How do I install WhisperGraph?

Copy the http config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does WhisperGraph need an API key?

The publisher lists these environment variables: WHISPER_API_KEY.

What transport does WhisperGraph use?

WhisperGraph is reached over HTTP.

When was WhisperGraph last checked?

Last checked 2026-10-28. The internet's infrastructure graph for AI agents - 46B nodes and edges, free trial via 2 HTTP calls

WhisperGraph MCP server

Power your agent

Add this server

The publisher's own URL. Not a PlugMCP endpoint.

Add to Cursor Add in Claude Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Server URL

https://mcp.whisper.security

Credentials from the publisher

WHISPER_API_KEY — WhisperGraph API key. Get a free one at https://console.whisper.security/sign-up

The Claude button above opens Claude with the name and URL filled in. You still confirm it there.

shClaude Code

1claude mcp add --transport http io.github.whisper-sec-whisper-graph https://mcp.whisper.security

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.whisper-sec-whisper-graph": {4      "command": "npx",5      "args": [6        "-y",7        "mcp-remote",8        "https://mcp.whisper.security"9      ]10    }11  }12}

claude_desktop_config.json

Remote · HTTPPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Remote

Transport: http
Version: 0.2.0

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

WhisperGraph is an MCP server backed by the world's largest internet-infrastructure graph database - 46 billion nodes and edges across 20 entity types, mapping every domain, IP, ASN, prefix, organization, Web link and threat-intelligence listing into a single Cypher-queryable graph. Used by security teams, incident responders, and AI agents for investigation, attribution, brand protection, and infrastructure forensics.

Built for agents from day one.

Programmatic signup in 2 HTTP calls. No browser, no CAPTCHA, no human-in-the-loop. Email verification only. Working API key in ~5 seconds.
Free trial for everyone, including agents. Paid tiers for higher quotas.

What you can ask:

DNS: resolution, nameservers, MX, SPF chains, DNSSEC
Routing: ASN ownership, BGP origin history, MOAS conflicts, peering
Hosting & ownership: registrar, WHOIS contacts, organization mapping
Threat intel: ~40 feeds across 18 categories, CALL explain() for full threat scoring
Historical: WHOIS history, BGP route changes
Web: 10.9B hyperlinks for inter-domain analysis

Learn more: Agent signup · WhisperGraph intro · Cypher API reference · Query guide · Cypher syntax · Functions · Best practices · MCP setup

Quick start

You need a WhisperGraph API key. Get one either:

Programmatically (recommended for agents) - see Agent quickstart below.
Via the dashboard (recommended for humans) - console.whisper.security/sign-up.

Hosted remote server (no install)

Whisper runs a hosted MCP server at https://mcp.whisper.security. Point any MCP client that supports remote servers at it and authenticate with your API key:

{
  "mcpServers": {
    "whisper": {
      "url": "https://mcp.whisper.security",
      "headers": { "Authorization": "Bearer <your_api_key>" }
    }
  }
}

MCP clients (stdio)

For local stdio transport, add this to your MCP client config:

{
  "mcpServers": {
    "whisper-graph": {
      "command": "npx",
      "args": ["-y", "@whisper-security/whisper-graph-mcp"],
      "env": { "WHISPER_API_KEY": "your-api-key" }
    }
  }
}

Self-hosting this repo is for teams who want to run the MCP layer in their own environment. See How to set up.

Agent quickstart

Get a working API key in two HTTP calls - no browser, no CAPTCHA, no waiting list.

Step 1 - start signup (Whisper emails a verification code):

POST https://console.whisper.security/api/signup
Content-Type: application/json

{"email":"[email protected]","attribution":{"agent_name":"your-agent","source":"<registry-name>"}}

Step 2 - verify with the emailed code:

POST https://console.whisper.security/api/signup/verify
Content-Type: application/json

{"signup_id":"...","code":"..."}

The response contains api_key, mcp_url, dashboard_url, and docs_url. Use api_key in the MCP config snippet above. Full docs: whisper.security/docs/agent-signup.

Tools

All eight tools are read-only.

Tool	What it does
`query`	Execute a Cypher query against WhisperGraph. Validated against a safety rule set before it reaches the backend.
`list_labels`	List every node label with counts. Call it before writing a query when you're unsure which label to anchor on.
`describe_label`	Confirm a label exists and enumerate its property keys.
`explain_indicator`	Threat assessment for an IP, hostname, CIDR, or ASN - score, level, factors, sources.
`whisper_history`	Historical WHOIS or BGP data for an indicator.
`domain_variants`	Typosquatting / brand-protection variants of a domain, checked against the graph.
`list_recipes`	List the full whisper.security catalog of ready-made recipes (see below).
`run_recipe`	Run any catalog recipe by slug - a keyless direct procedure or a keyed multi-step flow.

