PQCensus

Local static-analysis tool that finds where a codebase uses cryptography, infers what each use is for and flags the algorithms that matter for post-quantum migration. Produces audits, a cryptographic bill of materials (CBOM), migration plans and baselines via a pqcensus CLI or Python API, with SARIF and CycloneDX output and a policy-failure exit code for CI. Needs no API key or LLM and treats target code as data rather than executing it.