QuDAG v2 preview hardens the crypto and closes an open MCP door

What QuDAG is

A decentralised, quantum resistant network where agents can communicate and coordinate without a central server. It is MCP first, with stdio, HTTP and WebSocket transports.

What changed

Pull request #16 is the v2 preview: crypto and DAG hardening, a Ruflo federation bridge exposing live tools and ruv:// resources, and evidence gates. Credential validation is now fail closed, mock vault operations are unavailable, and unauthenticated network MCP serving is disabled.

That last one is the important line. An MCP server reachable over the network without authentication is not a feature.

Get started

Rust or Node. The CLI is available both ways:

npx qudag@latest --help

Or from crates.io:

cargo install qudag-cli
cargo add qudag-mcp

Expected result: the CLI prints its command surface. Read it before joining any network.

This is a preview of a decentralised network. Do not attach it to anything you care about until you have read the security posture in the repository.

Use it today

Practical case: a private coordination channel between agents on machines you control. Input is two nodes; the workflow is start, exchange a message, verify signatures; the output is coordination without a broker.

Acceptance test: try to reach the MCP surface over the network without credentials. It should refuse.

Push it further

Experimental commentary. The project's own framing is autonomous organisations running without human involvement. Treat that as a research direction, not a deployment plan; quantum resistant primitives are the easy part compared with governance.

Falsifiable test: partition the network and confirm the DAG converges when the partition heals, rather than forking silently.