Catalog recipes

list_recipes + run_recipe expose the entire whisper.security catalog - 29 curated recipes, no hand-written Cypher required. The vendored catalog (src/catalog/recipes.json) is generated from the canonical source with npm run sync:catalog, so it tracks the platform.

Two kinds:

Direct recipes (keyless). A single graph procedure that runs without a key (rate-limited): assess (threat posture), identify (vendor/operator), explain, variants, origins (CDN de-cloak), history / history-whois, walk, psl-tldplusone, psl-affiliation, asset, lookup-tor-relay, db-schema.
Flow recipes (keyed). Curated multi-step investigations that need an API key: attack-path, attack-surface, indicator-enrichment, infrastructure-mapping, subdomain-takeover, bgp-hijack-exposure, blast-radius, route-health, typosquat, nameserver-hijack-dns-consistency, map-supply-chain-concentration, discover-ai-agent-infrastructure, build-takedown-evidence-package, indicator, anycast-dns-root-sovereignty.

// keyless direct recipe
{ "name": "run_recipe", "arguments": { "recipe": "assess", "inputs": { "v": "185.220.101.33" } } }

// keyed multi-step flow (needs WHISPER_API_KEY / X-API-Key)
{ "name": "run_recipe", "arguments": { "recipe": "indicator-enrichment", "inputs": { "value": "github.com" } } }

Each recipe carries a docsUrl (visible in list_recipes) linking to its page under whisper.security/docs.

Resources

Six MCP resources: the full schema, the relationship map, a Cypher function reference, a query cookbook, plus live whisper://stats and whisper://quota.

Prompts

Eight investigation-workflow prompt templates: investigate-ip, map-attack-surface, compare-domains, blast-radius, threat-triage, whois-pivot, bgp-investigation, typosquat-sweep.

Self-hosting (Docker / HTTP)

For remote or team deployments, run the server over Streamable HTTP:

docker run -p 8080:8080 -e MCP_TRANSPORT=http \
  ghcr.io/whisper-sec/whisper-graph-mcp:latest

Or with Docker Compose:

docker compose up

In HTTP mode the server does not authenticate inbound requests - it relays the caller's X-API-Key or Authorization: Bearer header to the hosted WhisperGraph API, falling back to the WHISPER_API_KEY environment variable when no header is present. Put it behind your own gateway if you need access control.

Configuration

All configuration is via environment variables.

Variable	Default	Description
`WHISPER_API_KEY`	(none)	Your WhisperGraph API key. Get one programmatically in 2 HTTP calls or via the dashboard.
`MCP_TRANSPORT`	`stdio`	`stdio` for local CLI use, `http` for remote/Docker.
`HTTP_HOST`	`0.0.0.0`	Bind host for the HTTP transport.
`HTTP_PORT`	`8080`	Bind port for the HTTP transport.
`WHISPER_ALLOWED_HOSTS`	(none)	Comma-separated `Host` header allowlist for DNS-rebinding protection in HTTP mode. Leave empty only behind a trusted gateway.
`WHISPER_DB_URL`	`https://graph.whisper.security`	Base URL of the hosted WhisperGraph API.
`WHISPER_QUERY_TIMEOUT_MS`	`60000`	Hard per-query deadline forwarded to the API.
`WHISPER_DB_TIMEOUT_MS`	`10000`	HTTP timeout for non-query calls.
`LOG_LEVEL`	`info`	`debug`, `info`, `warn`, or `error`.

Development

npm install
npm run dev       # run from source over stdio
npm test          # unit + integration tests (no secrets needed)
npm run build     # bundle to dist/
npm run lint      # eslint
npm run typecheck # tsc --noEmit

Contributing

Contributions are welcome. See CONTRIBUTING.md and our Code of Conduct. Security issues: see SECURITY.md.

License

Apache-2.0. "Whisper", the Whisper logo, and "WhisperGraph" are trademarks of Whisper Security - see NOTICE.

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install WhisperGraph?

Does WhisperGraph need an API key?

What transport does WhisperGraph use?

When was WhisperGraph last checked?

Documentation

Quick start

Hosted remote server (no install)

MCP clients (stdio)

Agent quickstart

Tools

Catalog recipes

Resources

Prompts

Self-hosting (Docker / HTTP)

Configuration

Development

Contributing

License