Rqwstr Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Rqwstr Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
AI-native HTTP security testing toolkit, shipped as an MCP server. It gives an AI agent low-level control over HTTP/1.1 and HTTP/2 — raw framing, connection pinning, intruder-style fuzzing, request racing, OOB detection, and multi-step chains — on its own Go engine, rather than wrapping a high-level HTTP client.
rqwstr is free: every tool works right after install, with no account, key or sign-up.
This repository hosts the release binaries and Claude Desktop `.mcpb` bundles. The source is proprietary. Docs: [rqwstr.com](https://rqwstr.com).
rqwstr localhost MCP demo
Real v1.2.0 MCP session against a synthetic loopback fixture: one request, response-side filtering, stored search, and named retrieval. The capture and renderer are reproducible from demo/ against v1.2.0; no live target is involved.
Download the .mcpb for your platform from the latest release and double-click it to add rqwstr as a Claude Desktop extension.
darwin_arm64) or Intel (darwin_amd64)linux_amd64 or linux_arm64windows_amd64Download the binary for your platform from the latest release, then point your MCP client at it:
{
"mcpServers": {
"rqwstr": {
"command": "rqwstr",
"args": ["serve"]
}
}
}rqwstr serve runs the MCP server on stdio. Add a scope rule before sending (scope action=add type=include host_pattern=...); requests go direct unless you configure a proxy.
17 HTTP tools:
send · send_h2 · fetch · intruder · race · chain · oob · parallel · scope · session · encode · export · save · search · hunt · profile · import
The HTTP tools cover:
send (HTTP/1.1), send_h2 (HTTP/2), fetch, import (Burp / HAR), export (curl / python / requests)hunt, scope, save, search, session, profileintruder (sniper, battering ram, pitchfork, cluster bomb), race (single-packet), chain, paralleloob with Interactsh integrationencode (URL, base64, JWT, and more)Agents discover workflows through the rqwstr_docs tool. Per-hunt state lives in SQLite. Every tool is available to everyone.
v3.0.0 removes rqwstr setup, logout and license; an old config's [license] section is ignored. Requests now go direct unless a proxy is configured. Set [defaults] proxy = "http://127.0.0.1:8080" in ~/.rqwstr/config.toml to keep routing through Burp or Caido.
Each release includes checksums.txt. Verify before running:
# Linux
sha256sum -c checksums.txt
# macOS
shasum -a 256 -c checksums.txtrqwstr's data collection, usage, storage, sharing, retention, and contact practices are documented in the Privacy Policy.
Proprietary. © Kjøpstad IT. See rqwstr.com for terms.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.