io.github.whisper-secPublished by GitHub account whisper-secv0.256.1Updated Nov 7, 2026
One routable IPv6 per AI agent, verifiable from the DNS root. Keyless tools need no signup.
Whisper answers security questions about domains, IPs, ASNs and hashes from an internet-infrastructure graph, and provisions verifiable IPv6 identities for AI…
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/io.github.whisper-sec%2Fwhisper/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"whisper": {
"type": "http",
"url": "https://whisper.online/mcp"
}
}
}Give your agent a real, routable Whisper IPv6 identity - one command.
whisper is the command-line client for Whisper: a single
static binary that gives an agent a real, routable IPv6 /128 on AS219419, wires
egress so the agent's traffic sources from that address, and verifies it end-to-end.
The address is the identity - DNSSEC-signed, DANE-pinned, and resolvable in public
RDAP. One binary, standard ports, no config to get
started.
It is two surfaces over one core: a fully scriptable Cobra
CLI, and a full-screen Bubble Tea TUI when
you run whisper on a terminal with no subcommand. And it talks to the
whisper.security graph: whisper query for raw Cypher,
whisper graph for the 29-recipe catalog (below).
No API key and no install. Put this in your client's config and seven tools appear, and every one
answers with no key. Add a key, by env var or by whisper login once on the machine, and the same
server lists 45:
Claude Desktop, Claude Code, Cursor, Windsurf, VS Code, Cline and Zed all take the same
three lines. Already installed the CLI? whisper mcp is the identical server.
The seven, measured against the server with no key anywhere on the machine:
whisper_verify - is this address or hostname a real agent, and whose? Checks the
DANE pin against DNSSEC-signed DNS, from the IANA root.whisper_rdap - the public registration record for any /128.whisper_assess - a verdict on a domain, IP, ASN or file hash, with its evidence.whisper_identify - what an indicator is: category, vendor, band.whisper_explain - the scored explanation behind a verdict, with its sources.read_docs - the whisper.security documentation, listed, searched or fetched page by page.list_workflows - the gallery of ready-made investigations, and what each one takes.Add a key and the same server lists 45: the graph in full, plus registering agents, setting resolver policy, handing out egress configuration, reading per-agent activity and revoking an identity.
Most clients take that URL and nothing else. Claude Code, for one:
claude mcp add --transport http whisper https://whisper.online/mcp.
Streamable HTTP. initialize and tools/list answer with no credential, so a client that takes
a bare URL needs nothing else. The HTTP transport is a different server from the stdio one above
and it lists a different set: 17 tools with no key, every one of which works with no key, and 41
once you send your key as the X-API-Key header (the stdio server's keyed set is the 45 above).
The keyless 17 are the identity checks and the graph: whisper_verify, whisper_rdap,
whisper_assess, whisper_identify, whisper_explain, whisper_walk, whisper_watch,
whisper_variants, whisper_origins, whisper_history, whisper_asset, whisper_psl,
whisper_threatintel, whisper_lookupTlsFingerprint, whisper_lookupTorRelay,
whisper_topAsnsByPrefixCount, and whisper_signup, which issues you an API key from an email
address alone. The 24 a key adds over HTTP are the provisioning and governance set, 23 of them
whisper_agents_* and the 24th whisper_submit, which writes a claim into the graph and so
needs to be attributable.
whisper_verify and whisper_rdap check somebody else's agent. whisper_agents_verify in the
keyed set verifies a domain you control, which is not the same thing.
Verifying somebody else's agent needs nothing at all, not even the client:
The one-liner fetches the signed binary straight from this repo's GitHub Releases,
verifies its SHA-256 (and its PGP signature when gpg is present), and puts it on your
PATH:
Windows (PowerShell):
Homebrew (macOS/Linux):
Scoop (Windows):
With Go:
With mise (GitHub-release backend, no plugin):
(asdf has no built-in GitHub-release backend, so on asdf use mise, or a community
ubi-style plugin.)
On Debian/Ubuntu (apt) - signed repo:
On Fedora/RHEL (dnf) - signed repo:
On Alpine (apk) - signed repo:
All three repos are served from our own infrastructure (AS219419) and signed with the
Whisper package key (get.whisper.online/whisper.gpg; the apk repo uses its own
whisper-apk.rsa.pub).
Or download the binary for your platform from the
Releases page, make it
executable, and put it on your PATH.
