io.github.whisper-sec由 GitHub 账号 whisper-sec 发布v0.258.0更新于 Nov 8, 2026
One routable IPv6 per AI agent, verifiable from the DNS root. Keyless tools need no signup.
Whisper 基于互联网基础设施图谱回答域名、IP、ASN 与文件哈希的安全问题，并为 AI 代理分配可验证的 IPv6 身份。
Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。
把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。
阅读 https://sourceweft.com/mcp/io.github.whisper-sec%2Fwhisper/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。把它添加到你客户端的 mcpServers 配置中。
{
"mcpServers": {
"whisper": {
"type": "http",
"url": "https://whisper.online/mcp"
}
}
}Give your agent a real, routable Whisper IPv6 identity - one command.
whisper is the command-line client for Whisper: a single
static binary that gives an agent a real, routable IPv6 /128 on AS219419, wires
egress so the agent's traffic sources from that address, and verifies it end-to-end.
The address is the identity - DNSSEC-signed, DANE-pinned, and resolvable in public
RDAP. One binary, standard ports, no config to get
started.
It is two surfaces over one core: a fully scriptable Cobra
CLI, and a full-screen Bubble Tea TUI when
you run whisper on a terminal with no subcommand. And it talks to the
whisper.security graph: whisper query for raw Cypher,
whisper graph for the 29-recipe catalog (below).
No API key and no install. Put this in your client's config and seven tools appear, and every one
answers with no key. Add a key, by env var or by whisper login once on the machine, and the same
server lists 45:
Claude Desktop, Claude Code, Cursor, Windsurf, VS Code, Cline and Zed all take the same
three lines. Already installed the CLI? whisper mcp is the identical server.
The seven, measured against the server with no key anywhere on the machine:
whisper_verify - is this address or hostname a real agent, and whose? Checks the
DANE pin against DNSSEC-signed DNS, from the IANA root.whisper_rdap - the public registration record for any /128.whisper_assess - a verdict on a domain, IP, ASN or file hash, with its evidence.whisper_identify - what an indicator is: category, vendor, band.whisper_explain - the scored explanation behind a verdict, with its sources.read_docs - the whisper.security documentation, listed, searched or fetched page by page.list_workflows - the gallery of ready-made investigations, and what each one takes.Add a key and the same server lists 45: the graph in full, plus registering agents, setting resolver policy, handing out egress configuration, reading per-agent activity and revoking an identity.
Most clients take that URL and nothing else. Claude Code, for one:
claude mcp add --transport http whisper https://whisper.online/mcp.
Streamable HTTP. initialize and tools/list answer with no credential, so a client that takes
a bare URL needs nothing else. The HTTP transport is a different server from the stdio one above
and it lists a different set: 17 tools with no key, every one of which works with no key, and 41
once you send your key as the X-API-Key header (the stdio server's keyed set is the 45 above).
The keyless 17 are the identity checks and the graph: whisper_verify, whisper_rdap,
whisper_assess, whisper_identify, whisper_explain, whisper_walk, whisper_watch,
whisper_variants, whisper_origins, whisper_history, whisper_asset, whisper_psl,
whisper_threatintel, whisper_lookupTlsFingerprint, whisper_lookupTorRelay,
whisper_topAsnsByPrefixCount, and whisper_signup, which issues you an API key from an email
address alone. The 24 a key adds over HTTP are the provisioning and governance set, 23 of them
whisper_agents_* and the 24th whisper_submit, which writes a claim into the graph and so
needs to be attributable.
whisper_verify and whisper_rdap check somebody else's agent. whisper_agents_verify in the
keyed set verifies a domain you control, which is not the same thing.
Verifying somebody else's agent needs nothing at all, not even the client:
The one-liner fetches the signed binary straight from this repo's GitHub Releases,
verifies its SHA-256 (and its PGP signature when gpg is present), and puts it on your
PATH:
Windows (PowerShell):
Homebrew (macOS/Linux):
Scoop (Windows):
With Go:
With mise (GitHub-release backend, no plugin):
(asdf has no built-in GitHub-release backend, so on asdf use mise, or a community
ubi-style plugin.)
On Debian/Ubuntu (apt) - signed repo:
On Fedora/RHEL (dnf) - signed repo:
On Alpine (apk) - signed repo:
All three repos are served from our own infrastructure (AS219419) and signed with the
Whisper package key (get.whisper.online/whisper.gpg; the apk repo uses its own
whisper-apk.rsa.pub).
Or download the binary for your platform from the
Releases page, make it
executable, and put it on your PATH.
The installers (
scripts/install.sh,scripts/install.ps1) are published here so the whole install path is inspectable. They are the same scriptsget.whisper.onlineserves, differing only in where they download from by default: these fetchwhisper-<os>-<arch>(plus.sha256and.asc) from this repo's releases, the served copy fetches the same binaries fromcli.whisper.online/dl. Either way SHA-256 is a hard gate - a mismatch aborts the install - and the PGP check is an extra layer. PointWHISPER_CLI_BASEat any mirror to override the source.
