\n The internet's infrastructure graph for AI agents - 46B nodes and edges mapping DNS, IPs, ASNs, BGP, WHOIS, Web links and threat intel. Sign up programmatically in 2 HTTP calls.\n
\n\n
\n \n \n = 20\" />\n
\n\n---\n\n**WhisperGraph** is an MCP server backed by the world's largest internet-infrastructure graph database - **46 billion nodes and edges across 20 entity types**, mapping every domain, IP, ASN, prefix, organization, Web link and threat-intelligence listing into a single Cypher-queryable graph. Used by security teams, incident responders, and AI agents for investigation, attribution, brand protection, and infrastructure forensics.\n\n**Built for agents from day one.**\n\n- **Programmatic signup in 2 HTTP calls.** No browser, no CAPTCHA, no human-in-the-loop. Email verification only. Working API key in ~5 seconds.\n- **Free trial for everyone**, including agents. Paid tiers for higher quotas.\n\n**What you can ask:**\n\n- DNS: resolution, nameservers, MX, SPF chains, DNSSEC\n- Routing: ASN ownership, BGP origin history, MOAS conflicts, peering\n- Hosting & ownership: registrar, WHOIS contacts, organization mapping\n- Threat intel: ~40 feeds across 18 categories, `CALL explain()` for full threat scoring\n- Historical: WHOIS history, BGP route changes\n- Web: 10.9B hyperlinks for inter-domain analysis\n\n**Learn more:**\n[Agent signup](https://www.whisper.security/docs/agent-signup) ·\n[WhisperGraph intro](https://www.whisper.security/docs/whisper-graph-intro) ·\n[Cypher API reference](https://www.whisper.security/docs/cypher-api-reference) ·\n[Query guide](https://www.whisper.security/docs/cypher-query-guide) ·\n[Cypher syntax](https://www.whisper.security/docs/cypher-syntax) ·\n[Functions](https://www.whisper.security/docs/cypher-functions) ·\n[Best practices](https://www.whisper.security/docs/cypher-best-practices) ·\n[MCP setup](https://www.whisper.security/docs/mcp/setup)\n\n## Quick start\n\nYou need a WhisperGraph API key. Get one either:\n\n- **Programmatically** (recommended for agents) - see [Agent quickstart](#agent-quickstart) below.\n- **Via the dashboard** (recommended for humans) - [console.whisper.security/sign-up](https://console.whisper.security/sign-up).\n\n### Hosted remote server (no install)\n\nWhisper runs a hosted MCP server at `https://mcp.whisper.security`. Point any MCP client that supports remote servers at it and authenticate with your API key:\n\n```json\n{\n \"mcpServers\": {\n \"whisper\": {\n \"url\": \"https://mcp.whisper.security\",\n \"headers\": { \"Authorization\": \"Bearer \" }\n }\n }\n}\n```\n\n### MCP clients (stdio)\n\nFor local stdio transport, add this to your MCP client config:\n\n```json\n{\n \"mcpServers\": {\n \"whisper-graph\": {\n \"command\": \"npx\",\n \"args\": [\"-y\", \"@whisper-security/whisper-graph-mcp\"],\n \"env\": { \"WHISPER_API_KEY\": \"your-api-key\" }\n }\n }\n}\n```\n\nSelf-hosting this repo is for teams who want to run the MCP layer in their own environment. See [How to set up](https://www.whisper.security/docs/mcp/setup).\n\n## Agent quickstart\n\nGet a working API key in two HTTP calls - no browser, no CAPTCHA, no waiting list.\n\n**Step 1** - start signup (Whisper emails a verification code):\n\n```http\nPOST https://console.whisper.security/api/signup\nContent-Type: application/json\n\n{\"email\":\"your-agent@example.com\",\"attribution\":{\"agent_name\":\"your-agent\",\"source\":\"\"}}\n```\n\n**Step 2** - verify with the emailed code:\n\n```http\nPOST https://console.whisper.security/api/signup/verify\nContent-Type: application/json\n\n{\"signup_id\":\"...\",\"code\":\"...\"}\n```\n\nThe response contains `api_key`, `mcp_url`, `dashboard_url`, and `docs_url`. Use `api_key` in the MCP config snippet above. Full docs: [whisper.security/docs/agent-signup](https://www.whisper.security/docs/agent-signup).\n\n## Tools\n\nAll eight tools are read-only.\n\n| Tool | What it does |\n| ------------------- | --------------------------------------------------------------------------------------------------------------- |\n| `query` | Execute a Cypher query against WhisperGraph. Validated against a safety rule set before it reaches the backend. |\n| `list_labels` | List every node label with counts. Call it before writing a query when you're unsure which label to anchor on. |\n| `describe_label` | Confirm a label exists and enumerate its property keys. |\n| `explain_indicator` | Threat assessment for an IP, hostname, CIDR, or ASN - score, level, factors, sources. |\n| `whisper_history` | Historical WHOIS or BGP data for an indicator. |\n| `domain_variants` | Typosquatting / brand-protection variants of a domain, checked against the graph. |\n| `list_recipes` | List the full whisper.security catalog of ready-made recipes (see below). |\n| `run_recipe` | Run any catalog recipe by slug - a keyless direct procedure or a keyed multi-step flow. |\n\n### Catalog recipes\n\n`list_recipes` + `run_recipe` expose the entire [whisper.security catalog](https://github.com/whisper-sec/whisper-catalog) - 29 curated recipes, no hand-written Cypher required. The vendored catalog (`src/catalog/recipes.json`) is generated from the canonical source with `npm run sync:catalog`, so it tracks the platform.