Can you Call Top Secret from a Web Application that is not on MVS? Is that 
possible? 

Release:
Component: TSSMVS

Yes you can call Top Secret from a Web Application that is not on MVS. 
The web app would need to have programs that run on the web and in z/OS. 
If the web app runs in both the PC browser and in z/OS then you can use TSSCAI, TSSAI, and r_admin calls. 
if the web app program does not run in z/OS, then ldap would be needed to talk to Top Secret. CEM is an example of a web app that runs on both a PC browser and on the mainframe. 

Here is a link to the IBM documentation on r_admin calls (and many others). R_admin is on page 71: http://publibz.boulder.ibm.com/epubs/pdf/ich2d100.pdf