QECTOR Claude Plugin 2.0.1

Air-gapped, schema-validated, audited quantum error correction for Claude Code and Claude Desktop, built on qector-decoder-v3==1.0.1.

Every correction returned by an MCP tool is checked against the parity relation H c = s (mod 2) before it leaves the process. Every request is validated against a JSON Schema 2020-12 input schema before any decoder code runs, and every response is validated against the tool's advertised output schema before it is written. The default server opens no listening socket, launches no process, verifies its own files at startup, and can keep a hash-chained audit log.

1 secure MCP server (12 tools default, 41 in research profile) · 3 standalone servers · 11 commands · 5 agents · 28 skills · contract 2.0 · mcp 1.30+ and 2.x · Python 3.10–3.13 · air-gapped by default

Why 2.0.0

The 1.0.x line made claims its process could not enforce. 2.0.0 turns those claims into mechanisms and states what remains:

	1.0.6	2.0.0
Network	"zero egress" in the docs; check_pypi=true opened a connection	in-process guard installed before the first MCP frame (defence in depth; host egress rule documented for a hard guarantee); PyPI check refused
Validation	SDK-dependent input check, no output check	own Draft 2020-12 validator both ways; 91 committed schema files
Integrity	none	INTEGRITY.json verified at startup, strict by default
Audit	none	optional hash-chained JSONL log
SDK	mcp==1.26.0 (3 CVEs), broke on mcp 2.x	mcp>=1.30,<3; same wire output on both generations
Release	three different trees labelled 1.0.6	deterministic builder that refuses a dirty tree, hashed requirements.lock, per-archive manifest + RELEASE_COMMIT, Ed25519-signed manifests and SHA256SUMS, Sigstore log entry
Honesty about the wheel	not mentioned	native TLS client and billing endpoint disclosed in airgap_status and SECURITY.md
Wheel defects	color_code d=3 (1 check, no logicals) exposed as decodable; rotated_surface labelled distance d while a weight-2 error is undetectable	per-family health probe with a checked effective_distance (exact for graphlike codes via the matching graph's shortest odd-parity cycle, bounded enumeration otherwise; never the wheel's label); degenerate refused, weak warned on every result; a corrected rotated_surface_corrected family built by the plugin and verified at construction (mcp/qector_codes.py). 2.0.1 pins qector-decoder-v3==1.0.1, which fixes these families upstream; the probe now verifies every one at its label
Shipped bugs	sinter_task_template crashed on every call; DEM collapse ignored the 3rd+ mechanism	fixed, with regression tests

Installation

Claude Code

claude plugin marketplace add GuillaumeLessard/qector-claude-plugin
claude plugin install qector@qector-tools

The plugin registers qector-secure (mcp/mcp_server_secure.py --profile safe, QECTOR_AIR_GAPPED=1). Interpreter resolution goes through scripts/qector-python (QECTOR_PYTHON → python3.13…python3.10 → python3 → python → well-known Homebrew / python.org / pyenv locations, 3.10–3.13), a POSIX sh script.

Windows (Claude Code): a plugin manifest has one command for every platform and a sh script is not a Win32 executable, so on native Windows the plugin's server starts only where sh is on PATH (Git for Windows with "Unix tools" selected, or WSL). Otherwise register the server once by hand with the Windows launcher, which also serves the hooks:

claude mcp add qector-secure -e QECTOR_AIR_GAPPED=1 -e QECTOR_INTEGRITY_STRICT=1 -e QECTOR_SILENT=1 -- cmd /c "<plugin root>\scripts\qector-python.cmd" "<plugin root>\mcp\mcp_server_secure.py" --profile safe

The Claude Desktop extension does not have this limitation: its manifest carries a win32 override that launches scripts/qector-python.ps1 through powershell.exe.

The hooks (hooks/hooks.json) run in shell form, which Claude Code executes with Git Bash on Windows; without Git for Windows they report an error on each session start and the (optional) usage log is not written. The server itself is unaffected.

Claude Desktop

Install qector-claude-desktop-2.0.1.mcpb (Settings → Extensions → Advanced → Install Extension). The bundle runs the same secure server in strict-integrity mode; the optional Audit log directory setting enables the hash-chained log. A platform-specific bundle with the runtime vendored into server/lib can be built with scripts/build_release.py --desktop --bundle-lib <wheelhouse>.

Air-gapped laboratory

See AIRGAP.md: build a wheelhouse on a connected host (scripts/build_wheelhouse.py), carry it with SHA256SUMS, run scripts/install_offline.sh / .ps1 on the lab machine, and apply a host egress rule.

From source

git clone https://github.com/GuillaumeLessard/qector-claude-plugin.git
cd qector-claude-plugin
python -m pip install -r requirements.lock      # exact tested closure (Python 3.10-3.13)
QECTOR_SILENT=1 python scripts/qector_runtime_check.py

The tool surface

Server	Entry point	Tools	Default
qector-secure	mcp/mcp_server_secure.py --profile safe	12	✅ Claude Code & Desktop
qector-secure --profile research	same	41	opt-in
qector-library	mcp/mcp_server_library.py	8	legacy
qector-research	mcp/mcp_server_qector_bench.py	29	opt-in
qector-admin	mcp/mcp_server_admin.py	3	opt-in, QECTOR_ADMIN_ENABLED=1

Control-plane tools of the secure server: airgap_status, integrity_check, schema_catalog, audit_log_status. Full contract in MCP_API.md; every schema in schemas/.

This is the beginning of the README. Read the rest at the original. Read the full README ↗