Releases are signed with the AS219419 PGP key:
The public key is published at https://as219419.net/. To verify a binary you downloaded manually:
A good signature reports Good signature from the key with the fingerprint above.
Run whisper with no arguments for the guided flow. It signs you in (browser device
login or a pasted API key), helps you name and create an agent if you don't have one,
then connects and verifies:
Naming is mandatory - an agent's name is part of its identity, so the flow asks before it creates one. The same steps are scriptable:
whisper ip is exit-code-first: 0 when the observed egress address is inside
2a04:2a01::/32 and equals your selected agent's /128, 1 otherwise - so scripts
and agents can gate on it. Add --json to any command for the raw, scriptable envelope.
Per-project agent identity for Claude Code. whisper init claude makes a project
zero-config: run it once in a directory and Claude Code there - and every subagent it
spawns - egresses from that project's own /128, over SOCKS5 (default) or --tier wireguard. It pins the project's agent + tier in .whisper/config, wires a local proxy
into .claude/settings.local.json (merge-safe - it never clobbers your settings), and
keeps the connection up via a small auto-reconnecting daemon. Different projects, different
identities, nothing to remember. Pass --agent <name|/128> to reuse an existing agent or
--name <new> to mint one.
Other useful commands: whisper list, whisper logs, whisper policy, `whisper rdap
The same whisper.security graph the Whisper resolver
consults on every lookup - 6.9B nodes (hostnames, IPs, ASNs, certs, threat intel), 50.0B
relationships - is a first-class CLI surface. whisper query runs raw parameterised
Cypher; whisper graph runs a named recipe from the embedded catalog:
Direct recipes answer with one result table (--json emits the raw
{columns,rows,statistics} envelope); flow recipes stream their steps as NDJSON - pipe
them to jq. Every recipe documents itself: whisper graph <recipe> --help.
query and graph authenticate with your API key (whisper login, WHISPER_API_KEY,
or --key). The graph endpoint itself is two-tier: the direct read verbs
(whisper.identify, whisper.assess, whisper.variants, whisper.explain,
db.schema, ...) also answer keyless and rate-limited - no account needed:
A key lifts the rate limit and unlocks raw Cypher and the multi-step flows. The same
tools ride the MCP server (whisper mcp): whisper_graph_query plus one tool per
recipe. Docs: www.whisper.security/docs - the raw
Cypher API at /docs/cypher-api, per-verb
pages under /docs/whisper-graph.
Your agent's /128 carries a per-agent EC P-256 key, pinned in DNSSEC-signed DNS - so it can sign a document as itself and anyone can verify it with no account and no certificate authority. Trust is anchored by DANE, not a CA you have to install.
The per-agent verification key a stranger resolves is the agent's DANE TLSA 3 1 1 (and, for signatures, its SMIMEA 3 1 1) - both DNSSEC-signed and checkable with dig + openssl, no Whisper account. Full guide, including the byte-exact signature envelope: https://whisper.online/docs/sign-encrypt.
/128 out of 2a04:2a01::/32, announced by AS219419 - your
own internet address, not a shared NAT pool.ip6.arpa PTR) resolves to the agent; the assignment is
visible in public RDAP at rdap.whisper.online.whisper connect provisions a local proxy whose
traffic sources from your /128; whisper ip proves the source address is yours,
node-free and with no third party in the loop. --tier wireguard brings the /128 up
as a routed address over a userspace WireGuard tunnel (wireguard-go netstack - still
no root, no kernel wg, no TUN device), fronted by the same local proxy so tools need
no change.Same identity + egress from your language of choice - thin wrappers over this CLI:
Python - pip install whisper-id
Node - npm i whisper-id
The official image runs the CLI as an egress sidecar so any container leaves from your /128:
whisper init compose and whisper init k8s emit a ready-to-merge sidecar manifest.
Multi-arch (amd64/arm64), distroless, ~18 MB.
Requires Go 1.26.9+.
Cross-compile every supported platform into dist/ (binaries + .sha256, named exactly
as the release assets):
platforms.txt is the single source of truth for the target matrix - shared by
build-all.sh and the installers.
This repository is the Whisper client: identity, egress, connect, verify, the security-graph surface and the TUI. It is MIT, and what you build from it is that client.
The published binaries are not only that. whisper also carries Whisper's endpoint
sensor - the service, sensor and posture commands - and the sensor is not open
source today. It ships as a binary and its sources stay closed, so a binary from a release,
from curl -fsSL https://get.whisper.online | sh, or from apt, dnf, apk, brew or scoop has those
commands. Anything BUILT from this tree does not: go install, a local go build, and the
snap, which snapcraft builds from source.
Two consequences worth stating plainly. The MIT licence covers the source in this repository, not the additional closed component in the published binaries. And if you want the endpoint sensor, install a released binary rather than building from source.
linux-arm is 32-bit ARMv7. Every target is a static, CGO-free build, and every one is
signed with the AS219419 release key.
Issues and pull requests are welcome - see CONTRIBUTING.md. Run
go build ./..., go vet ./..., go test ./..., and gofmt -l . before opening a PR.
To report a security issue, see SECURITY.md.
