Rqwstr

io.github.Kjopstad-ITPublished by GitHub account Kjopstad-ITv1.1.0Updated Oct 24, 2026

AI-native HTTP security testing MCP server — 17 tools with raw HTTP/1.1 + HTTP/2 control

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Lets an assistant run low-level HTTP/1.1 and HTTP/2 security tests, including fuzzing, request racing, and out-of-band detection.

What you can do
Rqwstr is an HTTP security testing toolkit exposed as an MCP server with 17 tools. It gives an agent raw control over HTTP/1.1 and HTTP/2 framing, connection pinning, intruder-style fuzzing, single-packet request racing, multi-step chains, and out-of-band detection with Interactsh. It also covers traffic import and export, encoding, scoping, sessions, and search over stored hunt state kept in SQLite.
When to use it
Worth adding when an assistant needs to probe or fuzz HTTP endpoints at a low level rather than through a high-level HTTP client, for example during authorized security testing, request replay, or building multi-step attack chains. It is aimed at desktop use with a Claude Desktop extension or a standalone MCP client.
Requirements
Runs as a local process on the user's machine over stdio, installed as a Claude Desktop .mcpb bundle or a standalone binary started with the serve argument. Platform-specific builds are provided for macOS, Linux, and Windows. A free or Pro license is needed; the free tier covers the core toolset and Pro unlocks the heavier offensive tools. No environment variables or headers are declared.
Before you install
This is an offensive security tool: the intruder, race, chain, and out-of-band tools send traffic to targets, so only use it against systems you are authorized to test. The source is proprietary and the free tier is limited, with a Pro license required for the heavier offensive tools. Per-hunt state is stored locally in SQLite, and out-of-band detection uses Interactsh, which involves an external service. Verify release checksums before running a downloaded binary.

Installation

In SourceWeft

  1. Open Rqwstr in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

rqwstr

AI-native HTTP security testing toolkit, shipped as an MCP server. It gives an AI agent low-level control over HTTP/1.1 and HTTP/2 — raw framing, connection pinning, intruder-style fuzzing, request racing, OOB detection, and multi-step chains — on its own Go engine, rather than wrapping a high-level HTTP client.

rqwstr is free: every tool works right after install, with no account, key or sign-up.

This repository hosts the release binaries and Claude Desktop .mcpb bundles. The source is proprietary. Docs: rqwstr.com.

[rqwstr localhost MCP demo]

Real v1.2.0 MCP session against a synthetic loopback fixture: one request, response-side filtering, stored search, and named retrieval. The capture and renderer are reproducible from demo/ against v1.2.0; no live target is involved.

Install

Claude Desktop (one-click)

Download the .mcpb for your platform from the latest release and double-click it to add rqwstr as a Claude Desktop extension.

  • macOS — Apple silicon (darwin_arm64) or Intel (darwin_amd64)
  • Linux — linux_amd64 or linux_arm64
  • Windows — windows_amd64

Standalone MCP server

Download the binary for your platform from the latest release, then point your MCP client at it:

json
{  "mcpServers": {    "rqwstr": {      "command": "rqwstr",      "args": ["serve"]    }  }}

rqwstr serve runs the MCP server on stdio. Add a scope rule before sending (scope action=add type=include host_pattern=...); requests go direct unless you configure a proxy.

Tools

17 HTTP tools:

send · send_h2 · fetch · intruder · race · chain · oob · parallel · scope · session · encode · export · save · search · hunt · profile · import

Workflows

The HTTP tools cover:

  • Traffic — send (HTTP/1.1), send_h2 (HTTP/2), fetch, import (Burp / HAR), export (curl / python / requests)
  • Hunt lifecycle — hunt, scope, save, search, session, profile
  • Attacks — intruder (sniper, battering ram, pitchfork, cluster bomb), race (single-packet), chain, parallel
  • OOB — oob with Interactsh integration
  • Encoding — encode (URL, base64, JWT, and more)

Agents discover workflows through the rqwstr_docs tool. Per-hunt state lives in SQLite. Every tool is available to everyone.

Upgrading from v2

v3.0.0 removes rqwstr setup, logout and license; an old config's [license] section is ignored. Requests now go direct unless a proxy is configured. Set [defaults] proxy = "http://127.0.0.1:8080" in ~/.rqwstr/config.toml to keep routing through Burp or Caido.

Verify a download

Each release includes checksums.txt. Verify before running:

sh
# Linuxsha256sum -c checksums.txt
# macOSshasum -a 256 -c checksums.txt

Privacy Policy

rqwstr's data collection, usage, storage, sharing, retention, and contact practices are documented in the Privacy Policy.

License

Proprietary. © Kjøpstad IT. See rqwstr.com for terms.

Source: README.md at commit 943051e

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.1.0LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.