rqwstr

rqwstr

AI-native HTTP security testing toolkit, shipped as an MCP server. It gives an AI agent low-level control over HTTP/1.1 and HTTP/2 — raw framing, connection pinning, intruder-style fuzzing, request racing, OOB detection, and multi-step chains — on its own Go engine, rather than wrapping a high-level HTTP client.

rqwstr is free: every tool works right after install, with no account, key or sign-up.

This repository hosts the release binaries and Claude Desktop .mcpb bundles. The source is proprietary. Docs: rqwstr.com.

Real v1.2.0 MCP session against a synthetic loopback fixture: one request, response-side filtering, stored search, and named retrieval. The capture and renderer are reproducible from demo/ against v1.2.0; no live target is involved.

Install

Claude Desktop (one-click)

Download the .mcpb for your platform from the latest release and double-click it to add rqwstr as a Claude Desktop extension.

• macOS — Apple silicon (darwin_arm64) or Intel (darwin_amd64)
• Linux — linux_amd64 or linux_arm64
• Windows — windows_amd64

Standalone MCP server

Download the binary for your platform from the latest release, then point your MCP client at it:

{
  "mcpServers": {
    "rqwstr": {
      "command": "rqwstr",
      "args": ["serve"]
    }
  }
}

rqwstr serve runs the MCP server on stdio. Add a scope rule before sending (scope action=add type=include host_pattern=...); requests go direct unless you configure a proxy.

Tools

17 HTTP tools:

send · send_h2 · fetch · intruder · race · chain · oob · parallel · scope · session · encode · export · save · search · hunt · profile · import

Workflows

The HTTP tools cover:

• Traffic — send (HTTP/1.1), send_h2 (HTTP/2), fetch, import (Burp / HAR), export (curl / python / requests)
• Hunt lifecycle — hunt, scope, save, search, session, profile
• Attacks — intruder (sniper, battering ram, pitchfork, cluster bomb), race (single-packet), chain, parallel
• OOB — oob with Interactsh integration
• Encoding — encode (URL, base64, JWT, and more)

Agents discover workflows through the rqwstr_docs tool. Per-hunt state lives in SQLite. Every tool is available to everyone.

Upgrading from v2

v3.0.0 removes rqwstr setup, logout and license; an old config's [license] section is ignored. Requests now go direct unless a proxy is configured. Set [defaults] proxy = "http://127.0.0.1:8080" in ~/.rqwstr/config.toml to keep routing through Burp or Caido.

Verify a download

Each release includes checksums.txt. Verify before running:

# Linux
sha256sum -c checksums.txt

# macOS
shasum -a 256 -c checksums.txt

Privacy Policy

rqwstr's data collection, usage, storage, sharing, retention, and contact practices are documented in the Privacy Policy.

License

Proprietary. © Kjøpstad IT. See rqwstr.com for terms.