CryptoServe CLI (Node.js)

Zero-dependency CLI for cryptographic scanning, post-quantum readiness analysis, CBOM generation, CI/CD gating, encryption, and local key management.

npx cryptoserve pqc

Installation

# Run without installing
npx cryptoserve help

# Or install globally
npm install -g cryptoserve

Requires Node.js 18 or later. No dependencies — uses only Node.js built-in modules (node:crypto, node:fs, node:https).

Commands

| Command | Description | |---------|-------------| | scan [path] | Scan project for crypto libraries, hardcoded secrets, and weak patterns | | pqc | Post-quantum readiness analysis with SNDL risk assessment | | cbom [path] | Generate Cryptographic Bill of Materials (CycloneDX, SPDX, JSON) | | gate [path] | CI/CD quality gate with configurable thresholds | | encrypt / decrypt | Password-based encryption (strings and files) | | context list / show | List and inspect context-aware algorithm presets | | hash-password | scrypt / PBKDF2 password hashing | | vault | Encrypted local secret storage with env injection | | init | Set up master key + AI tool protection | | login / status | Connect to a CryptoServe server |

Scan

Detect crypto libraries, algorithm usage, hardcoded secrets, and certificate files across multiple languages and ecosystems.

cryptoserve scan .
cryptoserve scan ./src --format json
cryptoserve scan . --binary          # Include binary crypto detection

Supported Languages

| Language | Extensions | Detection | |----------|-----------|-----------| | JavaScript/TypeScript | .js, .ts, .mjs, .cjs, .jsx, .tsx | Imports, algorithm literals, weak patterns | | Go | .go | crypto/* stdlib, x/crypto, circl | | Python | .py | hashlib, cryptography, PyCryptodome, bcrypt | | Java/Kotlin | .java, .kt, .scala | Cipher.getInstance, MessageDigest, KeyPairGenerator | | Rust | .rs | aes-gcm, ring, ed25519-dalek, pqcrypto | | C/C++ | .c, .h, .cpp, .hpp, .cc | OpenSSL EVP_*, RSA_*, SHA*_Init |

Supported Manifests

| Manifest | Ecosystem | |----------|-----------| | package.json | npm | | go.mod | Go modules | | requirements.txt | PyPI | | pyproject.toml | PyPI (PEP 621 + Poetry) | | Cargo.toml | Cargo (Rust) | | pom.xml | Maven (Java) |

Additional Detection

• TLS/SSL versions — nginx, Apache, Node.js, Go, Java configs
• Binary signatures — AES S-box, DES tables, SHA constants, ChaCha20 sigma (with --binary)
• 80+ algorithms classified by quantum risk, weakness, and category
• Hardcoded secrets — AWS, OpenAI, Anthropic, GitHub, Stripe, and more

PQC Analysis

Offline post-quantum readiness assessment with confidence indicators.

cryptoserve pqc
cryptoserve pqc --profile healthcare
cryptoserve pqc --profile national_security --verbose
cryptoserve pqc --format json

Profiles: general, national_security, healthcare, financial, intellectual_property, legal, authentication, session_tokens, ephemeral

Output includes:

• Quantum readiness score (0-100) with confidence level
• Risk breakdown (critical/high/medium/low/safe)
• Migration urgency (immediate/high/medium/low/none)
• SNDL risk assessment
• KEM/signature recommendations (ML-KEM, ML-DSA, SLH-DSA)
• Migration plan with compliance references (CNSA 2.0, NIST SP 800-208, BSI, ANSSI)

CBOM Generation

Generate a Cryptographic Bill of Materials in industry-standard formats.

# CycloneDX 1.5 format
cryptoserve cbom . --format cyclonedx --output cbom.json

# SPDX 2.3 format
cryptoserve cbom . --format spdx --output cbom-spdx.json

# Native JSON with quantum readiness data
cryptoserve cbom . --format json --output cbom-native.json

# Print to stdout
cryptoserve cbom .

Each CBOM includes:

• All detected crypto components with Package URLs (purls)
• Quantum readiness score and risk assessment
• Git metadata (commit, branch, remote)
• Content hash for integrity verification

CI/CD Gate

Enforce cryptographic policies in your CI/CD pipeline.

