Workflow & recipe gallery

1. Discover. list_workflows searches the gallery and returns matching playbooks, each with its summary and its full parameter space — every dial, with options, ranges, and defaults — so an agent can run any variant, not just the default.
2. Run. run_workflow takes one or more slugs (with optional input / params) and runs them in a single call. It returns chained per-step results, derived signals, and an evidence trail.
3. Cite. Each result carries an evidence array: per step, the exact Cypher that ran, the row count, and the latency. The agent can show its work.

Gallery playbooks are addressed by slug. The tmpl- prefix marks a templated recipe — a parameterised investigation you run by name. A few flagship slugs:

These five cover the most common one-shot investigations — a brand sweep, a WHOIS timeline, a CDN de-cloak, host identity, and a host verdict.

The gallery holds many more — list_workflows is the authoritative, always-current index. Treat this table as a starting point, not the whole catalogue.

Search the gallery; get back each item's summary and its full parameter space.

Returns

{
  "workflows": [
    {
      "slug": "tmpl-brand-variants",
      "title": "Brand variants & typosquats",
      "summary": "Registered lookalikes of a domain, with the mutation method and a confidence score.",
      "personas": ["brand-protection", "threat-intel"],
      "task": "brand-protection",
      "layers": ["dns", "threat-intel", "whois"],
      "inputs": [{ "name": "domain", "type": "hostname", "required": true }],
      "params": [
        { "name": "includeNonExistent", "type": "boolean", "default": false },
        { "name": "algorithms", "type": "string[]", "options": ["omission", "homoglyph", "bitsquat", "tld-swap", "…"] }
      ],
      "stepCount": 4,
      "requiresCapability": null,
      "expectedOutput": "A table of registered variant domains, each with method, confidence, and any threat-feed listings."
    }
  ],
  "count": 1
}

Because every dial is described (options / ranges / default), the agent can run a non-default variant — e.g. flip includeNonExistent on, or narrow algorithms — without guessing the shape.

Run one or more playbooks by slug in a single call.

Input

{
  "runs": [
    { "slug": "tmpl-brand-variants", "input": "paypal.com" },
    { "slug": "tmpl-whois-history", "input": "paypal.com", "params": { "limit": 20 } }
  ],
  "format": "compact"
}

• runs[] — one or more { slug, input?, params? }. Multiple runs execute in the same call.
• format — table / graph / compact (default compact).

Output

{
  "results": [
    {
      "slug": "tmpl-brand-variants",
      "success": true,
      "complete": true,
      "coverage": { "stepsTotal": 2, "stepsWithData": 2, "stepsEmpty": 0, "stepsSkipped": 0, "stepsError": 0, "byStep": { "1": "data", "2": "data" } },
      "steps": [ { "title": "Generate variants", "rows": [ /* … */ ] } ],
      "derived": { "registeredCount": 7, "threatListedCount": 2 },
      "evidence": [
        { "step": 1, "title": "Generate variants", "cypher": "RETURN whisper.variants(\"paypal.com\")", "rowCount": 34, "executionTimeMs": 41 },
        { "step": 2, "title": "Check registration + threat", "cypher": "MATCH (h:HOSTNAME) WHERE h.name IN $variants RETURN …", "rowCount": 7, "executionTimeMs": 88 }
      ],
      "paramValues": { "includeNonExistent": false },
      "totalLatencyMs": 129
    }
  ],
  "references": { "schema": "https://www.whisper.security/docs/whisper-graph/schema", "cypherGuide": "https://www.whisper.security/docs/cypher", "apiReference": "https://www.whisper.security/docs/cypher-api/reference", "slugsRun": ["tmpl-brand-variants"] },
  "quota": { "plan": "free", "perMinuteRemaining": 58, "perDayRemaining": 940 }
}

That evidence array is what makes the result auditable: every step ships the exact Cypher it ran, its row count, and its executionTimeMs, so the agent can cite the query and the rows behind each conclusion. complete and the coverage map flag any step that was skipped or returned nothing — a coverage gap is a finding, not a clean result (no-data != benign) — and references hands back the schema / Cypher / API doc links plus the slugs that ran. derived carries the rolled-up signals (counts, verdicts) an agent usually wants without re-deriving them, and paramValues records exactly which dials were used.

A user asks: "Is anyone squatting on paypal.com, and is any of it dangerous?"

1 — discover the recipe.

list_workflows({ query: "typosquat brand protection" })
→ { workflows: [{ slug: "tmpl-brand-variants", inputs: [{name:"domain"}], params: [{name:"includeNonExistent", default:false}], … }], count: 1 }

2 — run it.

run_workflow({ runs: [{ slug: "tmpl-brand-variants", input: "paypal.com" }] })

3 — read the result and cite the evidence. The agent answers in plain language —

Found 7 registered lookalikes of paypal.com; 2 are on threat feeds (paypa1.com, paypal-secure.net). The rest resolve but aren't flagged.

— and can back every number with the evidence trail:

4 — pivot, still in one call. To go further, chain a second recipe in the same run_workflow:

run_workflow({ runs: [
  { slug: "tmpl-brand-variants", input: "paypal.com" },
  { slug: "tmpl-whois-history",  input: "paypa1.com" }
]})

That returns the lookalikes and the WHOIS history of the worst offender — two investigations, one round-trip, both with their own evidence trails.

Live numbers will differ. WhisperGraph reflects the current state of the internet, not a fixed snapshot — counts, verdicts, and registrants change as feeds and routing refresh.

• MCP Reference — the full 6-tool surface and the evidence model.
• Setup guide — connect a client and run your first investigation.
• Agent Skills — client-side skills that pick the right gallery recipe for you.
• Use cases — the same playbooks, as guided flows you can run in the browser.