Engineering · Open Source

We put our cryptography in the open.

KXCO has published thirteen post-quantum packages on npm and GitHub, independently indexed by Socket.dev. It is the inspectable foundation of the KXCO stack — and the point is that you don't have to take our word for any of it. This is what third-party-verifiable security looks like.

post-quantum open source third-party verifiable KXCO Engineering 21 July 2026 ~11 min read

KXCO’s founding principle is “proof, not promises.” Today we applied it to our own software. The cryptography that issues identities, signs records and encrypts data across the KXCO stack is now public: thirteen open-source post-quantum packages on npm, mirrored on GitHub and independently indexed by the supply-chain security service Socket.dev. Not a black box behind a sales deck — code you can read, run and scan.

01Trust you can check for yourself

In a field crowded with “quantum-safe” marketing, the rarest thing is a claim a third party can verify rather than believe. That is what open-sourcing the foundation delivers. Anyone — a bank’s security team, a regulator, a competitor — can inspect exactly how KXCO implements post-quantum cryptography, to the finalised NIST standards, and confirm it is real, current and correct.

# the base layer — install and inspect it yourself
npm i kxco-post-quantum
# or the complete stack in one package
npm i kxco-pq

02The thirteen packages

Rather than one library, KXCO released an interconnected suite: a base primitives layer, specialised modules for regulated needs, developer tooling, and a meta-package that ties them together.

kxco-post-quantumThe base layer — ML-DSA-65 signatures and ML-KEM-768 key encapsulation with key fingerprinting. kxco-pqThe complete stack in one package — identity, HSM, audit, attestation, channels, encryption, webhooks, chain relay. kxco-pq-sdkInstitution identity layer — hierarchical ML-DSA-65 credentials, HSM-backed signing, optional Armature L1 anchoring. kxco-pq-vaultData protection — file and envelope encryption with ML-KEM-768, to one or many recipients. kxco-pq-attestSignatures & proof — sign documents with ML-DSA-65 and anchor the attestation on-chain. kxco-pq-auditAudit & compliance — tamper-evident, ML-DSA-65-signed, SHA-256 hash-chained log; tampering breaks the chain. kxco-pq-tlsSecure communication — post-quantum encrypted channels for Node.js streams and WebSockets. kxco-pq-hsmSigning and decapsulation across a hardware security module boundary — institutional key custody. kxco-pq-agentAI-agent identity — a KYC-verified institution sponsors an ML-DSA-65 keypair and locked capability scope. kxco-pq-chainHTTP client for the post-quantum identity relay — sign ML-DSA-65 intents and post them to the record. kxco-post-quantum-webhookPost-quantum webhook signing and verification — recipients can prove a payload came from you. kxco-pq-cliCommand-line institution key management — generate and rotate ML-DSA-65 keypairs. kxco-verifyA standalone, browser-safe verifier for KXCO signatures and attestations — no account required.

The categories map to what regulated institutions actually need: data protection, digital signatures, hash-chained audit, secure channels, AI-agent identity, HSM key custody and developer tooling. HSM support, tamper-evident logs and on-chain attestation are not demo features — they are compliance requirements.

03Why “in the open” is the whole point

Publishing openly is not generosity; it is evidence. Three independent surfaces now carry KXCO’s cryptography, and none is controlled by our marketing:

  • npm — live, versioned, installable by anyone; the version history shows sustained development, not a one-off drop.
  • GitHub — the source is readable line by line and auditable by any security team before a byte is trusted.
  • Socket.dev — an independent supply-chain security service indexes and scans the suite, entirely outside KXCO’s control.

This is third-party validation in its most durable form. A vendor can claim anything in a datasheet; it cannot fake a public, inspectable, independently scanned codebase implementing named NIST standards. That KXCO exposes its cryptographic foundation to that scrutiny — and that the suite is coherent and production-shaped rather than a toy — is a signal about the maturity of the engineering behind it. Confidence that survives inspection is the only kind worth having.

04Only the foundation — the rest is deliberately private

What is public is the foundation: primitives, the identity layer, verifiers and tooling. It is real and enough to build on. It is not everything KXCO has built. The advanced components — coordination logic, the ontology engine, and the systems that compose these primitives into one verifiable reality — are held privately, as trade secrets, by deliberate policy. That policy is one Elon Musk has stated bluntly:

“We have essentially no patents in SpaceX. Our primary long-term competition is in China. If we published patents, it would be farcical, because the Chinese would just use them as a recipe book.”— Elon Musk, on SpaceX’s patent strategy (as reported in Vance, Elon Musk, 2015). He has elsewhere put it more bluntly still: “patents are for the weak.”

A patent application is a public teaching document — to win the monopoly you must disclose the method. For frontier cryptographic and coordination systems, that disclosure is a gift to any competitor or adversary. So KXCO runs a two-tier posture: open-source the foundation so it can be inspected and trusted, and keep the advanced work as protected trade secrets so the hardest engineering is never handed away in a filing. What you can see is genuine. What you cannot see is further ahead.

05From packages to the product family

These packages are the cryptographic engine inside KXCO’s products — the same primitives, exposed as libraries.

KXCO NexusIdentity, legal execution and proof — built on the SDK, HSM, CLI and verifier packages. KXCO SentinelThe quantum-resistant cloud — attestation, tamper-evident audit and signed events. Armature L1The post-quantum settlement record — on-chain anchoring of signed intents and attestations. KnightsPurseWallet for people and AI agents — post-quantum identity via the agent and base packages. KXCO Treasury & MeridianEncrypted data and channels beneath value, deal-making and NDA-gated rooms.

The open-source suite is therefore also a preview: the quality visible in the packages is the quality running inside the platform. The verifiable state of the foundation is direct evidence for the advanced, private state of the whole.

06Chain, quantum and AI — converging, and KXCO is early

Three forces are arriving at once. AI is producing autonomous agents that act, not just advise. Quantum computing is threatening the cryptography under everything they touch. And the chain is becoming the neutral record where their actions settle and can be proven. Handled separately they are three problems; handled together they are one — and these packages sit exactly on that seam.

// an agent, quantum-safe from identity to settlement to proof
kxco-pq-agent    // institution sponsors a post-quantum agent identity
kxco-post-quantum // it signs each action with ML-DSA-65
kxco-pq-chain     // the action is anchored on Armature L1
kxco-verify       // anyone verifies it offline — no KXCO account

That is chain, quantum and AI operating as one system — shipped as software you can install today. Very few organisations are building at this intersection at all; fewer still have published working code to prove it. The deeper account is in Why KXCO is the indispensable environment for the AI–quantum era.

07What third-party validation signals

For an institution evaluating KXCO, the takeaway is simple: the claims are checkable, the foundation is open and independently scanned, the engineering is advanced enough to expose to the world and mature enough to carry a product family — and the most advanced work is deliberately held back, which means the visible state of the art is a floor, not a ceiling. Verifiable in public, advanced in private. KXCO is not asking to be believed; it is inviting inspection, and letting the code speak.

Explore the packages: npmjs.com/~kxco · github.com/JackKXCO · socket.dev/npm/user/kxco. KXCO is a software company; regulated services are operated by licensed institutions. Cryptographic posture reflects NIST FIPS 203/204/205 alignment at Category-3 parameters; KXCO does not claim CNSA 2.0. The Musk quotation is reproduced from public reporting for commentary. Nothing here is investment advice.