Procedures

CALL runs a procedure standalone, with YIELD to pick and filter columns, or once per row in the UNWIND ... CALL form. A standalone call with no YIELD returns every column the procedure produces. Full clause syntax is in Syntax & Clauses.

CALL whisper.variants("paypal.com")
YIELD variant, method, exists, confidenceLabel
WHERE exists
RETURN variant, method, confidenceLabel
LIMIT 6

Four procedures do the heavy lifting, each with its own page. Beyond them, an identity family answers "whose infrastructure is this", and a set of helpers cover naming and lookups.

Read coverage before band. Only known-clean — coverage: known-clean. In coverage, no malicious evidence. licenses the word "clean"; no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at. means unknown, which is a different thing again; malicious-evidenced — coverage: malicious-evidenced. In coverage, with positive evidence of malice. and ambiguous — coverage: ambiguous. In coverage, and the evidence points both ways. mean there is evidence, whatever the band says. whisper.explain does not return coverage at all. Full contract: Coverage — what we looked at.

Investigation

Identity & assessment

Helpers

The tables above are the ones worth learning first. This one is the whole surface, generated from CALL db.procedures() — every procedure the engine registers, whether or not a page has been written about it. Mode is the engine's own: READ answers a question, WRITE changes something and needs a signed-in key.

Rows generated from CALL db.procedures() YIELD name, signature, description, mode against https://graph.whisper.security, fetched 2026-08-09T21:11:53Z.

Reach for the procedures first. They answer the hardest questions in one call, usually faster and cleaner than a hand-written deep traversal.

• The logic runs server-side. explain() computes a score from feed count, feed weights, recency, and the threat density of the surrounding network, and hands back the arithmetic in factors[] with the named feeds in sources[]. Reproducing that by walking LISTED_IN edges yourself takes more hops and gives you less evidence.
• A procedure replaces a slow scan. Where a hand-written query walks the graph itself, a procedure does the same work in one call, which makes it the standard fix for a query that runs long — alongside anchoring the query and adding a LIMIT. See Best Practices.
• The output is decision-ready. A procedure returns labeled columns you can paste straight into a ticket.

One caveat: BGP routing history over a large network is slow. Keep a LIMIT on whisper.history() calls and expect a longer round trip.

Some of these calls need an API key. Pass it in the X-API-Key header; sign in to get one — there is no card to enter.

The db.* procedures describe the live schema, so you can confirm a label or edge exists before you anchor on it.

CALL db.labels() YIELD label RETURN label ORDER BY label LIMIT 12

db.labels() lists every node label with its count. db.relationshipTypes() lists every edge type with its source and target labels. db.propertyKeys() lists every property name in use. db.schema() returns a structured overview of the whole graph and accepts a format argument ('json', 'markdown', or 'details'); db.schema.nodeTypeProperties() and db.schema.relTypeProperties() list the properties on each label and edge type. The full label, edge, and property model is on the Graph Schema pages.