The installers (
scripts/install.sh,scripts/install.ps1) are published here so the whole install path is inspectable. They are the same scriptsget.whisper.onlineserves, differing only in where they download from by default: these fetchwhisper-<os>-<arch>(plus.sha256and.asc) from this repo's releases, the served copy fetches the same binaries fromcli.whisper.online/dl. Either way SHA-256 is a hard gate - a mismatch aborts the install - and the PGP check is an extra layer. PointWHISPER_CLI_BASEat any mirror to override the source.
Releases are signed with the AS219419 PGP key:
The public key is published at https://as219419.net/. To verify a binary you downloaded manually:
A good signature reports Good signature from the key with the fingerprint above.
Run whisper with no arguments for the guided flow. It signs you in (browser device
login or a pasted API key), helps you name and create an agent if you don't have one,
then connects and verifies:
Naming is mandatory - an agent's name is part of its identity, so the flow asks before it creates one. The same steps are scriptable:
whisper ip is exit-code-first: 0 when the observed egress address is inside
2a04:2a01::/32 and equals your selected agent's /128, 1 otherwise - so scripts
and agents can gate on it. Add --json to any command for the raw, scriptable envelope.
Per-project agent identity for Claude Code. whisper init claude makes a project
zero-config: run it once in a directory and Claude Code there - and every subagent it
spawns - egresses from that project's own /128, over SOCKS5 (default) or --tier wireguard. It pins the project's agent + tier in .whisper/config, wires a local proxy
into .claude/settings.local.json (merge-safe - it never clobbers your settings), and
keeps the connection up via a small auto-reconnecting daemon. Different projects, different
identities, nothing to remember. Pass --agent <name|/128> to reuse an existing agent or
--name <new> to mint one.
Other useful commands: whisper list, whisper logs, whisper policy, `whisper rdap
The same whisper.security graph the Whisper resolver
consults on every lookup - 6.9B nodes (hostnames, IPs, ASNs, certs, threat intel), 50.0B
relationships - is a first-class CLI surface. whisper query runs raw parameterised
Cypher; whisper graph runs a named recipe from the embedded catalog:
Direct recipes answer with one result table (--json emits the raw
{columns,rows,statistics} envelope); flow recipes stream their steps as NDJSON - pipe
them to jq. Every recipe documents itself: whisper graph <recipe> --help.
query and graph authenticate with your API key (whisper login, WHISPER_API_KEY,
or --key). The graph endpoint itself is two-tier: the direct read verbs
(whisper.identify, whisper.assess, whisper.variants, whisper.explain,
db.schema, ...) also answer keyless and rate-limited - no account needed:
A key lifts the rate limit and unlocks raw Cypher and the multi-step flows. The same
tools ride the MCP server (whisper mcp): whisper_graph_query plus one tool per
recipe. Docs: www.whisper.security/docs - the raw
Cypher API at /docs/cypher-api, per-verb
pages under /docs/whisper-graph.
Your agent's /128 carries a per-agent EC P-256 key, pinned in DNSSEC-signed DNS - so it can sign a document as itself and anyone can verify it with no account and no certificate authority. Trust is anchored by DANE, not a CA you have to install.
The per-agent verification key a stranger resolves is the agent's DANE TLSA 3 1 1 (and, for signatures, its SMIMEA 3 1 1) - both DNSSEC-signed and checkable with dig + openssl, no Whisper account. Full guide, including the byte-exact signature envelope: https://whisper.online/docs/sign-encrypt.
/128 out of 2a04:2a01::/32, announced by AS219419 - your
own internet address, not a shared NAT pool.ip6.arpa PTR) resolves to the agent; the assignment is
visible in public RDAP at rdap.whisper.online.whisper connect provisions a local proxy whose
traffic sources from your /128; whisper ip proves the source address is yours,
node-free and with no third party in the loop. --tier wireguard brings the /128 up
as a routed address over a userspace WireGuard tunnel (wireguard-go netstack - still
no root, no kernel wg, no TUN device), fronted by the same local proxy so tools need
no change.Same identity + egress from your language of choice - thin wrappers over this CLI:
Python - pip install whisper-id
Node - npm i whisper-id
The official image runs the CLI as an egress sidecar so any container leaves from your /128:
whisper init compose and whisper init k8s emit a ready-to-merge sidecar manifest.
Multi-arch (amd64/arm64), distroless, ~18 MB.
Requires Go 1.26.9+.
Cross-compile every supported platform into dist/ (binaries + .sha256, named exactly
as the release assets):
platforms.txt is the single source of truth for the target matrix - shared by
build-all.sh and the installers.
This repository is the Whisper client: identity, egress, connect, verify, the security-graph surface and the TUI. It is MIT, and what you build from it is that client.
