QNSI MCP Server - Add QNSI to Claude, ChatGPT, Cursor, Windsurf

17MCP tools

4Compatible agents (and counting)

30sSetup time

FreeOn every plan

Get a free API key @heossihq/qnsi-mcp on npm →

Get a free API key. Sign in at cloud.qnsi.heossi.com/auth, then go to Settings → API Keys → New API Key. Copy the qnsi_pqc_api_… token that appears once.

Open ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows). Add the QNSI entry under mcpServers:

{
  "mcpServers": {
    "qnsp": {
      "command": "npx",
      "args": ["-y", "@heossihq/qnsi-mcp"],
      "env": {
        "QNSP_API_KEY": "qnsi_pqc_api_..."
      }
    }
  }
}

Restart Claude Desktop. You'll see a 🔌 icon in the input area; click it to confirm qnsp is connected. All 17 tools are now callable: try "List my QNSI vault secrets" or "Generate an ML-KEM-768 key in QNSI".

Cursor and Windsurf both speak MCP and accept the same JSON shape - just put it in the IDE's MCP config file:

# Cursor / Windsurf settings (.cursor/mcp.json or .windsurf/mcp.json)

{
  "mcpServers": {
    "qnsp": {
      "command": "npx",
      "args": ["-y", "@heossihq/qnsi-mcp"],
      "env": { "QNSP_API_KEY": "qnsi_pqc_api_..." }
    }
  }
}

ChatGPT (Pro, Team, Enterprise) supports custom MCP connectors. In Settings → Connectors → Custom, point at the @heossihq/qnsi-mcp hosted endpoint or run it locally with stdio transport.

qnsp_kms_generate_key

KMS

Generate a new PQC key (ML-KEM or ML-DSA) under the agent's tenant scope.

qnsp_kms_list_keys

KMS

List the tenant's PQC keys with algorithm, status, and rotation date.

qnsp_kms_get_key

KMS

Fetch metadata for a specific key id (no private key material).

qnsp_kms_rotate_key

KMS

Rotate a key, bumping its version while keeping prior versions for legacy reads.

qnsp_kms_hspk_seal

KMS / HSPK

Generate a NIST PQC keypair and seal its private key under a qualified BYOHSM RSA-OAEP custody key.

qnsp_kms_hspk_sign

KMS / HSPK

Unseal a stored HSPK through the HSM and sign while the PQC private key exists only transiently in memory.

qnsp_vault_create_secret

Vault

Create a versioned secret with optional metadata. Genuine PQC-envelope execution remains deployment-specific and NOT VERIFIED.

qnsp_vault_get_secret

Vault

Retrieve a secret by id (returns encrypted payload + metadata).

qnsp_vault_list_secrets

Vault

Enumerate the tenant's secrets, paginated.

qnsp_crypto_scan

Crypto Inventory

Trigger a discovery scan over a configured scope (keys, certificates, algorithms, or full infrastructure).

qnsp_crypto_inventory

Crypto Inventory

Read the current Cryptographic Bill of Materials (CBOM) for the tenant.

qnsp_crypto_readiness

Crypto Inventory

Compute the tenant's PQC migration readiness score.

qnsp_audit_query

Audit

Query the tamper-evident audit chain by topic, source service, and time window.

qnsp_search_query

Search

Run an encrypted-vector or keyword search against the tenant's indexes.

qnsp_tenant_info

Tenant

Read tenant metadata, tier, crypto policy, and current quotas.

qnsp_billing_status

Billing

Read the tenant's entitlements, usage meters, and credit balance.

qnsp_platform_health

Platform

Aggregate health snapshot of all 18 QNSI backend services via the edge gateway.

How many tools does the QNSI MCP server expose?

@heossihq/qnsi-mcp 0.2.0 exposes 17 tenant-scoped tools across KMS, HSPK, vault, crypto inventory, audit, encrypted search, tenant, billing, and platform health.

Can an AI assistant use HSM-Sealed Post-Quantum Keys?

Yes. The qnsp_kms_hspk_seal and qnsp_kms_hspk_sign tools let an authorized assistant create and use PQC keys whose private-key custody at rest is rooted in a qualified customer HSM.

Which environment variable does @heossihq/qnsi-mcp read?

Set QNSP_API_KEY to a tenant-scoped QNSI API key. QNSP_PLATFORM_URL is optional and defaults to the production QNSI API gateway. The QNSP variable names are retained for compatibility.

AI agents need vaults too

Agents that handle real customer data can't keep API keys, PHI, or PII in plaintext context windows. The MCP server makes QNSI's PQC vault a first-class agent capability - 'store this securely' becomes one tool call.

Audit trails for non-determinism

Every agent action that touches QNSI is signed and chained in the audit log. When an agent deletes the wrong key or scans the wrong scope, the post-mortem is one query - no log scraping across 5 services.

Crypto inventory on demand

Ask Claude to scan your connected infrastructure - cloud KMS, certificates, TLS endpoints - and surface every classical crypto primitive that needs PQC migration. The MCP server kicks off the discovery run; the agent renders the CBOM as a Markdown table.

Tenant-scoped by construction

The agent's API key resolves to a single tenant. There's no 'pick a tenant' confusion or cross-tenant leak risk. Free-tier keys get free-tier limits; enterprise keys get enterprise capabilities.

Add quantum-safe security to your AI assistant in under a minute.

Add QNSI to Claude in 3 steps

Same config, different file path

Custom MCP connector

17 QNSI tools, tenant-scoped and audit-trailed

QNSI MCP server answers

Quantum-safe security primitives, native in agent workflows