← Docs

Getting Started

Download, install, and send your first request in under 60 seconds.

1

Download the binary

The quickest way to install — auto-detects your OS and architecture:

$ curl -fsSL https://rqwstr.com/install.sh | sh

Or download manually for your platform.

2

Authenticate with rqwstr setup

This step is required on all tiers — free and Pro. The setup wizard opens your browser for authentication, then downloads your license key and config. Free accounts get a 1-year license; Pro subscribers get their Pro key via the same flow.

$ rqwstr setup

  Opening browser for authentication...
  → https://rqwstr.com/api/v1/auth/device/authorize?code=ABCD-1234

  Waiting for authorization... ✓

  License: Pro (expires 2026-04-08)
  Config written to ~/.rqwstr/config.toml

Don't have an account yet? Sign up free — it takes 10 seconds.

3

Add to Your MCP Client

Add rqwstr as an MCP server in your client configuration (e.g. Claude Code, Cursor, or any MCP-compatible client):

{
  "mcpServers": {
    "rqwstr": {
      "command": "rqwstr",
      "args": ["serve"]
    }
  }
}

v2.0.0

Egress is fail-closed until you allow a target

After setup, send, send_h2, chain, redirect hops, and session_setup fail closed until an enabled include rule exists — or you deliberately set [scope].unrestricted = true in server config. Check the active mode with scope(action="status") (reports mode and locked). Operator-file and unrestricted modes are locked against MCP mutation. 

scope(action="add", type="include", host_pattern="*.acme.com")
scope(action="status")

Immutable JSON policies live on the server as [scope].file — the old per-hunt hunt.scope_file input is gone. file and unrestricted are mutually exclusive. See Upgrade to 2.0.0 and the config builder.

4

Start hunting

Talk to your AI assistant in natural language. It calls rqwstr's MCP tools behind the scenes. Add an include rule first — otherwise the send is rejected:

You:

"Set up a hunt for httpbin.org and allow https://httpbin.org"

Assistant (calls hunt, scope):

Hunt created for httpbin.org. Include rule added for httpbin.org. Scope status: dynamic, unlocked.

You:

"Send a GET request to https://httpbin.org/get and show me the response headers"

Assistant (calls send):

200 OK | 89ms | 1.2kb

Content-Type: application/json
Access-Control-Allow-Origin: *
X-Powered-By: Flask

You:

"Send a POST to https://httpbin.org/post with JSON body {"username": "admin", "password": "test"} and save it as login-attempt"

Assistant (calls send, save):

200 OK | 112ms | 0.8kb — saved as "login-attempt"

You:

"Search all my stored requests for Set-Cookie headers"

Assistant (calls search):

Found 3 responses with Set-Cookie headers across 12 stored requests.

Next steps