# rqwstr

AI-native HTTP security testing toolkit, shipped as an MCP server. It gives an AI agent low-level control over HTTP/1.1 and HTTP/2 — raw framing, connection pinning, intruder-style fuzzing, request racing, OOB detection, and multi-step chains — on its own Go engine, rather than wrapping a high-level HTTP client.

**rqwstr is free:** every tool works right after install, with no account, key or sign-up.

This repository hosts the **release binaries and Claude Desktop `.mcpb` bundles**. The source is proprietary. Docs: **[rqwstr.com](https://rqwstr.com)**.

![rqwstr localhost MCP demo](demo/rqwstr-demo.gif)

Real v1.2.0 MCP session against a synthetic loopback fixture: one request, response-side
filtering, stored search, and named retrieval. The capture and renderer are reproducible
from [`demo/`](demo/README.md) against v1.2.0; no live target is involved.

## Install

### Claude Desktop (one-click)

Download the `.mcpb` for your platform from the [latest release](https://github.com/Kjopstad-IT/rqwstr-mcp/releases/latest) and double-click it to add rqwstr as a Claude Desktop extension.

- **macOS** — Apple silicon (`darwin_arm64`) or Intel (`darwin_amd64`)
- **Linux** — `linux_amd64` or `linux_arm64`
- **Windows** — `windows_amd64`

### Standalone MCP server

Download the binary for your platform from the [latest release](https://github.com/Kjopstad-IT/rqwstr-mcp/releases/latest), then point your MCP client at it:

```json
{
  "mcpServers": {
    "rqwstr": {
      "command": "rqwstr",
      "args": ["serve"]
    }
  }
}
```

`rqwstr serve` runs the MCP server on stdio. Add a scope rule before sending (`scope action=add type=include host_pattern=...`); requests go direct unless you configure a proxy.

## Tools

17 HTTP tools:

`send` · `send_h2` · `fetch` · `intruder` · `race` · `chain` · `oob` · `parallel` ·
`scope` · `session` · `encode` · `export` · `save` · `search` · `hunt` · `profile` ·
`import`

## Workflows

The HTTP tools cover:

- **Traffic** — `send` (HTTP/1.1), `send_h2` (HTTP/2), `fetch`, `import` (Burp / HAR), `export` (curl / python / requests)
- **Hunt lifecycle** — `hunt`, `scope`, `save`, `search`, `session`, `profile`
- **Attacks** — `intruder` (sniper, battering ram, pitchfork, cluster bomb), `race` (single-packet), `chain`, `parallel`
- **OOB** — `oob` with Interactsh integration
- **Encoding** — `encode` (URL, base64, JWT, and more)

Agents discover workflows through the `rqwstr_docs` tool. Per-hunt state lives in SQLite. Every tool is available to everyone.

## Upgrading from v2

v3.0.0 removes `rqwstr setup`, `logout` and `license`; an old config's `[license]` section is ignored. Requests now go direct unless a proxy is configured. Set `[defaults] proxy = "http://127.0.0.1:8080"` in `~/.rqwstr/config.toml` to keep routing through Burp or Caido.

## Verify a download

Each release includes `checksums.txt`. Verify before running:

```sh
# Linux
sha256sum -c checksums.txt

# macOS
shasum -a 256 -c checksums.txt
```

## Privacy Policy

rqwstr's data collection, usage, storage, sharing, retention, and contact practices are
documented in the [Privacy Policy](https://rqwstr.com/legal/privacy/).

## License

Proprietary. © Kjøpstad IT. See [rqwstr.com](https://rqwstr.com) for terms.