Security & Testing

whisper.online

MCP server for Whisper agent registration and verification, RDAP registration lookups, and identifying and assessing risk/policy posture of domain, IP, or hash indicators against a threat graph.

1 endpoint17 known toolsFirst detected July 25, 2026Last detected September 6, 2026

ENDPOINT 1

https://whisper.online/mcp

No auth detected

MCP server metadata

Name: whisper
Version: 0.219.2

Capabilities

tools

Server instructions

Whisper gives an AI agent a routable IPv6 address of its own on AS219419, with reverse DNS, a public RDAP record and a DANE certificate in DNSSEC-signed DNS, plus egress that sources from that address and a resolver whose policy you set. It also answers security questions about any domain, address, ASN or file hash from a graph of internet infrastructure. The tools whose names you can see without a key really work without one. For the rest, run whisper_signup with your email address: a key arrives with no account and no human in the loop, and then pass it as the X-API-Key header.

Known tools 17

whisper_signup

Start or complete Whisper signup from an email address alone, and receive an API key that unlocks the provisioning and governance skills on this card.

Potential side effects

whisper_verify

Is this IPv6 address or hostname a real Whisper agent, and whose?

Inferred read-only

whisper_rdap

The public registration record for any address in Whisper's space, in RFC 9083 form: the handle, the agent's label, its country, and the entities behind it.

Inferred read-only

whisper_identify

Identify an indicator (domain, IP, hash, …) against the graph.

Inferred read-only

whisper_assess

Assess the risk/policy posture of one or more indicators.

Inferred read-only

whisper_walk

Walk the graph from an indicator across its relationships.

Inferred read-only

whisper_watch

Watch an indicator for change/activity over time.

Inferred read-only

whisper_explain

Explain a verdict - the evidence and reasoning behind it.

Inferred read-only

whisper_variants

Enumerate variants/permutations of an indicator.

Inferred read-only

whisper_origins

Trace the origins/provenance of an indicator.

Inferred read-only

whisper_history

Historical records for an indicator (incl.

Inferred read-only

whisper_lookupTlsFingerprint

Look up a TLS (JA3/JA4) fingerprint in the graph.

Inferred read-only

whisper_lookupTorRelay

Look up Tor relay metadata for an address.

Inferred read-only

whisper_asset

Resolve an asset and its catalog of attributes.

Inferred read-only

whisper_threatintel

Threat-intelligence indicator family (candidate apex/CDN/hosting).

Inferred read-only

whisper_psl

Public-suffix-list family (tld-plus-one, is-public-suffix, affiliation).

Inferred read-only

whisper_topAsnsByPrefixCount

Top ASNs ranked by announced-prefix count.

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.whisper]
url = "https://whisper.online/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "whisper": {
      "type": "http",
      "url": "https://whisper.online/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: whisper
Remote MCP URL: https://whisper.online/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "whisper": {
      "url": "https://whisper.online/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "whisper": {
      "type": "http",
      "url": "https://whisper.online/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "whisper",
  "transport": "streamable-http",
  "url": "https://whisper.online/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Loading Trust v2 evidence…

Checking the associated registrable domain. The BuiltWith key remains server-side.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.