Whisper

Connect it to your AI

Claude Code

claude mcp add --transport http whisper https://whisper.online/mcp

Claude, ChatGPT, Cursor and other apps

Add it as a custom connector with this URL (Streamable HTTP):

https://whisper.online/mcp

claude mcp add whisper -- npx -y @whisper-security/whisper-mcp@0.222.0

claude mcp add whisper -- docker run -i --rm ghcr.io/whisper-sec/whisper:0.222.0

Cursor, VS Code and other apps (mcp.json)

{
  "mcpServers": {
    "whisper": {
      "url": "https://whisper.online/mcp"
    }
  }
}

Tools it offers

17 tools, as the server itself reported during our check on Oct 31, 2026.

• whisper_signupStart or complete Whisper signup from an email address alone, and receive an API key that unlocks the provisioning and governance skills on this card. Send {"email":"..."} to start; a six-digit code arrives by email; sen
• whisper_verifyIs this IPv6 address or hostname a real Whisper agent, and whose? Grades the full keyless trust chain: the reverse DNS record, the forward AAAA confirming it back to the same address, and the DANE-EE certificate pin publ
• whisper_rdapThe public registration record for any address in Whisper's space, in RFC 9083 form: the handle, the agent's label, its country, and the entities behind it. The same document the RDAP service serves at /ip/{address}, whi
• whisper_identifyIdentify an indicator (domain, IP, hash, …) against the graph. Answers without an API key. Example call: {"skill":"identify","input":"example.com"}
• whisper_assessAssess the risk/policy posture of one or more indicators. Answers without an API key. Example call: {"skill":"assess","input":"example.com"}
• whisper_walkWalk the graph from an indicator across its relationships. Answers without an API key. Example call: {"skill":"walk","input":"example.com"}
• whisper_watchWatch an indicator for change/activity over time. Answers without an API key. Example call: {"skill":"watch","input":{"action":"list"}}
• whisper_explainExplain a verdict - the evidence and reasoning behind it. Answers without an API key. Example call: {"skill":"explain","input":"example.com"}
• whisper_variantsEnumerate variants/permutations of an indicator. Answers without an API key. Example call: {"skill":"variants","input":"example.com"}
• whisper_originsTrace the origins/provenance of an indicator. Answers without an API key. Example call: {"skill":"origins","input":"example.com"}
• whisper_historyHistorical records for an indicator (incl. whois/bgp history). Answers without an API key. Example call: {"skill":"history","input":"example.com"}
• whisper_lookupTlsFingerprintLook up a TLS (JA3/JA4) fingerprint in the graph. Answers without an API key. Example call: {"skill":"lookupTlsFingerprint","input":"ja3:771,4865-4866-4867"}
• whisper_lookupTorRelayLook up Tor relay metadata for an address. Answers without an API key. Example call: {"skill":"lookupTorRelay","input":"185.220.101.1"}
• whisper_assetResolve an asset and its catalog of attributes. Answers without an API key. Example call: {"skill":"asset","input":"example.com"}
• whisper_threatintelThreat-intelligence indicator family (candidate apex/CDN/hosting). A family verb: name the sub-verb as "sub" alongside the input. Sub-verbs: candidateCdnApex, candidateMultiTenantApex, candidateSharedHostingIp.. Answers
• whisper_pslPublic-suffix-list family (tld-plus-one, is-public-suffix, affiliation). A family verb: name the sub-verb as "sub" alongside the input. Sub-verbs: tldPlusOne, isPublicSuffix, affiliation.. Answers without an API key. Exa
• whisper_topAsnsByPrefixCountTop ASNs ranked by announced-prefix count. Answers without an API key. Example call: {"skill":"topAsnsByPrefixCount","input":10}

Questions