\n\nTwo kinds:\n\n- **Direct recipes (keyless).** A single graph procedure that runs without a key (rate-limited): `assess` (threat posture), `identify` (vendor/operator), `explain`, `variants`, `origins` (CDN de-cloak), `history` / `history-whois`, `walk`, `psl-tldplusone`, `psl-affiliation`, `asset`, `lookup-tor-relay`, `db-schema`.\n- **Flow recipes (keyed).** Curated multi-step investigations that need an API key: `attack-path`, `attack-surface`, `indicator-enrichment`, `infrastructure-mapping`, `subdomain-takeover`, `bgp-hijack-exposure`, `blast-radius`, `route-health`, `typosquat`, `nameserver-hijack-dns-consistency`, `map-supply-chain-concentration`, `discover-ai-agent-infrastructure`, `build-takedown-evidence-package`, `indicator`, `anycast-dns-root-sovereignty`.\n\n```jsonc\n// keyless direct recipe\n{ \"name\": \"run_recipe\", \"arguments\": { \"recipe\": \"assess\", \"inputs\": { \"v\": \"185.220.101.33\" } } }\n\n// keyed multi-step flow (needs WHISPER_API_KEY / X-API-Key)\n{ \"name\": \"run_recipe\", \"arguments\": { \"recipe\": \"indicator-enrichment\", \"inputs\": { \"value\": \"github.com\" } } }\n```\n\nEach recipe carries a `docsUrl` (visible in `list_recipes`) linking to its page under [whisper.security/docs](https://www.whisper.security/docs).\n\n### Resources\n\nSix MCP resources: the full schema, the relationship map, a Cypher function reference, a query cookbook, plus live `whisper://stats` and `whisper://quota`.\n\n### Prompts\n\nEight investigation-workflow prompt templates: `investigate-ip`, `map-attack-surface`, `compare-domains`, `blast-radius`, `threat-triage`, `whois-pivot`, `bgp-investigation`, `typosquat-sweep`.\n\n## Self-hosting (Docker / HTTP)\n\nFor remote or team deployments, run the server over Streamable HTTP:\n\n```bash\ndocker run -p 8080:8080 -e MCP_TRANSPORT=http \\\n ghcr.io/whisper-sec/whisper-graph-mcp:latest\n```\n\nOr with Docker Compose:\n\n```bash\ndocker compose up\n```\n\nIn HTTP mode the server **does not authenticate inbound requests** - it relays the\ncaller's `X-API-Key` or `Authorization: Bearer` header to the hosted WhisperGraph\nAPI, falling back to the `WHISPER_API_KEY` environment variable when no header is\npresent. Put it behind your own gateway if you need access control.\n\n## Configuration\n\nAll configuration is via environment variables.\n\n| Variable | Default | Description |\n| -------------------------- | -------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `WHISPER_API_KEY` | _(none)_ | Your WhisperGraph API key. Get one [programmatically in 2 HTTP calls](https://www.whisper.security/docs/agent-signup) or via the [dashboard](https://console.whisper.security/sign-up). |\n| `MCP_TRANSPORT` | `stdio` | `stdio` for local CLI use, `http` for remote/Docker. |\n| `HTTP_HOST` | `0.0.0.0` | Bind host for the HTTP transport. |\n| `HTTP_PORT` | `8080` | Bind port for the HTTP transport. |\n| `WHISPER_ALLOWED_HOSTS` | _(none)_ | Comma-separated `Host` header allowlist for DNS-rebinding protection in HTTP mode. Leave empty only behind a trusted gateway. |\n| `WHISPER_DB_URL` | `https://graph.whisper.security` | Base URL of the hosted WhisperGraph API. |\n| `WHISPER_QUERY_TIMEOUT_MS` | `60000` | Hard per-query deadline forwarded to the API. |\n| `WHISPER_DB_TIMEOUT_MS` | `10000` | HTTP timeout for non-query calls. |\n| `LOG_LEVEL` | `info` | `debug`, `info`, `warn`, or `error`. |\n\n## Development\n\n```bash\nnpm install\nnpm run dev # run from source over stdio\nnpm test # unit + integration tests (no secrets needed)\nnpm run build # bundle to dist/\nnpm run lint # eslint\nnpm run typecheck # tsc --noEmit\n```\n\n## Contributing\n\nContributions are welcome. See [CONTRIBUTING.md](./CONTRIBUTING.md) and our\n[Code of Conduct](./CODE_OF_CONDUCT.md). Security issues: see [SECURITY.md](./SECURITY.md).\n\n## License\n\n[Apache-2.0](./LICENSE). \"Whisper\", the Whisper logo, and \"WhisperGraph\" are\ntrademarks of Whisper Security - see [NOTICE](./NOTICE).\n",
"bytes": 11729,
"sha": "2e31e661c062aeb8e15032b261a7d27f30b391240b26fd12dd54e7c08f13e271",
"repo_slug": "whisper-sec/whisper-graph-mcp",
"fonte": "repo",
"truncated": false,
"api": "https://agentalog.com/api/listings/mcp_io_github_whisper_sec_whisper_graph_dba7c884/readme"
}
![\"WhisperGraph\"](\"./assets/whisper-logo.svg\"){kind=logo}
\n![\"npm](\"https://img.shields.io/npm/v/@whisper-security/whisper-graph-mcp.svg\")
\n ![\"License:](\"https://img.shields.io/badge/license-Apache--2.0-blue.svg\"){kind=icon}
\n ![\"Node](\"https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg\"){kind=icon}
= 20\" />\n