WhisperGraph

Whisper Security ships two MCP surfaces over one graph. (1) A hosted remote server at https://mcp.whisper.security (Streamable HTTP, protocol revisions negotiated up to 2025-11-25) that advertises seven read-only tools, four resources and ten prompts; it is listed in the Claude Connectors Directory as "WhisperGraph" and in the official MCP registry as io.github.whisper-sec/whisper-graph. It is an RFC 9728 protected resource — an anonymous tools/list returns HTTP 401 with WWW-Authenticate: Bearer scope="mcp:read", resource_metadata="https://mcp.whisper.security/.well-known/oauth-protected-resource" — with OAuth (RFC 7591 dynamic client registration, PKCE S256, Client ID Metadata Documents) or a static API key as Authorization: Bearer / X-API-Key. There is no anonymous mode. (2) A local stdio server, `whisper mcp`, built into the MIT-licensed whisper CLI binary (MCP registry entry io.github.whisper-sec/whisper, OCI package ghcr.io/whisper-sec/whisper), which adds the identity plane: two keyless tools (whisper_verify, whisper_rdap) plus six key-gated control-plane tools, the same graph tools as the hosted connector, text2cypher, and one whisper_ tool per catalog recipe (45 tools with a key as of the docs). A third, older open-source stdio server (npm @whisper-security/whisper-graph-mcp 0.2.0, Apache-2.0) is still published. The hosted tool list below is taken verbatim from the provider's own /.well-known/mcp-manifest.json (saved as mcp/whisper-online-mcp-manifest.json); input schemas require an authenticated tools/list and are described from the reference docs, not fetched.

Open endpoint → Whisper Security provider profile

One-click install for Cursor, VS Code, Claude, and 20+ other MCP clients, powered by API Commons MCP Install — visit install.apicommons.org for more information.

Provider: Whisper Security Type: Hosted endpoint Transport: streamable-http Host: mcp.whisper.security

Endpoint

https://mcp.whisper.security

Hosted endpoint · transport streamable-http

Connect

This is a remote MCP server — point an MCP client at the endpoint URL. Clients with native remote support (Claude, Cursor, VS Code, …):

# mcp client config (e.g. .mcp.json / mcp settings) { "mcpServers": { "whisper-online": { "url": "https://mcp.whisper.security" } } }

For stdio-only clients (older Claude Desktop, etc.), bridge with mcp-remote:

# Add to claude_desktop_config.json { "mcpServers": { "whisper-online": { "command": "npx", "args": ["-y", "mcp-remote", "https://mcp.whisper.security"] } } }

If the server requires authentication, add the provider's token/header (e.g. an X-API-Key) per its docs. A quick reachability check:

curl -i -X POST https://mcp.whisper.security \ -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Tools

query — Run an arbitrary read-only Cypher query; write and admin clauses and mutating CALL procedures are refused before execution. Returns columns, rows, statistics plus an evidence block and references on every call.
explain_indicator — Coverage-qualified threat verdict for IPv4, IPv6, hostname, CIDR or ASN; every row carries level and coverage, unscored rows read level UNSCORED / score null.
explain_schema — Label catalogue (41 labels, 52 edge types) or one label's properties, edges and a sample traversal.
read_docs — Lists, searches or fetches the published documentation at call time.
list_workflows — The shared investigation gallery with each item's full parameter space (inputs[] with passAs, params[] with kind/options/min/max/default).
run_workflow — Runs one or more gallery workflows inside a wall-clock budget; returns steps[], evidence[] with the Cypher per step, coverage{}, and a budgeted markdown report under the default mcp profile.
identify — Vendor and role attribution for a batch of hosts (DIRECT > DERIVED 0.70-0.89 > HEURISTIC 0.4 > UNKNOWN), deliberately not a threat verdict.
whisper_verify — Full trust chain (reverse DNS + DANE-EE TLSA + DNSSEC + JWS) for an address or FQDN, returning a verdict JSON. Same check as GET https://rdap.whisper.online/verify-identity/.
whisper_rdap — RDAP (RFC 9083) registration record for a /128 — operator, tenant, issued-since.
whisper_register — Create an agent: name in, routable /128 + DNS name out (CALL whisper.agents({op:'register'})).
whisper_list — List the tenant's agents, DNS records, or identities.
whisper_policy — Read or set the tenant's resolver policy (block/allow/default).
whisper_logs — Query an agent's DNS/connection/allocation history.
whisper_revoke — Irreversibly withdraw an agent's /128, reverse DNS and keys.
whisper_egress_config — Return the proxy env + whisper connect/run command to source a workload from an agent's /128.
text2cypher — Translate an English question into Cypher.
whisper_ — One tool per catalog recipe (e.g. whisper_typosquat, whisper_bgpHijackExposure, whisper_subdomainTakeover, whisper_identify); read the live tools/list rather than a hardcoded count.

About MCP

The Model Context Protocol (MCP) is an open protocol Anthropic introduced for connecting LLM-based agents to external tools and data sources. Providers publish MCP servers that expose their API surface as structured, discoverable tools — an MCP-compatible client (Claude Desktop, Cursor, Cline, Continue, etc.) can connect to the server and call its tools without any per-provider integration code.

Browse every MCP server on the APIs.io network or compare with the broader Agent Skill surfaces of the same providers.

Work with this as data

Every MCP server here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for mcp servers

4 MCP tools reach this

find_mcpBrowse and filter every MCP server in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This MCP server

curl "https://apis.io/api/v1/mcp/whisper-graph"

All mcp servers

curl "https://apis.io/api/v1/mcp?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.