The published binaries are not only that. whisper also carries Whisper's endpoint
sensor - the service, sensor and posture commands - and the sensor is not open
source today. It ships as a binary and its sources stay closed, so a binary from a release,
from curl -fsSL https://get.whisper.online | sh, or from apt, dnf, apk, brew or scoop has those
commands. Anything BUILT from this tree does not: go install, a local go build, and the
snap, which snapcraft builds from source.
Two consequences worth stating plainly. The MIT licence covers the source in this repository, not the additional closed component in the published binaries. And if you want the endpoint sensor, install a released binary rather than building from source.
linux-arm is 32-bit ARMv7. Every target is a static, CGO-free build, and every one is
signed with the AS219419 release key.
Issues and pull requests are welcome - see CONTRIBUTING.md. Run
go build ./..., go vet ./..., go test ./..., and gofmt -l . before opening a PR.
To report a security issue, see SECURITY.md.
MIT © 2026 viaGraph B.V. (Whisper Security) - for the source in this repository. The published binaries additionally contain the closed-source endpoint sensor; see Source here, binaries there.
The embedded Mozilla CA certificate list
(internal/client/cabundle/mozilla-cacert.pem) is distributed under the Mozilla Public
License 2.0.
Source: README.md at commit 28d7c00
Get a Whisper API key
Start or complete Whisper signup from an email address alone, and receive an API key that unlocks the provisioning and governance skills on this card. Send {"email":"..."} to start; a six-digit code arrives by email; send {"signup_id":"...","code":"123456"} to complete. No human step, no account needed first. Example call: {"skill":"signup","input":{"email":"[email protected]"}}
inputrequiredVerify a Whisper agent identity
Is this IPv6 address or hostname a real Whisper agent, and whose? Grades the full keyless trust chain: the reverse DNS record, the forward AAAA confirming it back to the same address, and the DANE-EE certificate pin published in DNSSEC-signed DNS. Returns is_whisper_agent with the evidence for the verdict either way, so a negative answer is an answer and not an error. Answers without an API key, and every leg of it is independently checkable from the DNS root with dig. Example call: {"skill":"verify","input":"2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478"}
inputrequiredLook up an address in RDAP
The public registration record for any address in Whisper's space, in RFC 9083 form: the handle, the agent's label, its country, and the entities behind it. The same document the RDAP service serves at /ip/{address}, which any RDAP client can already read. Answers without an API key. Example call: {"skill":"rdap","input":"2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478"}
inputrequiredidentify
Identify an indicator (domain, IP, hash, …) against the graph. Answers without an API key. Example call: {"skill":"identify","input":"example.com"}
inputrequiredassess
Assess the risk/policy posture of one or more indicators. Answers without an API key. Example call: {"skill":"assess","input":"example.com"}
inputrequiredwalk
Walk the graph from an indicator across its relationships. Answers without an API key. Example call: {"skill":"walk","input":"example.com"}
inputrequiredwatch
Watch an indicator for change/activity over time. Answers without an API key. Example call: {"skill":"watch","input":{"action":"list"}}
inputrequiredsubmit
Submit an observation/claim into the graph. Writes to the graph, so it needs your API key: an anonymous claim would not be attributable. Example call: {"skill":"submit","input":{"host":"example.com","claim":"benign"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputrequiredexplain
Explain a verdict - the evidence and reasoning behind it. Answers without an API key. Example call: {"skill":"explain","input":"example.com"}
inputrequiredvariants
Enumerate variants/permutations of an indicator. Answers without an API key. Example call: {"skill":"variants","input":"example.com"}
inputrequiredorigins
Trace the origins/provenance of an indicator. Answers without an API key. Example call: {"skill":"origins","input":"example.com"}
inputrequiredhistory
Historical records for an indicator (incl. whois/bgp history). Answers without an API key. Example call: {"skill":"history","input":"example.com"}
inputrequiredlookupTlsFingerprint
Look up a TLS (JA3/JA4) fingerprint in the graph. Answers without an API key. Example call: {"skill":"lookupTlsFingerprint","input":"ja3:771,4865-4866-4867"}
inputrequiredlookupTorRelay
Look up Tor relay metadata for an address. Answers without an API key. Example call: {"skill":"lookupTorRelay","input":"185.220.101.1"}
inputrequiredasset
Resolve an asset and its catalog of attributes. Answers without an API key. Example call: {"skill":"asset","input":"example.com"}
inputrequiredthreatintel
Threat-intelligence indicator family (candidate apex/CDN/hosting). A family verb: name the sub-verb as "sub" alongside the input. Sub-verbs: candidateCdnApex, candidateMultiTenantApex, candidateSharedHostingIp.. Answers without an API key. Example call: {"skill":"threatintel","sub":"candidateCdnApex","input":5}
subrequiredinputrequiredpsl
