Connector changelog

This page logs changes to the MCP connector specifically — its tools, its resources, its prompts, the fields a response carries, and the workflow gallery behind run_workflow. For product and data-layer changes across all of WhisperGraph, see the general changelog.

An MCP client caches a tool list. That is the reason this page exists separately: a change to the connector's shape is a change to a contract your agent has already read, and it is not visible in a log about data layers.

Check the current shape, don't trust this page alone

Three endpoints answer "what does the connector look like right now", and all three are live:

A changelog entry says what moved. Only those three say what is true today.

2026-09

• Ten validation rules. A tenth query-safety rule joins the set: a fixed-length, untyped outgoing expansion from an announced or registered prefix is rejected with a fix, because the engine cannot serve that shape. Type the relationship, expand into the anchor, use a [*1..N] form, or anchor on a PREFIX. See Query language.
• explain_indicator says when it cannot score. A row the engine has evidence for but no score to report now reads score: null, level: UNSCORED and scoreUnavailable: true, never a clean-looking NONE. An ASN's reputation composite travels separately as reputation{value, scale, direction, category}; recoveredScore appears only when the recovered number is on score's own scale.
• Roster listings are no longer counted as threats. Each sources[] entry carries its feed category and a threatCategory flag, and the row carries threatFeedCount and nonThreatFeedCount, so a Tor roster or a popularity list is a fact about the node rather than an abuse report. Every advisory is spelled out in explanation, a row listed in a threat feed never reads "No known risk", and dataCoverage is present on every row.
• Per-layer freshness on whisper://stats. Each query-time layer reports lastRefresh, ageSeconds and a coverage verdict (OK / DEGRADED / EMPTY), so a stale or thin layer is visible before you read a result rather than inferred afterwards.
• run_workflow reports over the declared step list. Coverage is reconciled against the workflow's declared steps, so a step that never reported back is skipped rather than missing. An entity sent inside params is still used and flagged via inputSource; a key matching no declared param comes back in ignoredParams.
• identify confidence bands are documented ranges. DIRECT > DERIVED (0.70–0.89) > HEURISTIC (0.4) > UNKNOWN (0.0); do not threshold on a single number. See identify.

2026-08

• The connector became read-only, and it is not a default. submit_indicator and submit_feedback were removed along with the mcp:write scope. Every remaining tool is annotated readOnlyHint: true, destructiveHint: false. There is no contribution or feedback tool on this surface, under any scope or deployment. Engine procedures that write (whisper.submit, whisper.watch) are refused by name on the query path — see Procedures.
• assess and walk folded into explain_indicator and identify. explain_indicator gained the detail knob (auto / full / band) and the batch indicators[] argument; identify gained the automatic structural-neighbourhood fallback for hosts it cannot place. Both remain callable as procedures (whisper.assess, whisper.walk) inside query.
• identify joined the tool surface. Vendor and role attribution for a batch of hosts, deliberately not a threat verdict. See whisper.identify().
• Every result is held to a response-size budget. An over-budget query result is fitted rather than dropped (rows trimmed, truncated / budgetTruncated: true, a pagination continuation pointer); every other tool returns an honest, schema-valid empty result with a resultTruncated{} block. Nothing is capped silently.
• run_workflow runs inside a wall-clock budget. On expiry it returns a successful partial (success: true, partial: true, guidance in warnings[]), never a hang. attack-surface cannot fit that budget on any input and is refused up front with notRun: true, a reason and a howToNarrow hint.
• OAuth scopes are enforced and documented. mcp:read and offline_access (plus the legacy mcp:query) are what the discovery documents advertise; Client ID Metadata Documents join Dynamic Client Registration as a way to register a client; refresh tokens can be revoked; any browser origin is served by default.
• Feeds and categories anchor on .id. explain_schema and the tool descriptions teach the stable slug rather than the display name, and evidence.cypher carries the query that actually ran — the rewritten form if the engine auto-bounded or corrected yours.

2026-07

• run_workflow gained server-owned output profiles. profile (console / website / mcp / raw) selects a server-maintained response shape; the default mcp profile returns a budgeted markdown report with a numbered evidence appendix. output fine-tunes on top of a profile and replaces its slice list rather than merging with it. See the Workflow gallery.
• Truncation became explicit. Anything a report's budget dropped is recorded in truncations[] and non-fatal warnings land in profileWarnings[]. Nothing is dropped silently.
• The docs are read live. read_docs lists, searches or fetches the published documentation at call time, so nothing about the query language has to sit in always-on context.

2026-06

• The tool surface was reworked around the gallery. list_workflows and run_workflow arrived alongside explain_schema and read_docs; the always-listed resources were trimmed to four; the prompts are generated from the gallery, one per flagship workflow.
• query learned to correct itself. A typed error envelope with machine-readable errorCodes, a fix object for corrections an agent must apply, automatic bounding of limit-less queries, format: compact, count-first pagination, and an evidence block on every call.
• The agent tool set landed. identify, assess and walk reached the connector alongside the reconciled threat verdict — verdictScore, verdictLevel, verdictBlocking — so an agent reads one answer instead of reconciling feed signals itself.
• Verdicts carry coverage. Every explain_indicator row gained the coverage block that separates "not listed at this granularity" from "safe", and sharedHost flags multi-tenant apexes where a hostname-level verdict is structurally uninformative.
• Authentication is always enforced, and a refresh token keeps an active connection signed in for up to six months.

Reading a change that affects you

• A field that appears is safe to ignore until you want it. Responses are objects; an unknown key is not an error.
• A field that disappears, or a tool that is renamed, is the case that breaks an agent silently, because a request built against the old name usually still returns a valid-looking response. Those changes are announced here and governed by the deprecation policy.
• The workflow gallery moves independently. Workflows are added and retired without a connector release. Discover them with list_workflows at call time rather than hard-coding a slug list — list_workflows with no argument returns the whole catalogue.