Lattice¶

Crypto-agility and post-quantum-readiness scanner. Lattice statically analyzes a codebase, produces a CycloneDX-style Cryptographic Bill of Materials (CBOM), grades every cryptographic usage for quantum vulnerability and classical weakness, and emits a prioritized migration roadmap toward the NIST post-quantum standards (FIPS 203/204/205).

12 languages + config/key material + dependency manifests
Zero runtime dependencies, offline, deterministic output
CI-native: --fail-on gate, CBOM drift diff, SARIF for code scanning, policy packs

How a scan works

Install¶

Lattice is not yet on PyPI; install from source:

git clone https://github.com/mk12002/Lattice && cd Lattice
pip install .

Quick start¶

lattice scan .                         # HTML report to ./lattice-report/report.html
lattice scan . --format all --fail-on P0
lattice rules list                     # the full algorithm knowledge base

See it¶

Live sample report — a real Lattice HTML report (light + dark, self-contained).
Terminal demo — an asciinema recording of a scan (asciinema play).
Benchmarks — reproducible measurements.

Where to next¶

Explained simply — a ten-minute, no-prerequisites walkthrough.
Command & config reference — every flag, exit code, and lattice.toml option.
Comparison to other tools — honest positioning vs. CBOMkit, Semgrep, TLS scanners.
Accuracy & benchmarks — real-repo audits and measurements.
Threat model — what Lattice does with the sensitive files it reads.
Gaps & roadmap — an honest, ranked account of what's next.

Source, changelog, and contributing guide: https://github.com/mk12002/Lattice.