Developers
Sixteen packages. Free. Apache-2.0.
The cryptography that KXCO's products are built on, published on npm for anyone to read, install and audit before relying on it. You need no account and no API key. The core library, kxco-post-quantum, makes no network call; packages such as kxco-pq-chain and kxco-pq-network contact the network when you post to the relay or check a chain anchor.
The shelf
One install for the whole family. Or take a single package from the list below.
$ npm install kxco-pq
| Package | What it does |
|---|---|
| kxco-pq | The whole family in one install. Start here unless you know you want one piece. |
| kxco-post-quantum | The primitives: ML-DSA-87, ML-DSA-65, ML-KEM-768 and SLH-DSA-SHA2-192s, with key fingerprinting. OpenSSL 3.5 on Node 24 and later, a JavaScript backend on Node 20 and 22 and in browsers. |
| kxco-pq-scan | Finds the quantum-vulnerable cryptography already in a JavaScript dependency tree and separates what Shor's algorithm breaks from what it does not. Emits a cryptography bill of materials (CBOM) in CycloneDX format. The one package you can run today without building anything. |
| eslint-plugin-kxco-pq | Fails the build when code reaches past the wrapper to touch a raw primitive. |
| kxco-pq-hsm | Key custody in a hardware security module (HSM) or other PKCS#11 token. ML-DSA keys are generated on the token and marked unextractable, so the private key never exists in process memory. |
| kxco-pq-sdk | Institution identity: hierarchical ML-DSA-87 and ML-DSA-65 credentials, HSM-backed signing and anchoring. |
| kxco-pq-cli | Key management from a terminal: generate, fingerprint, and rotate under a signed manifest. |
| kxco-verify | A standalone, browser-safe verifier. It shares no code with the signer, which is what makes it worth having. |
| kxco-pq-attest | Signs any payload into a self-contained envelope a counterparty can check on their own. |
| kxco-pq-audit | Tamper-evident audit log: signed entries, SHA-256 hash-chained, and replayable end to end. |
| kxco-pq-vault | File and envelope encryption to one or many recipients, using ML-KEM-768. |
| kxco-pq-tls | Encrypted channels for Node streams and WebSockets. ML-KEM-768 key exchange alongside X25519. |
| kxco-post-quantum-webhook | Signed webhooks, so a recipient can check which key signed a payload and that it has not changed since. Adapters for Express, Fastify, Hono, Workers and Vercel. |
| kxco-pq-chain | Sign an intent, post it to the relay, and KXCO Armature verifies the signature in consensus. |
| kxco-pq-agent | Signing keys for AI agents and autonomous systems, linked to the institution that sponsors them. |
| kxco-pq-network | Three levels of verification for an envelope, from the signature alone offline through to a chain anchor. |
Every package is published as ECMAScript modules (ESM), needs Node 20.19 or later, and ships type declarations.
The evidence is a document, not a paragraph
Claiming a library is correct is easy and worth nothing. So the conformance results, the interoperability matrix, the supply-chain position and the per-package provenance live in one machine-readable document that anyone, or any assessor's tooling, can fetch and diff against the registry.
- 9 parameter sets. Across FIPS 203, 204 and 205, from NIST Category 1 to Category 5.
The published tarballs rebuild byte for byte from their own tags, checked in continuous integration (CI) on every run. The version numbers in that document are regenerated from the registry rather than typed, because a hand-maintained evidence file goes out of date faster than anyone checks it.
Check us, from a cold start
The platform's own signing key is published. Fetch it, hash the public key, and confirm the first eight bytes match the key id it claims. This check confirms that the published key matches its key id; on its own, it does not confirm that the key is KXCO's.
$ curl -s https://kxco.ai/.well-known/kxco-pq-pubkey | jq -r '.publicKey' | xxd -r -p | sha256sum | cut -c1-16
aa29f37ab7f4b2cf
That is ML-DSA-87 under FIPS 204 at NIST Category 5. The document states the algorithm, the specification, the key id and the rule used to derive it.
Where this sits
These packages are the free half of the picture. They give you the primitives, a build-time guardrail, key custody in hardware and an inventory of what you already have. That inventory comes from kxco-pq-scan, the free scanner that is part of KXCO Portcullis alongside Portcullis Survey.
What the packages deliberately do not do is decide whether a valid signature should count, which is a question about authority rather than mathematics.
For the longer walkthrough, including who needs which package and what it costs, read the toolkit guide.