Public-suffix-list family (tld-plus-one, is-public-suffix, affiliation). A family verb: name the sub-verb as "sub" alongside the input. Sub-verbs: tldPlusOne, isPublicSuffix, affiliation.. Answers without an API key. Example call: {"skill":"psl","sub":"tldPlusOne","input":"a.b.example.co.uk"}
subrequiredinputrequiredtopAsnsByPrefixCount
Top ASNs ranked by announced-prefix count. Answers without an API key. Example call: {"skill":"topAsnsByPrefixCount","input":10}
inputrequiredagents: agent
The agent operation on the Whisper control plane, served as CALL whisper.agents({op:'agent', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Add include:'tombstones' to read an agent that is gone: its newest lifecycle row says whether it was revoked, released, erased or reaped, when, by whom and why. Example call: {"skill":"agents.agent","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputrequiredagents: alert
The alert operation on the Whisper control plane, served as CALL whisper.agents({op:'alert', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.alert","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: connect
The connect operation on the Whisper control plane, served as CALL whisper.agents({op:'connect', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.connect","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: detect
The detect operation on the Whisper control plane, served as CALL whisper.agents({op:'detect', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.detect","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: disconnect
The disconnect operation on the Whisper control plane, served as CALL whisper.agents({op:'disconnect', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.disconnect","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: domain
The domain operation on the Whisper control plane, served as CALL whisper.agents({op:'domain', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.domain","input":{"name":"example.com"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputrequiredagents: firewall
The firewall operation on the Whisper control plane, served as CALL whisper.agents({op:'firewall', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.firewall","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputrequiredagents: history
The history operation on the Whisper control plane, served as CALL whisper.agents({op:'history', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.history","input":{"address":"2a04:2a01:f6d7:1ffe:a0be:ba8a:c355:bba1"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputrequiredagents: host
The host operation on the Whisper control plane, served as CALL whisper.agents({op:'host', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.host","input":{"name":"my-host","type":"TXT","value":"hello"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputrequiredagents: identity
The identity operation on the Whisper control plane, served as CALL whisper.agents({op:'identity', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.identity","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: list
The list operation on the Whisper control plane, served as CALL whisper.agents({op:'list', args:{...}}). Requires your Whisper API key. Add include:'tombstones' to list the agents that are gone as well, paged, each with its lifecycle state (never 'active'), actor and reason. Example call: {"skill":"agents.list","input":{"kind":"agents"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputrequiredagents: logs
The logs operation on the Whisper control plane, served as CALL whisper.agents({op:'logs', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.logs","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: lookups
The lookups operation on the Whisper control plane, served as CALL whisper.agents({op:'lookups', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.lookups","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: partner
The partner operation on the Whisper control plane, served as CALL whisper.agents({op:'partner', args:{...}}). Requires your Whisper API key. It is gated on partner authority rather than on arguments: without it the call is refused whatever you pass. Example call: {"skill":"agents.partner","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: policy
The policy operation on the Whisper control plane, served as CALL whisper.agents({op:'policy', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.policy","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: register
The register operation on the Whisper control plane, served as CALL whisper.agents({op:'register', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.register","input":{"label":"my-first-agent"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputrequiredagents: rename
The rename operation on the Whisper control plane, served as CALL whisper.agents({op:'rename', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.rename","input":{"agent":"agent-a1f4c0b2d3e4f5a67","label":"renamed-agent"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputrequiredagents: resolver
The resolver operation on the Whisper control plane, served as CALL whisper.agents({op:'resolver', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.resolver","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: revoke
