Rqwstr is an AI-native HTTP security testing toolkit that provides AI agents with low-level control over HTTP/1.1 and HTTP/2 for offensive web security testing. Key capabilities include:
HTTP Traffic Generation & Manipulation: Send raw HTTP/1.1 (send) and HTTP/2 (send_h2) requests with advanced options like header smuggling, content-length overrides, connection pinning, and pause attacks. Import raw requests from Burp or HAR (import), export stored requests to various formats (export), and fetch/search stored requests and responses.
Advanced Attack Vectors: Perform Burp Intruder-style fuzzing (intruder) with multiple attack types and payload management. Test for race conditions (race) with burst, single-packet, or staggered timing. Execute multi-step request chains (chain) with variable extraction, conditional logic, and automatic cookie forwarding. Send parallel requests (parallel) for throughput attacks or synchronized testing.
Out-of-Band Interaction Detection: Detect blind vulnerabilities via OOB interactions (oob) using Interactsh integration.
Hunt & Session Management: Create and manage named hunts (hunt) with targets, proxies, and default settings (SQLite-backed). Manage scope rules (scope) for testing, cookie jars (session), and variable profiles (profile).
Utilities: Encode/decode payloads (encode) using various schemes, and access built-in agent guidance (rqwstr_docs).
AI-native HTTP security testing toolkit, shipped as an MCP server. It gives an AI agent low-level control over HTTP/1.1 and HTTP/2 — raw framing, connection pinning, intruder-style fuzzing, request racing, OOB detection, and multi-step chains — on its own Go engine, rather than wrapping a high-level HTTP client.
This repository hosts the release binaries and Claude Desktop .mcpb bundles. The source is proprietary. Docs and sign-up: rqwstr.com.
Real v1.2.0 MCP session against a synthetic loopback fixture: one request, response-side
filtering, stored search, and named retrieval. The capture and renderer are reproducible
from demo/ with an activated free or Pro license; no live target is
involved.
Download the .mcpb for your platform from the latest release and double-click it to add rqwstr as a Claude Desktop extension.
macOS — Apple silicon (darwin_arm64) or Intel (darwin_amd64)
Linux — linux_amd64 or linux_arm64
Windows — windows_amd64
Download the binary for your platform from the latest release, then point your MCP client at it:
{
"mcpServers": {
"rqwstr": {
"command": "rqwstr",
"args": ["serve"]
}
}
}rqwstr serve runs the MCP server on stdio.
Related MCP server: pentestMCP
17 HTTP tools:
send · send_h2 · fetch · intruder · race · chain · oob · parallel ·
scope · session · encode · export · save · search · hunt · profile ·
import
The HTTP tools cover:
Traffic — send (HTTP/1.1), send_h2 (HTTP/2), fetch, import (Burp / HAR), export (curl / python / requests)
Hunt lifecycle — hunt, scope, save, search, session, profile
Attacks — intruder (sniper, battering ram, pitchfork, cluster bomb), race (single-packet), chain, parallel
OOB — oob with Interactsh integration
Encoding — encode (URL, base64, JWT, and more)
Agents discover workflows through the rqwstr_docs tool. Per-hunt state lives in SQLite. The free tier is the core toolset; a Pro tier unlocks the heavier offensive tools.
Each release includes checksums.txt. Verify before running:
# Linux
sha256sum -c checksums.txt
# macOS
shasum -a 256 -c checksums.txtrqwstr's data collection, usage, storage, sharing, retention, and contact practices are documented in the Privacy Policy.
Proprietary. © Kjøpstad IT. See rqwstr.com for terms.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Kjopstad-IT/rqwstr-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server