Four passes over four kinds of evidence
Cryptography hides in more places than a code search will find, and the configuration file usually matters more than the call site.
Per language crypto API usage, plus generic call extractors that catch an algorithm named as an argument to a function the catalogue has never seen.
TLS cipher suites and versions, SSH ciphers, key exchange and message authentication, JWT algorithms, OpenSSL configuration and IPsec proposals.
X.509 material on disk parsed for algorithm, key size and validity. Metadata only: key bytes are never read, stored or transmitted.
Declared cryptographic libraries, which tell you what a project can do even where no call site was found.
Spellings are normalised before anything is recorded, so SHA256, Sha256 and SHA_256 collapse into one asset instead of three findings that inflate every count downstream.
Four postures, and a security level to go with them
Quantum safe means standardised to resist a cryptographically relevant quantum computer. Quantum vulnerable means broken by a known quantum algorithm, which makes anything encrypted with it today subject to harvest now, decrypt later. Deprecated means already withdrawn on classical grounds. Hybrid means a classical and a post-quantum algorithm combined. Each asset carries its NIST quantum security level where one applies, and a per country approval matrix, because the algorithm your regulator accepts is not the same everywhere you operate.
Inventory first, gate when you are ready
The gate is opt in and the default exits zero, because a migration that fails every build on day one is a migration nobody finishes. Take the inventory, agree the target, then turn the gate on for the posture you have decided to stop accepting.
Cryptographic assets land in the same CycloneDX document as your dependencies, so one run answers a composition question and a cryptography question. The AI equivalent is the AI bill of materials, and the evidence feeds the framework reports in compliance reporting.