Engineers and AI agents
Every agent gets an identity anyone can check.
And an off switch it cannot reach.
Your agents can reach whatever their host can reach, DNS included, and a control that runs on that host is one a rogue agent can tamper with.
Whisper Graph XDR is identity and egress control for AI agents: each one gets its own address anyone can verify with dig, a rule on what it may reach and a revoke that works from our edge.
Put a rule on the way out.
An agent that can read private data, take in untrusted content and send data out is what Simon Willison calls the lethal trifecta.
The first two are usually the job. Graph XDR puts a rule on the third: every lookup an agent makes passes a policy that knows who is on the other end, and on a routed tier, every connection does too.
In September 2026, OpenAI reported that an agent in one of its training sandboxes reached an outside chatbot through insufficient DNS filtering, and has since limited DNS queries to an allowed list.
An identity you can verify with dig.
A real agent identity from our lab. The reverse DNS, the forward match and the registry record are public and DNSSEC-signed, so nobody has to trust our API.
$ dig -x 2a04:2a01:c787:fa3b:d78c:23bd:a6:c4ae +short
ad78c23bd00a6c4ae.tb00ab91b62bf1dbae50af8a9a292633e.agents.whisper.online.
$ curl -s https://rdap.whisper.online/ip/2a04:2a01:c787:fa3b:d78c:23bd:a6:c4ae | jq .status
[
"active"
]One identity per agent, and everything that follows from it.
Its own address
An IPv6 address of its own on Whisper's network, AS219419, with signed reverse DNS, a pinned certificate and a public registry record.
Every identity traces back to whoever created it, with a tree for sub-agents.
A rule on what it may reach
Countries, bulletproof hosting, Tor exits, new registrations and RPKI-invalid routes, plus a per-identity firewall by address, network, host and port.
Try it in monitor mode first.
An off switch outside the host
Revoke the identity and it stops resolving, its firewall drops traffic and its public record is withdrawn.
See the blast radius before you cut.
Revoke a build server and its agents stop with it.
Identities form a tree. Revoking one cuts everything connected beneath it, and the console shows you exactly what before you confirm. Every action goes to the audit trail.
Nothing here asks you to trust us.
Whisper's own network
AS219419, allocated by RIPE, with exact-length RPKI routes you can check without asking us.
A public log of every identity
Every identity granted or revoked is written to a public, append-only log, cosigned by a witness.
Compared, with sources
Graph XDR's agent identity next to other identity products, cell by cell, with a source for each.
Three ways to connect an agent.
Route all its traffic through a tunnel, send chosen apps through our egress proxy, or use only our DNS. An identity and DNS-level policy need no software on the host.
Where to start building.
Give an agent an identity
How identities are issued and named, and how anyone checks one.
Attributable egress for fleets
The tunnel, egress proxy and DNS-only tiers, and the policy bundles.
Ground an agent over MCP
The MCP server, agent sign-up and Agent Skills.
Issue and revoke identities
Every change to an agent goes through one procedure you can script.
What engineers ask first.
Write down the rule you could never enforce.
Then start free with five identities, for good, and €3.99 per endpoint per month, billed yearly, after that.