The revoke operation on the Whisper control plane, served as CALL whisper.agents({op:'revoke', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.revoke","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputrequiredagents: task
The task operation on the Whisper control plane, served as CALL whisper.agents({op:'task', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.task","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputrequiredagents: token
The token operation on the Whisper control plane, served as CALL whisper.agents({op:'token', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.token","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputrequiredagents: trace
The trace operation on the Whisper control plane, served as CALL whisper.agents({op:'trace', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.trace","input":{"dest":"203.0.113.7"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputrequiredagents: verify
The verify operation on the Whisper control plane, served as CALL whisper.agents({op:'verify', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.verify","input":{"name":"example.com"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputrequired100% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
{ "mcpServers": { "whisper": { "command": "npx", "args": ["-y", "@whisper-security/whisper-mcp"] } }}https://whisper.online/mcpcurl -s https://rdap.whisper.online/verify-identity/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478curl -fsSL https://get.whisper.online | shirm https://get.whisper.online/install.ps1 | iexbrew install whisper-sec/tap/whisperscoop bucket add whisper https://github.com/whisper-sec/scoop-bucketscoop install whispergo install github.com/whisper-sec/whisper-cli/cmd/whisper@latestmise use -g "github:whisper-sec/whisper-cli[exe=whisper]"curl -fsSL https://get.whisper.online/whisper.gpg | sudo tee /usr/share/keyrings/whisper.gpg >/dev/nullecho "deb [signed-by=/usr/share/keyrings/whisper.gpg] https://get.whisper.online/deb stable main" | sudo tee /etc/apt/sources.list.d/whisper.listsudo apt update && sudo apt install whispersudo tee /etc/yum.repos.d/whisper.repo >/dev/null <<'EOF'[whisper]name=Whisperbaseurl=https://get.whisper.online/rpmenabled=1gpgcheck=1gpgkey=https://get.whisper.online/whisper.gpgEOFsudo dnf install whisperwget -qO /etc/apk/keys/whisper-apk.rsa.pub https://get.whisper.online/apk/whisper-apk.rsa.pubecho "https://get.whisper.online/apk" | sudo tee -a /etc/apk/repositoriessudo apk add whisperFingerprint: EFF1663D992539682106A5EAD0F70908CF3B7929# 1. SHA-256 - compare against the asset's .sha256 (and the release checksums.txt)sha256sum -c whisper-linux-amd64.sha256
# 2. PGP - import the AS219419 key, then verify the detached signaturecurl -fsSL https://as219419.net/whisper-release.asc | gpg --importgpg --verify whisper-linux-amd64.asc whisper-linux-amd64$ whisperwhisper: signed in.whisper: name your agent: my-first-agentwhisper: created my-first-agent → 2a04:2a01:…::1whisper: connecting…2a04:2a01:…::1 ✓ egress verifiedConnected ✓whisper connect # bring up egress bound to your /128 (Tier-1.5 SOCKS5/HTTPS)whisper connect --tier wireguard # Tier-1: routed /128 over a userspace WireGuard tunnel (no root)whisper ip # print your egress IP and verify it IS your /128 (exit 0 = verified)whisper run -- curl ifconfig.co # run any command with your Whisper egress wired inwhisper claude # run Claude Code through your Whisper egress, one stepwhisper init claude # wire THIS project so Claude Code always egresses from its own /128whisper use my-agent # choose the agent the rest of `whisper` binds towhisper status # key state, selected agent, connection statewhisper query "CALL whisper.identify(['api.openai.com'])" # who operates this host?whisper query 'CALL whisper.assess([$v])' --param v=8.8.8.8 # threat posture, one row per hostwhisper graph list # all 29 recipes, each with its docs URLwhisper graph variants paypal.com # registered typosquat look-alikes, one tablewhisper graph typosquat paypal.com # the full brand-impersonation flow (streams NDJSON)curl -s https://graph.whisper.online/api/query \ -H 'content-type: application/json' \ -d '{"query":"CALL whisper.assess([\"8.8.8.8\"])"}'# Sign any file, PDF or email as your agent -> a detached S/MIME (.p7s):whisper sign file contract.pdf
# Verify with NO key: checks the CMS signature AND that the signer's key matches the# DNSSEC-validated SMIMEA (RFC 8162) pin for the signer - resolved from the IANA root, in-process:whisper sign verify contract.pdf --sig contract.pdf.p7s
# Encrypt a file so ONLY the named agent can read it (keyless), then decrypt as that agent (keyed):whisper encrypt --to [email protected] secret.txt # -> secret.txt.wencwhisper decrypt secret.txt.wencfrom whisper_id import register, egressagent = register("my-bot") # a routable /128with egress(): # this block leaves from your /128 requests.get("https://api64.ipify.org")import { register, withEgress } from "whisper-id";const agent = await register("my-bot");await withEgress(async () => { /* env-aware clients leave from your /128 */ });docker run --rm ghcr.io/whisper-sec/whisper:latest --versiongit clone https://github.com/whisper-sec/whisper-clicd whisper-cligo build -o whisper ./cmd/whisper./whisper --version./build-all.sh # → dist/whisper-<os>-<arch>[.exe] + .sha256./build-all.sh dist v1.0.0 # stamp a version into `whisper --version`