Skip to main content

Air-Gapped & Classified Networks

pqc-check makes zero network calls in any mode. The detection ruleset is compiled into the binary, and the scanner only reads the target tree from local disk. There is no telemetry, analytics, phone-home, or remote ruleset fetch in any code path — a guarantee enforced in the project's CI by a static test that fails the build if any network import or API is ever introduced.

This makes pqc-check suitable for SIPR / JWICS / agency-internal networks where outbound internet is blocked.

--offline​

pqc-check ./my-project --offline

The scanner is already fully offline, so --offline does not change behaviour — it documents air-gapped intent for CI policy and hard-disables any future telemetry (of which there is none today).

Reviewing & distributing the ruleset​

An administrator on an isolated network can export the bundled ruleset to a reviewable, signable JSON file before transfer, and re-import a custom one:

# Write the bundled ruleset to a file an admin can review + sign
pqc-check ruleset export ruleset.json

# Validate a reviewed / air-gap-distributed ruleset (round-trips with export)
pqc-check ruleset import ruleset.json

# List the bundled detection patterns
pqc-check ruleset list

ruleset import fails loud on any schema, regex, or duplicate-id error rather than silently scanning with a broken ruleset.

  1. On an internet-connected workstation, install pqc-check and pqc-check ruleset export the bundled ruleset.
  2. Review and sign the ruleset per your agency process.
  3. Transfer the package to the classified network via your approved process.
  4. Run pqc-check --offline to inventory cryptography on classified codebases.
Self-contained offline bundle

The pqc-check v1.6.0 GitHub Release publishes pqc-check-1.6.0-airgap.tar.gz — a self-contained bundle with all dependencies that runs offline with only a local Node.js (no npm install) — plus a SHA256SUMS manifest. Verify the SHA-256 against the Release page (over HTTPS) before transferring to an isolated network:

shasum -a 256 -c SHA256SUMS

Privacy​

pqc-check collects and transmits nothing. There is no account, no registration, and no usage reporting in any code path.