PQC Khepra MCP Server: Agentic Security Attestation Framework
Description
KHEPRA MCP Server smithery badge MCP Registry License Container PQC Sovereign compliance engine with 36,195 STIG/CCI/NIST/CMMC mappings. Air-gappable. Zero token costs. Run ert_scan → get a Godfather Report with dollar-denominated business impact. The only MCP compliance server…
About
KHEPRA MCP Server smithery badge MCP Registry License Container PQC Sovereign compliance engine with 36,195 STIG/CCI/NIST/CMMC mappings. Air-gappable. Zero token costs. Run ert_scan → get a Godfather Report with dollar-denominated business impact. The only MCP compliance server that runs on your metal — with the…
Details
- Author
- nouchix
- Downloads
- 208
- Categories
- Developer Tools, AI, Other, Security, Infrastructure
Jump to
- 36,195 offline STIG/CCI/NIST/CMMC mappings
- Post-quantum cryptographic attestation (ML-DSA-65 / FIPS 204)
- World's First DoD PQC STIG (17 controls)
- Godfather Report with dollar-denominated business impact (FAIR model)
- Air-gap and SCIF compatible (sovereign/ironbank modes)
- Flat annual licensing – no per-token charges
- Runs on your metal – on-prem, classified environments
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
PQC Khepra MCP Server: Agentic Security Attestation FrameworkCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Install via Docker (recommended) or compile a binary with Go 1.21+. Configure your MCP client (Claude Desktop, Cursor, VS Code, Windsurf, Continue.dev) using a stdio subprocess command pointing to the server. Set environment variables like KHEPRA_MODE=sovereign and optionally KHEPRA_LICENSE_KEY for paid tiers. Run the pqc_stig tool (Community tier) to assess quantum readiness against the built-in PQC-01-STIG-V1R1.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"pqc khepra mcp server: agentic security attestation framework": {
"khepra": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"-e",
"KHEPRA_MODE=sovereign",
"-v",
"/var/lib/khepra:/var/lib/khepra",
"ghcr.io/nouchix/pqc-khepra-mcp:latest"
]
}
}
}
}McpServers
{
"khepra": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"-e",
"KHEPRA_MODE=sovereign",
"-v",
"/var/lib/khepra:/var/lib/khepra",
"ghcr.io/nouchix/pqc-khepra-mcp:latest"
]
}
}KHEPRA MCP Server
Sovereign compliance engine with 36,195 STIG/CCI/NIST/CMMC mappings.
Air-gappable. Zero token costs. Run ert_scan → get a Godfather Report with dollar-denominated business impact.
The only MCP compliance server that runs on your metal — with the World's First DoD PQC STIG built in.
> PQC-01-STIG-V1R1 — Full Whitepaper →
> 17 controls covering CNSA 2.0, FIPS 203/204/205, and the NSA's May 2026 MCP security advisory.
> The world's first DoD-style Post-Quantum Cryptography STIG, including the first PQC controls for agentic AI and MCP deployments.
---
Tiers
| Tier | License Key | Tools | Telemetry | Egress |
|------|-------------|-------|-----------|--------|
| Community | ❌ Not required | pqc_stig + 12 core tools | Opt-in Dark Crypto Intel | Zero (sovereign mode) |
| Sovereign | ✅ Required | All 34 tools | Zero | Zero |
| Pharaoh | ✅ Required | All 34 tools + priority support | Zero | Zero |
> Community tier is free. Run pqc_stig to assess your project's quantum readiness against
> PQC-01-STIG-V1R1 — the World's First DoD-style Post-Quantum Cryptography STIG — no license key needed.
---
What It Does
KHEPRA MCP connects your AI assistant directly to a hardened compliance engine. Ask Claude or any MCP client to scan a system, map findings to STIG/NIST/CMMC controls, and generate an executive-ready risk report — all without sending data to external APIs.
Key capabilities:
- 36,195 STIG/CCI/NIST 800-53/800-171/CMMC mappings (offline, bundled)
- Post-quantum cryptographic attestation on every tool call (ML-DSA-65 / FIPS 204)
- World's First DoD PQC STIG — 17 controls covering CNSA 2.0 / FIPS 203/204/205 + agentic AI / MCP (PQC-01-STIG-V1R1)
- Godfather Report: dollar-denominated business impact per finding (FAIR model)
- Air-gap and SCIF compatible — sovereign/ironbank modes make zero egress calls
- Flat annual licensing — no per-token or per-query charges
- Runs on your metal: on-prem, DoD, IC, classified environments
---
Installation
There are two delivery methods: Docker (recommended, no build required) and compiled binary (fastest startup, required for air-gap). Both support the same environment variables and all MCP clients.
Choose your path:
| Method | Best For | Startup |
|--------|----------|---------|
| Docker | Most users, easiest setup | ~2s |
| Compiled Binary | Air-gap, SCIF, performance | ~300ms |
---
Option A: Docker (Recommended)
Requires Docker Desktop or Docker Engine. The image is pre-built and ships the full compliance database — no additional downloads in sovereign mode.
```bash
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
