pqdoctor CLI or Flarebox

There are two products, and one engine inside both. They give the same verdicts and cause codes, so results compare across them.

	pqdoctor CLI	Flarebox
What it is	The all-in-one command-line tool	The desktop app: pqdoctor with a window, and Cloudflare Workers managed from it
Answers	Is this server post-quantum, why not, and how do I fix it? Then: what do we have, who owns it, is it being fixed?	Are my Cloudflare origins post-quantum, how is the whole organization doing, and can I fix it from one window?
Scope	One host, a list of thousands, or a whole company on a schedule	Your Cloudflare zones and Workers, and your organization’s fleet
For	Engineers, SREs, security testers, platform teams	Cloudflare administrators, Workers developers, security leads
Runs on	Windows, macOS, Linux, CI	Windows 10/11 x64, Linux x86_64

pqdoctor.com shows both, and Try it runs the check in your browser with nothing to install.

pqdoctor CLI

What it is. One program that checks whether a server negotiates post-quantum key exchange (hybrid ML-KEM), and when it doesn’t, says why, one level down. The config leaves ML-KEM out, the TLS library is too old, or a provider’s load balancer terminates TLS. It gives the exact fix, and can apply a config fix with automatic rollback. It also checks SSH, QUIC and mail servers, and whether each certificate chain is ready for ML-DSA.

Everything else is part of it:

At work. inventory finds every endpoint (certificate transparency, DNS zones, Cloudflare, Kubernetes, Terraform, AWS). tickets files one issue per server for the team that owns it and closes it when it’s fixed. push sends a run to your fleet. agent runs the whole loop on a schedule from inside each network. See Across a company.
In CI. The GitHub Action is the CLI in a workflow: it fails a build on a non-post-quantum host or a regression, uploads SARIF, comments on the pull request and pushes to the fleet.

Who it’s for. Hands-on engineers who own web servers and load balancers, security engineers assessing servers, developers checking the APIs their code depends on, and the platform team that rolls the migration out.

Why use it.

Other scanners say “not post-quantum” and stop. pqdoctor says why and what to change, which turns a finding into a fix.
It’s safe on production: each probe stops at the server’s first reply, and scans are paced.
Free and MIT-licensed, with signed and attested builds from public source.

Flarebox

What it is. A desktop app for people who run Cloudflare, with pqdoctor built in:

Post-quantum, done for you. Every origin behind every zone checked daily, alerts when one regresses, a one-page readiness report, and fixes such as tunnels and ML-DSA origin certificates. Any server can be checked from this computer, from Cloudflare’s network, or both (next release).
The fleet (next release). Your organization’s post-quantum dashboard: the share of servers post-quantum by team, the trend, regressions and fixes, each server’s history and the plan. Flarebox deploys it to your own Cloudflare account as a reviewed change and shows it; the CLI, agents and CI send it their runs.
Workers and Cloudflare. Local Workers projects (run, inspect, edit data, deploy), and your zones through the API (DNS, SSL/TLS, rules, tunnels and more), every change a reviewed and undoable diff.

Each person turns on only the features they use.

Who it’s for. Cloudflare administrators and DevOps engineers at companies that use Cloudflare, developers building on Workers, security leads who need the organization’s picture, and agencies managing Cloudflare for several clients.

Why use it.

Visitors already reach Cloudflare over post-quantum TLS. The hop from Cloudflare to your origin is the one left to do, and Flarebox checks it for every origin, every day.
The fleet gives leadership one number and a trend, and makes regressions visible the day they happen. It lives on your account: nobody else runs it or sees the data, and Cloudflare’s free plan is enough for most organizations.
Changes are safer than in the dashboard: reviewed diffs, refused if the zone changed since you looked, and undoable. Read-only mode suits auditors and shared machines.
No telemetry; API tokens and the fleet’s admin token stay in Windows Credential Manager.

How they work together

Try it: someone checks their domain on pqdoctor.com and sees the problem.
pqdoctor CLI: an engineer reproduces it, understands why, and fixes the first servers.
Flarebox: the Cloudflare administrator checks every origin daily and deploys the fleet to the account.
pqdoctor CLI at work: the platform team inventories everything, files tickets for each team, and points agents and CI at the fleet.
Flarebox’s Fleet view: leadership follows the trend and the regressions; the plan sets priorities.