Skip to content
CLI
Skip navigation
CLI

Recipes from the terminal

Run any recipe in the catalog by name. Direct recipes answer with one table; flow recipes stream their steps as NDJSON you can pipe to jq.

Published

View as Markdown
On this page (5)

Recipes from the terminal Documentation

whisper graph runs a named recipe from the catalog built into the binary. Every recipe is a subcommand with its own help, and every one names the docs page that explains it. You do not need to know any Cypher to use this page.

Sign in first, then list what is there:

bash
whisper graph list
text
RECIPE                     MODE    TITLE                                          DOCS
attack-surface             flow    Attack-Surface Mapper                          https://www.whisper.security/docs/recipes/pentest-recon
typosquat                  flow    Typosquat & Brand-Impersonation Scanner        https://www.whisper.security/docs/recipes/brand-protection
identify                   direct  Vendor / Operator Identity (whisper.identify)  https://www.whisper.security/docs/whisper-graph/procedures/identify
variants                   direct  Typosquat Variant Generator (whisper.variants) https://www.whisper.security/docs/whisper-graph/procedures/variants
...

The catalog is the same one the MCP server exposes as tools, so a recipe you learn here is one you can hand to an agent later.

Two kinds of recipe

A direct recipe wraps one procedure call and answers with one table:

bash
whisper graph variants paypal.com
text
variant      method      exists  confidence
aypal.com    OMISSION    true    0.805
pypal.com    OMISSION    true    0.805
paypal.cm    OMISSION    true    0.805
ppaypal.com  REPETITION  true    0.805
...

A flow recipe is a multi-step investigation, the same kind the workflow gallery runs. It streams each step to stdout as one JSON line, {"event": ..., "data": ...}, and keeps its own status line on stderr, so a pipe sees only the data:

bash
whisper graph typosquat paypal.com | jq -c '.event'
text
"start"
"graph"
...

whisper graph list shows which is which in the MODE column.

Inputs

Inputs go in catalog order as positional arguments, or by name:

bash
whisper graph typosquat paypal.com
whisper graph typosquat domain=paypal.com
whisper graph typosquat --in domain=paypal.com

Leave one out and the recipe falls back to its documented default. --param k=v passes a tuning parameter; the recipe's docs page says which ones exist. The recipe's own help lists its inputs with their defaults:

bash
whisper graph typosquat --help
text
Typosquat & Brand-Impersonation Scanner (flow)

Find registered look-alikes of your brand and check which ones are dangerous.

Inputs (positional in this order, or named k=v / --in k=v):
  domain  (domain)  default: paypal.com

Docs: https://www.whisper.security/docs/recipes/brand-protection

Raw output

On a direct recipe, --json prints the columns, rows, statistics envelope instead of the table, the same shape whisper query prints. Flow recipes are already JSON, one line per step.

Where each recipe is explained

The DOCS column is the page to read when a result surprises you. Direct recipes point at their procedure page under Procedures; flows point at the Recipes chapter, where the Cypher behind each step is written out so you can adapt it.

Where next

  • Query: when no recipe asks your question.
  • Local MCP server: every recipe here as a tool an agent can call.