`	`POST /api/v1/v2/validate`
`quantumlock_post_api_v1_enterprise_keys_generate`	`POST /api/v1/enterprise/keys/generate`
`quantumlock_get_api_v1_enterprise_keys`	`GET /api/v1/enterprise/keys`
`quantumlock_get_api_v1_enterprise_entropy_sources`	`GET /api/v1/enterprise/entropy/sources`
`quantumlock_post_api_v1_evidence_bundles`	`POST /api/v1/evidence/bundles`
`quantumlock_post_api_v1_evidence_verify`	`POST /api/v1/evidence/verify`

Typed key-engine tool contracts

Alongside the auto-generated tools, QuantumLock publishes a typed tool-contract catalog for the Enterprise Key Engine (metadata only — execution always maps to the API endpoints, never to a parallel runtime). Each contract carries a risk rating and a strict input schema. The catalog covers:

Entropy: quantumlock_list_entropy_sources, quantumlock_collect_entropy, quantumlock_verify_entropy, quantumlock_get_entropy_job, quantumlock_condition_entropy
Key lifecycle: quantumlock_generate_enterprise_key, quantumlock_list_keys, quantumlock_get_key, quantumlock_get_key_evidence, quantumlock_wrap_key, quantumlock_revoke_key, quantumlock_activate_key, quantumlock_rotate_key, quantumlock_suspend_key, quantumlock_expire_key, quantumlock_archive_key, quantumlock_destroy_key (rated critical)
Governance: quantumlock_policy_check, quantumlock_key_provenance_report, quantumlock_doctor
Artifact signing: quantumlock_sign_artifact, quantumlock_verify_artifact

Pointing an MCP client at it

QuantumLock’s MCP endpoint is plain HTTP JSON-RPC. For clients that speak HTTP MCP directly, configure the URL; for stdio-only clients (such as Claude Desktop), use a stdio-to-HTTP bridge like mcp-remote:

{
  "mcpServers": {
    "quantumlock": {
      "command": "npx",
      "args": ["mcp-remote", "https://quantumlock.softquantus.com/v1/mcp"]
    }
  }
}

Withdrawn services (PKI, cipher, trust badges) are absent from the MCP tool list by construction — an advertised tool is a capability claim, and the tool list is generated from the live spec that no longer contains them. See Withdrawn services.

Getting Started

Guides

Reference

Platform

Protocol

Authentication

The curated tool set

Typed key-engine tool contracts

Pointing an MCP client at it

​Protocol

​Authentication

​The curated tool set

​Typed key-engine tool contracts

​Pointing an MCP client at it

Protocol

Authentication

The curated tool set

Typed key-engine tool contracts

Pointing an MCP client at it