# Recipes from the terminal

> whisper graph runs WhisperGraph's named recipes from the command line: vendor identity, threat posture, typosquats, attack surface and BGP exposure, each with its own --help.

*Source: https://www.whisper.security/docs/cli/recipes*

---
`whisper graph` runs a named recipe from the catalog built into the binary. Every recipe is a subcommand with its own help, and every one names the docs page that explains it. You do not need to know any Cypher to use this page.

[Sign in](/docs/cli#sign-in) first, then list what is there:

```bash
whisper graph list
```

```text
RECIPE                     MODE    TITLE                                          DOCS
attack-surface             flow    Attack-Surface Mapper                          https://www.whisper.security/docs/recipes/pentest-recon
typosquat                  flow    Typosquat & Brand-Impersonation Scanner        https://www.whisper.security/docs/recipes/brand-protection
identify                   direct  Vendor / Operator Identity (whisper.identify)  https://www.whisper.security/docs/whisper-graph/procedures/identify
variants                   direct  Typosquat Variant Generator (whisper.variants) https://www.whisper.security/docs/whisper-graph/procedures/variants
...
```

The catalog is the same one the [MCP server](/docs/cli/mcp) exposes as tools, so a recipe you learn here is one you can hand to an agent later.

## Two kinds of recipe

A **direct** recipe wraps one procedure call and answers with one table:

```bash
whisper graph variants paypal.com
```

```text
variant      method      exists  confidence
aypal.com    OMISSION    true    0.805
pypal.com    OMISSION    true    0.805
paypal.cm    OMISSION    true    0.805
ppaypal.com  REPETITION  true    0.805
...
```

A **flow** recipe is a multi-step investigation, the same kind the [workflow gallery](/docs/ai/mcp/workflow-gallery) runs. It streams each step to stdout as one JSON line, `{"event": ..., "data": ...}`, and keeps its own status line on stderr, so a pipe sees only the data:

```bash
whisper graph typosquat paypal.com | jq -c '.event'
```

```text
"start"
"graph"
...
```

`whisper graph list` shows which is which in the `MODE` column.

## Inputs

Inputs go in catalog order as positional arguments, or by name:

```bash
whisper graph typosquat paypal.com
whisper graph typosquat domain=paypal.com
whisper graph typosquat --in domain=paypal.com
```

Leave one out and the recipe falls back to its documented default. `--param k=v` passes a tuning parameter; the recipe's docs page says which ones exist. The recipe's own help lists its inputs with their defaults:

```bash
whisper graph typosquat --help
```

```text
Typosquat & Brand-Impersonation Scanner (flow)

Find registered look-alikes of your brand and check which ones are dangerous.

Inputs (positional in this order, or named k=v / --in k=v):
  domain  (domain)  default: paypal.com

Docs: https://www.whisper.security/docs/recipes/brand-protection
```

## Raw output

On a direct recipe, `--json` prints the `columns`, `rows`, `statistics` envelope instead of the table, the same shape [`whisper query`](/docs/cli/query#json-output) prints. Flow recipes are already JSON, one line per step.

## Where each recipe is explained

The `DOCS` column is the page to read when a result surprises you. Direct recipes point at their procedure page under [Procedures](/docs/whisper-graph/procedures); flows point at the [Recipes](/docs/recipes) chapter, where the Cypher behind each step is written out so you can adapt it.

## Where next

- [Query](/docs/cli/query): when no recipe asks your question.
- [Local MCP server](/docs/cli/mcp): every recipe here as a tool an agent can call.