For AI agents
Give your agent the internet'sinfrastructure graph.
Whisper answers infrastructure questions over a read-only MCP server with seven tools, and over a keyless tier that returns real answers with no account and no key.
One key covers the graph API and the MCP server, and an agent can get one without a browser.
Questions your agent can hand over.
If a question sounds like one of these, Whisper has the data behind the answer.
Is this address or domain listed anywhere?
A verdict for an IP, hostname, CIDR or ASN, and how much of the picture it covers.
Who actually runs this host?
The operator behind a hostname, with how sure the answer is.
What else does this registrant own?
From one WHOIS email to every domain it registered.
Which look-alikes of our brand are registered?
Lookalike domains, sorted into the ones that matter first.
Which network routes this, and is it signed?
The prefix, the ASN that announces it, and its RPKI state.
What does this domain depend on?
Name servers, hosting, networks and buildings, in one traversal.
Connect the MCP server.
On Claude web, Desktop and mobile, add WhisperGraph from the Connectors Directory. Every other client takes the URL below and signs in with OAuth.
claude mcp add --transport http whisper-graph https://mcp.whisper.security
# then run /mcp in a session to sign in{
"mcpServers": {
"whisper-graph": {
"url": "https://mcp.whisper.security"
}
}
}{
"servers": {
"whisper-graph": {
"type": "http",
"url": "https://mcp.whisper.security"
}
}
}{
"mcpServers": {
"whisper-graph": {
"serverUrl": "https://mcp.whisper.security"
}
}
}# ~/.codex/config.toml
[mcp_servers.whisper-graph]
url = "https://mcp.whisper.security"
# then run: codex mcp login whisper-graphclaude mcp add --transport http whisper-graph https://mcp.whisper.security \
--header "Authorization: Bearer YOUR_API_KEY"Seven tools. Every one of them reads.
Nothing on the server writes to the graph, and the list is the same on every connection.
query
Read-only Cypher over the whole graph, with the query and row count behind every result.
explain_indicator
A threat verdict for IPs, hostnames, CIDRs and ASNs, with its coverage on every row.
explain_schema
What an entity is, what it holds and how it connects.
identify
Who runs a host. An attribution, never a verdict.
list_workflows
Search the prepared investigations and every parameter they take.
run_workflow
Run one or more of them in a call and get a cited report back.
read_docs
List, search and fetch the Whisper docs, live.
The API answers before you sign up.
The graph API has a keyless tier. Send a Cypher query with no key and you get real rows from the live graph. It belongs to the API: running an example on this site takes a free account, and the MCP server always takes a key.
No account, no key
POST the query to graph.whisper.security/api/query with no auth header.
Real answers
The same graph and the same read-only Cypher a key reaches.
A key goes further
Most cross-layer questions need one. Send it as X-API-Key and run the same query again.
Skills that teach an agent to investigate.
Four open-source playbooks on top of the MCP server: triage one indicator, rank a list, write Cypher, and sort look-alike domains. Each one checks what a result is worth before the agent writes a sentence.
/plugin marketplace add whisper-sec/whisper-skills
/plugin install whisper-graph@whisper-securitynpx skills add whisper-sec/whisper-skillsFrom a terminal, or from your code.
The CLI
One signed binary: Cypher, named recipes and a local MCP server over stdio.
Node SDK
npm i whisper-id: a routable Whisper identity for any Node agent.
Python SDK
pip install whisper-id: the same identity for any Python agent.
Edge SDK
whisper-edge: dependency-free, for serverless and edge runtimes.
Embed the graph
Building a product on the graph? One endpoint, metered per call.
Get a key without a browser.
Two HTTP calls, with no browser and no human in the loop. If bot protection is ever on for sign-ups, the first call answers 400 captcha_missing_token. Write to support@whisper.security and we finish the sign-up with you.
Send an email address
POST it to console.whisper.security/api/signup. The optional attribution block names your agent and its runtime. It never blocks a sign-up.
Read the code
A six-digit code arrives at that address.
Verify it
POST the code to /api/signup/verify. The key comes back in the response.
Use one key everywhere
The same key works for the graph API and the MCP server.
Start, then verify.
curl -s -X POST https://console.whisper.security/api/signup \
-H "Content-Type: application/json" \
-d '{
"email": "your-agent@example.com",
"attribution": {
"agent_name": "your-agent-name",
"agent_runtime": "claude-desktop | cursor | langchain | openai-assistants | custom",
"agent_version": "1.2.3",
"source": "smithery | mcp-directory | self | blog-post"
}
}'curl -s -X POST https://console.whisper.security/api/signup/verify \
-H "Content-Type: application/json" \
-d '{ "signup_id": "<from step 1>", "code": "<from email>" }'Investigations, ready to run.
The catalog holds prepared investigations, filed by role and by job. An agent finds them with list_workflows and runs them with run_workflow. A person browses the same catalog here on the site.
Where the limits are written.
Every account can read the limits it runs under from the API itself, with CALL whisper.quota(). The Cypher API reference explains it, Pricing lists the plans, and the Terms cover use of the API and the MCP server.