Rqwstr Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Rqwstr Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
AI-native HTTP security testing toolkit, shipped as an MCP server. It gives an AI agent low-level control over HTTP/1.1 and HTTP/2 — raw framing, connection pinning, intruder-style fuzzing, request racing, OOB detection, and multi-step chains — on its own Go engine, rather than wrapping a high-level HTTP client.
This repository hosts the release binaries and Claude Desktop `.mcpb` bundles. The source is proprietary. Docs and sign-up: [rqwstr.com](https://rqwstr.com).
Download the .mcpb for your platform from the latest release and double-click it to add rqwstr as a Claude Desktop extension.
darwin_arm64) or Intel (darwin_amd64)linux_amd64 or linux_arm64windows_amd64Download the binary for your platform from the latest release, then point your MCP client at it:
{
"mcpServers": {
"rqwstr": {
"command": "rqwstr",
"args": ["serve"]
}
}
}rqwstr serve runs the MCP server on stdio.
17 HTTP tools driven by an AI agent over MCP:
send (HTTP/1.1), send_h2 (HTTP/2), fetch, import (Burp / HAR), export (curl / python / requests)hunt, scope, save, search, session, profileintruder (sniper, battering ram, pitchfork, cluster bomb), race (single-packet), chain, paralleloob with Interactsh integrationencode (URL, base64, JWT, and more)Agents discover workflows through the rqwstr_docs tool. Per-hunt state lives in SQLite. The free tier is the core toolset; a Pro tier unlocks the heavier offensive tools.
Each release includes checksums.txt. Verify before running:
sha256sum -c checksums.txtProprietary. © Kjøpstad IT. See rqwstr.com for terms.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.