Skip to content
Agentmart
Submit a tool

WhisperGraph

The internet's infrastructure graph for AI agents - 46B nodes and edges, free trial via 2 HTTP calls

Connector by whisper-sec · GitHub account verified by the MCP Registry

IndexedApache-2.0Local (stdio)Remote (HTTP)★ 1
Write a review

Install

Works with Claude Code, VS Code, Codex, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/whisper-sec-whisper-graph

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Remote endpoint

  • https://mcp.whisper.security Remote (HTTP)

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

The internet's infrastructure graph for AI agents - 46B nodes and edges, free trial via 2 HTTP calls

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools
8 read · 0 write · 0 deleteRead-only
Secrets
1 (API keys, tokens or passwords)
Install scripts
Not scanned yet
Runs as
Node.js package

Tools by what they do 8

Read from the source code; the running server may list different tools.

Read 8 · Look things up without changing anything.

  • describe_label
  • domain_variants
  • explain_indicator
  • list_labels
  • list_recipes
  • query
  • run_recipe
  • whisper_history

Secrets and settings it asks for

Secrets: values you paste in that let it act as you.

  • WHISPER_API_KEY

Network hosts it talks to 1

  • mcp.whisper.security · found in remote endpoint, install command

Tools (8)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • describe_labelDescribe WhisperGraph Labelread-only

    Describe a single label: confirm it exists, get its node count, and enumerate the property keys observed on that label. Use this BEFORE writing a query that filters on a specific property. If you write WHERE h.fqdn = "..." but describe_label("HOSTNAME") returns properties = ["name", "threatScore", ...], your query will silently scan the entire label. Verify first. Argument: label (string, required) - uppercase letters, digits, and underscores only. Returns: {name, exists, count, properties[], edgesDoc}. Cached 5 minutes. Tip: edge types are NOT in the response - see the whisper://schema/re…

  • domain_variantsTyposquat / Brand-Protection Variantsread-only

    Generate typosquatting / brand-protection variants of a domain or brand name and check which ones actually exist in WhisperGraph. Runs 14 mutation algorithms - character omission, repetition, transposition, QWERTY-adjacent replacement/insertion, vowel-swap, bitsquatting, homoglyph / Unicode confusables, hyphenation, dot insertion/omission, TLD-swap, TLD-addition, and subdomain-add. Unicode input is accepted (and expected) so IDN homoglyph lookalikes resolve correctly. Returns { rows: [...] }. Each row: { variant, method, exists, nodeId, label, confidence (0.3-0.9), confidenceLabel (low/mediu…

  • explain_indicatorThreat Assessment for an Indicatorread-only

    Run a comprehensive threat assessment on a single indicator. The indicator can be an IPv4, IPv6, hostname, CIDR network, or ASN - the procedure auto-detects the type. Returns a single structured row: { indicator, type, available, cached, found, score, level (NONE/INFO/LOW/MEDIUM/HIGH/CRITICAL), explanation, factors[], sources[] }. For ASN inputs the row also includes a `breakdown` object with composite sub-scores (threatDensityScore, graphMetricsScore, historicalScore, prefixAgeScore). For CIDR inputs the explanation field carries threat-density stats (listed IPs, density %). Prefer this too…

  • list_labelsList WhisperGraph Labelsread-only

    List all node labels in WhisperGraph with their counts. Use this BEFORE writing a query when you're not sure which label to anchor on. It rules out hallucinated labels (e.g. there is no DOMAIN or FQDN - only HOSTNAME) and tells you which labels are large (HOSTNAME, IPV4) vs small (RIR, COUNTRY). Returns: an array of {label, count} rows. Cached server-side for 5 minutes. Tip: pair with describe_label to verify which properties exist on a label before referencing them in WHERE clauses.

  • list_recipesList WhisperGraph Catalog Recipesread-only

    List the whisper.security catalog of ready-made recipes - the full set exposed by this server. Two kinds: - `direct` recipes (keyless) are a single graph procedure: whisper.assess (threat posture), whisper.identify (vendor/operator), whisper.explain, whisper.variants (typosquats), whisper.origins (CDN de-cloak), whisper.history / whisper.history.whois (WHOIS timeline), whisper.walk, whisper.psl.*, whisper.asSet, whisper.lookupTorRelay, db.schema. These run WITHOUT an API key (rate-limited). - `flow` recipes (keyed) are curated multi-step investigations: attack-path, attack-surface, indicator-…

  • queryWhisperGraph Cypher Queryread-only

    Execute a Cypher query against WhisperGraph - the internet's largest infrastructure graph database (7.39B nodes, 39B edges, 5.6M threat intel edges). Returns JSON with columns, rows, and statistics. Use this tool for any question involving domains, hostnames, IPs, DNS, BGP, GeoIP, web links, email infrastructure, WHOIS, DNSSEC, or threat intelligence. NODE LABELS (20): HOSTNAME (2.6B), IPV4 (619M), IPV6 (820K), PREFIX (2.5M), ASN (116K), ASN_NAME (108K), ORGANIZATION (119M), CITY (54K), TLD (1.7K), COUNTRY (424), RIR (5), DNSSEC_ALGORITHM (8), TLD_OPERATOR (737), REGISTRAR (51K), EMAIL (237M…

  • run_recipeRun a WhisperGraph Catalog Reciperead-only

    Run a named whisper.security catalog recipe by its slug (see list_recipes for the full set). This is the highest-leverage tool for infrastructure & threat questions: instead of hand-writing Cypher, run the curated recipe. Arguments: - recipe (string, required) - the recipe slug, e.g. "assess", "identify", "indicator-enrichment", "infrastructure-mapping", "attack-path", "subdomain-takeover", "typosquat", "bgp-hijack-exposure". - inputs (object, optional) - the recipe's inputs keyed by name (see the recipe's inputs[] in list_recipes). Examples: {"v":"8.8.8.8"} for assess/identify; {"value":…

  • whisper_historyHistorical WHOIS / BGP for an Indicatorread-only

    Retrieve historical WHOIS or BGP data for a single indicator. The indicator can be an IPv4, IPv6, hostname, CIDR, or ASN - the procedure auto-detects the type. Returns shape varies by indicator type: - IP / prefix (type=routing): { origin, prefix, startTime, endTime, peersSeing } - Domain (type=domain): WHOIS snapshots - { queryTime, createDate, updateDate, expiryDate, registrar, nameServers } - ASN (type=asn): prefix announcement history (slow, ~9s for large ASNs) On upstream failure (the data source is rate-limiting or temporarily down), the row shape is: { available: false, error: "…

Signals

Stars
1
Forks
2
Open issues
8
Last commit
Jul 19, 2026 (3 months ago)
Last release
Jul 19, 2026 (3 months ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name
io.github.whisper-sec/whisper-graph
Version
0.2.0
Auth
Auth not stated, API key
Packages
npm @whisper-security/whisper-graph-mcp
License
Apache-2.0
Repository
github.com/whisper-sec/whisper-graph-mcp
Website
www.whisper.security/docs/ai/mcp/setup
First seen
Oct 24, 2026
Last checked
Oct 24, 2026
Source
Official MCP Registrygithub-graphql

More from whisper-sec

Cite this page

WhisperGraph MCP server. Agent Mart. https://agentmart.dev/connectors/whisper-sec-whisper-graph (last updated 2026-10-24)