Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Aug 12, 2026

Scanners

Map TLS crypto exposure and post-quantum readiness on authorized hosts

ac-scanner is a TLS and SSH cryptographic inventory scanner that sweeps exposed endpoints for weak, legacy, and post-quantum-insecure cipher configurations and turns the results into CBOM-shaped findings for security reporting.

installdocker pull qubitac/acscannergit clone https://github.com/qubitac/AC-Scanner.git

Python · AGPL-3.0 license

Agent
Inventory TLS crypto on a live host listScore post-quantum readiness before mandates landEmit CBOM-shaped rows for auditors and retests

overview

What ac-scanner does

ac-scanner is the QubitAC AC Scanner packaged for Trickest. It takes a single host or a hosts file, fingerprints TLS cryptographic exposure, assesses post-quantum readiness against NIST-era guidance, and writes structured findings (with optional CBOM-style rows) into a folder your next node can consume.

On Trickest the node is intentionally thin: pass --host for one target or --hosts for a file of host or host:port lines. Upstream AC Scanner also covers SSH auditing and richer CBOM export; the Library path focuses on the TLS/PQC pass that the PQ Crypto Surface Scanner workflow schedules after subdomain and HTTP live-host discovery.

Use it when harvest-now decrypt-later planning needs an evidence inventory, not a policy essay. Pair with subfinder and httpx when you start from a domain, or feed a known host list when inventory already exists.

source github.com/qubitac/AC-Scanner

use cases

Where ac-scanner fits

Inventory TLS crypto on a live host list

Feed authorized hosts (or host:port lines) so each endpoint's TLS version, cipher, and key-exchange posture lands in findings.jsonl instead of a slide deck.

Score post-quantum readiness before mandates land

Surface classical-only stacks and hybrid PQC signals (for example X25519MLKEM768-class groups when present) so migration work orders target real endpoints.

Emit CBOM-shaped rows for auditors and retests

Keep a scheduleable crypto bill of materials beside findings so the next run can produce a retest delta when certificates or edge configs change.

Run after discovery in a Trickest workflow

On the Library PQ Crypto Surface Scanner path, subfinder and httpx expand a domain, extract-hosts builds the list, ac-scanner fingerprints TLS/PQC, and report emits inventory, findings, cbom, and retest_delta.

reference

ac-scanner inputs and flags

2 inputs
NameTypeFlagDescription
hostsFILE--hostsFile of hosts (one host or host:port per line).
hostSTRING--hostSingle host or host:port to scan.

Showing key inputs. ac-scanner exposes 2 inputs in total.

example

Run ac-scanner

ac-scanner · command
# scan a host file (one host or host:port per line)
ac-scanner --hosts hosts.txt

# or a single target
ac-scanner --host www.example.com:443
sample output
{
  "tool": "ac-scanner",
  "host": "www.example.com",
  "tls_version": "TLS 1.3",
  "key_exchange": "x25519",
  "pqc_readiness": "classical-only",
  "severity": "high",
  "remediation": "Plan hybrid or PQC-capable TLS where data lifetime requires it"
}

guidance

Choosing ac-scanner

Reach for ac-scanner when you need TLS and post-quantum readiness evidence on hosts you authorize. Use sslyze or testssl.sh-class tools when you only need classical TLS lab detail and do not need Arsenal PQC/CBOM-shaped output in a Trickest graph.

sslyze

Deep classical TLS analysis. Strong for cipher and cert detail; not the Arsenal PQC/CBOM path used in the Collection workflow.

tlsx

Fast TLS probing and enrichment on host lists. Use for broad TLS metadata; pair or switch to ac-scanner when PQC readiness and CBOM-shaped findings are the job.

nuclei

Template-driven checks across many classes. Useful adjacent scans; not a dedicated crypto inventory / CBOM producer.

workflows

Workflows using ac-scanner

1 workflow

  1. PQ Crypto Surface Scanner

    Enumerate live hosts from a domain, fingerprint TLS and post-quantum readiness with AC Scanner, and emit CBOM-style evidence plus remediation.

faq

ac-scanner questions

It runs the QubitAC AC Scanner image against --host or --hosts and writes a folder of TLS/PQC findings (findings.jsonl, with CBOM-style rows when the pack emits them) for downstream report or correlate nodes.

The tool node takes hosts. For a domain, use a workflow that enumerates and probes first (as PQ Crypto Surface Scanner does), or build your own host file and pass --hosts.

No. It assesses cryptographic exposure and post-quantum readiness signals on ordinary TLS (and upstream SSH) endpoints. No quantum hardware is required to run it.

sslyze is a classical TLS analyzer with deep protocol detail. ac-scanner is the BHUSA Arsenal QubitAC path aimed at PQC readiness inventory and CBOM-shaped output for scheduleable Trickest runs.

QubitAC publishes AC Scanner at github.com/qubitac/AC-Scanner. The Trickest tool id is the vault-packaged ac-scanner node used by the Library Drop workflow.

Only scan hosts and domains you are authorized to assess. The Library demo default is for shape checks; change targets before treating output as your estate.

related

More Scanners tools

  1. airixss

    Reflection triage for parameter URLs during recon.

  2. bedrock-keys-security

    Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.

  3. cmseek

    CMS detection and version fingerprinting.

  4. jaeles

    Signature-driven web application scanner.

  5. joomscan

    OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.

  6. nikto

    Bundled web server checks for dangerous files and outdated software.

Run ac-scanner yourself

An authorized host list feeds ac-scanner, which fingerprints TLS and post-quantum readiness and emits findings for report or retest.

Open ac-scanner in the libraryView the workflow

Facts on this page come from the live Trickest tool library.