Workflow gallery

1. Discover. list_workflows searches the gallery and returns matching workflows, each with its summary and its full parameter space — every dial, with options, ranges, and defaults — so an agent can run any variant, not just the default.
2. Run. run_workflow takes one or more slugs (with optional input / params) and runs them in a single call. It returns chained per-step results, derived signals, and an evidence trail — rendered, by default, as a ready markdown report the agent can relay verbatim.
3. Cite. Each result carries an evidence array: per step, the exact Cypher that ran, the row count, and the latency. The agent can show its work.

Gallery workflows are addressed by slug — a stable, human-readable identifier you pass to run_workflow. A few of the most-used:

These six cover the most common one-shot investigations — a brand sweep, a full indicator deep-dive, owned-estate and dependency mapping, an exposure sweep, and single-indicator enrichment.

The other six round out the catalogue: anycast-dns-root-sovereignty (how resilient a country's core DNS is if cut off from the world), bgp-hijack-exposure (grade a network's routing security and trace conflicts to affected domains), build-takedown-evidence-package (a ready-to-submit takedown dossier for a scam or phishing domain), nameserver-hijack-dns-consistency (the name-server misconfigs that enable DNS hijack), route-health (BGP route health — prefixes, peers, MOAS conflicts, RPKI), and subdomain-takeover (subdomains pointing at abandoned services an attacker could claim).

Ten of the twelve are also advertised as MCP prompts, so your client's prompt picker shows them as one-click investigations; the Reference documents the prompt surface. The two exceptions are deliberate: attack-surface and indicator are not advertised as prompts, because both run longer than a client will wait for a tool call — indicator runs 81 steps and the client gives up even on a small domain, and attack-surface scales with the estate, so the client gives up on a large one at every level. Both stay reachable through run_workflow by slug, where you choose the entity and own the latency.

The gallery holds 12 workflows in total — list_workflows is the authoritative, always-current index. Treat this table as a starting point, not the whole catalogue.

A partial run is not a clean result, and the response says which it is. Read three fields before you believe an empty answer:

• coverage.stepsWithData below coverage.stepsTotal is a coverage gap and therefore a finding. Report it as one.
• coverage.stepsSkipped usually means a capability layer is not live on this deployment rather than that the data is absent. Check readyLayers[] in the whisper://server resource.
• truncations[] records everything the report's token budget dropped. An untruncated-looking report is not complete until this array is empty.

Two known gaps, so you can tell them apart from your own mistake:

• route-health returns complete: false on an ASN. The asn-reputation step is skipped because that capability is not enabled on this deployment. Everything else runs — a live run on AS3356 returned success: true in 1.1 s with 4 of 6 steps carrying data — and the coverage block names the gap rather than passing it off as clean.
• attack-surface and indicator run longer than a client will wait for a tool call — on a large domain and on any domain respectively. That is why neither is advertised as a prompt.

If one of these returns nothing, you did not do it wrong.

Search the gallery; get back each item's summary and its full parameter space. All five filters are optional: keyword, persona, task, layer, and kind. Every entry carries kind: "workflow" — list_workflows({kind: "recipe"}) returns {"workflows": [], "count": 0}, and that empty array is the expected answer, not a fault. Called with no arguments it returns the entire catalogue, uncapped.

Returns

{
  "workflows": [
    {
      "slug": "typosquat",
      "kind": "workflow",
      "title": "Typosquat & Brand-Impersonation Scanner",
      "summary": "Find registered look-alikes of your brand and check which ones are dangerous.",
      "personas": ["Brand protection", "Threat intelligence"],
      "task": ["detect", "cluster", "enrich", "pivot"],
      "layers": ["DNS", "threat-intel", "BGP", "GeoIP", "WHOIS", "historical"],
      "inputs": [{ "paramName": "domain", "label": "Brand domain", "kind": "domain", "required": false }],
      "params": [],
      "stepCount": 10,
      "requiresCapability": null,
      "expectedOutput": "scored report — Registered look-alikes",
      "icon": "Tag",
      "docPath": "/docs/recipes/brand-protection"
    }
  ],
  "count": 1
}

Because every dial is described (options / ranges / default), the agent can run a non-default variant — for example flip includeNonExistent on, or narrow algorithms — without guessing the shape. Note stepCount: it is the workflow's declared step count, and the coverage.stepsTotal you get back from run_workflow is what actually ran. When the two differ, the difference is the story.

Read coverage before band. Only known-clean — coverage: known-clean. In coverage, no malicious evidence. licenses the word "clean"; no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at. means unknown, which is a different thing again; malicious-evidenced — coverage: malicious-evidenced. In coverage, with positive evidence of malice. and ambiguous — coverage: ambiguous. In coverage, and the evidence points both ways. mean there is evidence, whatever the band says. whisper.explain does not return coverage at all. Full contract: Coverage — what we looked at.

Run one or more workflows by slug in a single call.

Input

{
  "runs": [
    { "slug": "typosquat", "input": "paypal.com" },
    { "slug": "indicator-enrichment", "input": "paypal.com" }
  ],
  "format": "compact"
}

• runs[] — one or more { slug, input?, params? }. Multiple runs execute in the same call.
• format — table / graph / compact (default compact).
• profile — console / website / mcp / raw (default mcp), a top-level sibling of output. On the default compact path the server-owned mcp profile returns a ready, budgeted markdown report — verdict, findings, and a numbered ## Evidence appendix — in results[].markdown; table / graph still return per-step rows.
• output — optional { emit, slices } fine-tuning, applied on top of whichever profile resolves. Sending it at all replaces the profile's slice list and overrides its emit — it does not merge — so omit it entirely (the default) to keep the profile's markdown.