# Default: fail if quantum risk > high or score < 50
cryptoserve gate .

# Strict: fail on any high-risk algorithm
cryptoserve gate . --max-risk medium

# Fail on weak/deprecated algorithms (MD5, DES, RC4, etc.)
cryptoserve gate . --fail-on-weak

# Custom score threshold
cryptoserve gate . --min-score 70

# JSON output for CI parsing
cryptoserve gate . --format json

Exit codes: 0 = pass, 1 = fail, 2 = error

Example GitHub Actions step:

- name: Crypto gate
  run: npx cryptoserve gate . --max-risk high --min-score 50 --fail-on-weak

Encrypt / Decrypt

AES-256-GCM, AES-128-GCM, and ChaCha20-Poly1305 encryption with password-based key derivation (scrypt).

# Text
cryptoserve encrypt "sensitive data" --password mypassword
cryptoserve decrypt "<base64 output>" --password mypassword

# Files
cryptoserve encrypt --file report.pdf --output report.enc --password mypassword
cryptoserve decrypt --file report.enc --output report.pdf --password mypassword

# Choose algorithm
cryptoserve encrypt "data" --algorithm ChaCha20-Poly1305 --password mypassword

# Context-aware (auto-selects algorithm based on data sensitivity)
cryptoserve encrypt "SSN: 123-45-6789" --context user-pii --password mypassword

Cross-SDK Compatibility

The encrypted blob format is byte-identical between the Python and Node.js SDKs. Data encrypted by one can be decrypted by the other:

[header_len: 2 bytes][JSON header][ciphertext + auth tag]

Context-Aware Encryption

A 5-layer algorithm resolver selects the optimal encryption algorithm based on data sensitivity, compliance requirements, threat model, and access patterns.

cryptoserve context list
cryptoserve context show user-pii --verbose
cryptoserve encrypt "patient diagnosis" --context health-data --password mypassword

Built-in Contexts

| Context | Sensitivity | Algorithm | Compliance | |---------|------------|-----------|------------| | user-pii | High | AES-256-GCM | GDPR | | payment-data | Critical | AES-256-GCM | PCI-DSS | | session-tokens | Medium | AES-128-GCM | OWASP | | health-data | Critical | AES-256-GCM | HIPAA | | general | Medium | AES-128-GCM | — |

Custom Contexts

Add project-specific contexts in .cryptoserve.json:

{
  "contexts": {
    "audit-logs": {
      "displayName": "Audit Logs",
      "sensitivity": "high",
      "compliance": ["SOX"],
      "adversaries": ["insider"],
      "protectionYears": 7,
      "usage": "at_rest",
      "frequency": "high"
    }
  }
}

Password Hashing

cryptoserve hash-password
cryptoserve hash-password --algorithm pbkdf2

Outputs $scrypt$... or $pbkdf2-sha256$... format strings.

Vault

Encrypted local secret storage using AES-256-GCM. Secrets are stored at ~/.cryptoserve/vault.enc.

cryptoserve vault init
cryptoserve vault set DATABASE_URL "postgres://..."
cryptoserve vault set API_KEY "sk-..."
cryptoserve vault get DATABASE_URL
cryptoserve vault list

# Run a command with secrets injected as environment variables
cryptoserve vault run -- node server.js

# Import from .env file
cryptoserve vault import .env

Init

Set up master key storage and AI tool protection in one command.

cryptoserve init

This generates a master key (stored in OS keychain on macOS/Linux, encrypted file fallback), detects AI coding tools (Claude Code, Cursor, Copilot, Windsurf, Cline, Aider), and configures deny rules to prevent them from reading .env, .pem, .key, and other sensitive files.

Programmatic Usage

All modules are importable as ES modules:

import { encrypt, decrypt, encryptString, decryptString } from 'cryptoserve/lib/local-crypto.mjs';
import { analyzeOffline } from 'cryptoserve/lib/pqc-engine.mjs';
import { scanProject } from 'cryptoserve/lib/scanner.mjs';
import { resolveContext } from 'cryptoserve/lib/context-resolver.mjs';
import { generateCbom, toCycloneDx, toSpdx } from 'cryptoserve/lib/cbom.mjs';
import { ALGORITHM_DB, lookupAlgorithm } from 'cryptoserve/lib/algorithm-db.mjs';

License

Apache-2.0