# Tenable Cloud Exposure PQC Posture Portal

> Self-hosted web portal showing post-quantum cryptography readiness for cloud resources using Tenable Cloud Exposure's native SSL/TLS PQC telemetry.

- Type: Agent
- Author: chanochm
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-08-04
- Source repository: https://github.com/chanochm/Tenable-CloudSecurity-PQCPosture
- Repo state: not archived
- Last push: 2026-10-29T08:41:43Z
- Stars: 0 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable, Tenable Hexa AI MCP
- Domains: cryptography-pki, cloud-security
- Tags: post-quantum-cryptography, pqc, tls, cryptography, cloud-security, cloud-exposure, network-exposure, dashboard, vulnerability-management
- Date added: 2026-08-04
- Works with the Tenable Hexa AI MCP server: yes
- Listing page: https://exchange.tenable.com/agents/tenable-cloud-exposure-pqc-posture-portal
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/agents/tenable-cloud-exposure-pqc-posture-portal.md

A self-hosted web dashboard that answers a single critical question: *which of our internet-reachable cloud resources would survive a quantum adversary?*

## What it does

PQC Posture Portal visualizes post-quantum cryptography readiness across your entire cloud estate by consuming Tenable Cloud Exposure's native `SSL/TLS PQC Support` telemetry. It scores every exposed resource — `Enforced`, `Ready`, `Review`, or `Not quantum-safe` — and presents the results through two views:

- **Dashboard:** Readiness ratio, endpoint lattice visualization, and seven summary widgets mapping to capabilities from Tenable's Cryptographic Inventory dashboard (services using/not using PQC, cipher inventory, TLS weaknesses, certificate expiry, and countdown to Executive Order 14412 migration deadlines)
- **Resource inventory:** Filterable table with cryptographic drill-down per endpoint, showing offered key-exchange groups with post-quantum algorithms highlighted

Zero dependencies beyond Python's standard library. No pip install, no Node, no external network calls. One HTML file, vanilla JavaScript, and direct MCP JSON-RPC communication with Tenable Cloud Exposure via the Tenable Hexa MCP server.

## How it works

The portal runs a local HTTP server (`ThreadingHTTPServer`) that serves a single-page application and queries Tenable Cloud Exposure through the Tenable Hexa AI MCP server. It speaks MCP JSON-RPC over HTTPS directly — no AI client needed at runtime, no model in the data path.

Verdicts are recomputed server-side on every request from raw endpoint fields stored in saved UDM queries (`queries/*.json`). Service account credentials are encrypted at rest with a per-install key file using PBKDF2-derived HMAC-SHA256. Corporate TLS-inspecting proxies are handled automatically by resolving trust from the OS certificate store (macOS keychains via `security`, Windows stores via `ssl.enum_certificates`).

Designed for distribution: works offline with bundled demo data, handles schema drift explicitly with a legacy query fallback, and requires no manual certificate configuration on networks with MDM-installed corporate roots.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/agents/tenable-cloud-exposure-pqc-posture-portal.json. The full index and how to read it: https://exchange.tenable.com/llms.txt