Output

{
  "results": [
    {
      "slug": "typosquat",
      "success": true,
      "complete": true,
      "coverage": { "stepsTotal": 11, "stepsWithData": 10, "stepsEmpty": 1, "stepsSkipped": 0, "stepsError": 0, "byStep": { "registered": "data", "scored": "data", "curate": "empty" } },
      "steps": [ { "stepId": "registered", "title": "Registered look-alikes", "status": "done", "rows": [ /* … */ ] } ],
      "derived": { "stepRowCounts": { "registered": 152, "scored": 50 } },
      "evidence": [
        { "step": "registered", "title": "Registered look-alikes", "cypher": "CALL whisper.variants($domain) YIELD variant, method, exists, confidence\nWHERE exists AND variant <> $domain AND NOT variant ENDS WITH ('.' + $domain)\nRETURN variant, method, confidence ORDER BY confidence DESC LIMIT 500", "rowCount": 152, "executionTimeMs": 347 },
        { "step": "scored", "title": "Threat verdict per look-alike", "cypher": "CALL whisper.assess($variants) YIELD host, label, band\nRETURN host, label, band LIMIT 50", "rowCount": 50, "executionTimeMs": 171 }
      ],
      "paramValues": {},
      "markdown": "**Verdict:** … ## Findings … ## Evidence — [1] step `registered`: CALL whisper.variants($domain) YIELD variant, method, exists, confidence … (152 rows)",
      "truncations": [],
      "profile": "mcp",
      "totalLatencyMs": 3152
    }
  ],
  "references": { "schema": "https://www.whisper.security/docs/whisper-graph/schema", "cypherGuide": "https://www.whisper.security/docs/cypher", "apiReference": "https://www.whisper.security/docs/cypher-api/reference", "slugsRun": ["typosquat"] }
}

That evidence array is what makes the result auditable: every step ships the exact Cypher it ran, its row count, and its executionTimeMs, so the agent can cite the query and the rows behind each conclusion. On the default mcp profile, markdown is the piece to hand to the user — verdict, findings, and a numbered ## Evidence appendix mapping each [n] citation to its fact, its step, and the exact Cypher behind it — relayed verbatim, not re-summarized. Anything the report's budget dropped is recorded in truncations[] ({layer, kind, target?, dropped, of}) and non-fatal warnings land in profileWarnings[] — never silently. complete and the coverage map flag any step that was skipped or returned nothing — a coverage gap is a finding, not a clean result (no-data != benign) — and references hands back the schema / Cypher / API doc links plus the slugs that ran. derived carries the rolled-up signals (counts, verdicts) an agent usually wants without re-deriving them, and paramValues records exactly which dials actually ran — an out-of-range param is clamped or filtered, never rejected, and the effective value is echoed back here.

A user asks: "Is anyone squatting on paypal.com, and is any of it dangerous?"

1 — discover the workflow.

list_workflows({ keyword: "typosquat brand protection" })
→ { workflows: [{ slug: "typosquat", kind: "workflow", inputs: [{paramName:"domain"}], stepCount: 10, … }], count: 1 }

2 — run it.

run_workflow({ runs: [{ slug: "typosquat", input: "paypal.com" }] })

3 — relay the report. On the default mcp profile the answer arrives ready-made: results[].markdown is a budgeted report — verdict, findings, and a numbered ## Evidence appendix — that the agent relays verbatim, not re-summarized.

A live run on 2026-08-08 returned 152 registered look-alikes of paypal.com, each tagged with the generation method that found it (homoglyph, bitsquatting, TLD-swap, hyphenation, …); 3 listed in a threat feed; 7 defensive registrations traced back to PayPal's own registrant through a WHOIS pivot; 5 operator clusters sharing a registrant email or nameserver; and 25 unregistered variants still available to squat. It took 46.5 s cold across 11 steps and reported complete: true.

Read exists carefully: it means registered or observed, not malicious. 152 look-alikes existing is normal for a brand this size; the 3 that are feed-listed and the 5 clusters are the finding.

Behind the report, every [n] citation maps to the evidence trail:

4 — pivot, still in one call. To go further, chain a second workflow in the same run_workflow:

run_workflow({ runs: [
  { slug: "typosquat",                       input: "paypal.com" },
  { slug: "build-takedown-evidence-package", input: "paypa1.com" }
]})

That returns the lookalikes and a ready-to-send takedown dossier on the worst offender — two investigations, one round-trip, both with their own evidence trails. (build-takedown-evidence-package measured 7.4 s, 7 of 7 steps complete.)

Live numbers will differ. WhisperGraph reflects the current state of the internet, not a fixed snapshot — counts, verdicts, and registrants change as feeds and routing refresh. The figures above are what one dated run returned, not a guarantee about the next one.

• Your first investigation — one alert worked end to end, with the pivot and the falsification step.
• MCP Reference — the full 7-tool, read-only surface and the evidence model.
• Setup guide — connect a client and run your first investigation.
• Use cases — the same 12 workflows, as guided flows you can run in the browser.
• Recipes — the narrower pivots the gallery does not carry, as copy-paste Cypher.