MIT © 2026 viaGraph B.V. (Whisper Security) - for the source in this repository. The published binaries additionally contain the closed-source endpoint sensor; see Source here, binaries there.
The embedded Mozilla CA certificate list
(internal/client/cabundle/mozilla-cacert.pem) is distributed under the Mozilla Public
License 2.0.
来源：README.md，提交 28d7c00
Get a Whisper API key
Start or complete Whisper signup from an email address alone, and receive an API key that unlocks the provisioning and governance skills on this card. Send {"email":"..."} to start; a six-digit code arrives by email; send {"signup_id":"...","code":"123456"} to complete. No human step, no account needed first. Example call: {"skill":"signup","input":{"email":"[email protected]"}}
input必填Verify a Whisper agent identity
Is this IPv6 address or hostname a real Whisper agent, and whose? Grades the full keyless trust chain: the reverse DNS record, the forward AAAA confirming it back to the same address, and the DANE-EE certificate pin published in DNSSEC-signed DNS. Returns is_whisper_agent with the evidence for the verdict either way, so a negative answer is an answer and not an error. Answers without an API key, and every leg of it is independently checkable from the DNS root with dig. Example call: {"skill":"verify","input":"2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478"}
input必填Look up an address in RDAP
The public registration record for any address in Whisper's space, in RFC 9083 form: the handle, the agent's label, its country, and the entities behind it. The same document the RDAP service serves at /ip/{address}, which any RDAP client can already read. Answers without an API key. Example call: {"skill":"rdap","input":"2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478"}
input必填identify
Identify an indicator (domain, IP, hash, …) against the graph. Answers without an API key. Example call: {"skill":"identify","input":"example.com"}
input必填assess
Assess the risk/policy posture of one or more indicators. Answers without an API key. Example call: {"skill":"assess","input":"example.com"}
input必填walk
Walk the graph from an indicator across its relationships. Answers without an API key. Example call: {"skill":"walk","input":"example.com"}
input必填watch
Watch an indicator for change/activity over time. Answers without an API key. Example call: {"skill":"watch","input":{"action":"list"}}
input必填submit
Submit an observation/claim into the graph. Writes to the graph, so it needs your API key: an anonymous claim would not be attributable. Example call: {"skill":"submit","input":{"host":"example.com","claim":"benign"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填explain
Explain a verdict - the evidence and reasoning behind it. Answers without an API key. Example call: {"skill":"explain","input":"example.com"}
input必填variants
Enumerate variants/permutations of an indicator. Answers without an API key. Example call: {"skill":"variants","input":"example.com"}
input必填origins
Trace the origins/provenance of an indicator. Answers without an API key. Example call: {"skill":"origins","input":"example.com"}
input必填history
Historical records for an indicator (incl. whois/bgp history). Answers without an API key. Example call: {"skill":"history","input":"example.com"}
input必填lookupTlsFingerprint
Look up a TLS (JA3/JA4) fingerprint in the graph. Answers without an API key. Example call: {"skill":"lookupTlsFingerprint","input":"ja3:771,4865-4866-4867"}
input必填lookupTorRelay
Look up Tor relay metadata for an address. Answers without an API key. Example call: {"skill":"lookupTorRelay","input":"185.220.101.1"}
input必填asset
Resolve an asset and its catalog of attributes. Answers without an API key. Example call: {"skill":"asset","input":"example.com"}
input必填threatintel
Threat-intelligence indicator family (candidate apex/CDN/hosting). A family verb: name the sub-verb as "sub" alongside the input. Sub-verbs: candidateCdnApex, candidateMultiTenantApex, candidateSharedHostingIp.. Answers without an API key. Example call: {"skill":"threatintel","sub":"candidateCdnApex","input":5}
sub必填input必填psl
Public-suffix-list family (tld-plus-one, is-public-suffix, affiliation). A family verb: name the sub-verb as "sub" alongside the input. Sub-verbs: tldPlusOne, isPublicSuffix, affiliation.. Answers without an API key. Example call: {"skill":"psl","sub":"tldPlusOne","input":"a.b.example.co.uk"}
sub必填input必填topAsnsByPrefixCount
Top ASNs ranked by announced-prefix count. Answers without an API key. Example call: {"skill":"topAsnsByPrefixCount","input":10}
input必填agents: agent
The agent operation on the Whisper control plane, served as CALL whisper.agents({op:'agent', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Add include:'tombstones' to read an agent that is gone: its newest lifecycle row says whether it was revoked, released, erased or reaped, when, by whom and why. Example call: {"skill":"agents.agent","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: alert
The alert operation on the Whisper control plane, served as CALL whisper.agents({op:'alert', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.alert","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: connect
The connect operation on the Whisper control plane, served as CALL whisper.agents({op:'connect', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.connect","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: detect
The detect operation on the Whisper control plane, served as CALL whisper.agents({op:'detect', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.detect","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: disconnect
The disconnect operation on the Whisper control plane, served as CALL whisper.agents({op:'disconnect', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.disconnect","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: domain
The domain operation on the Whisper control plane, served as CALL whisper.agents({op:'domain', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.domain","input":{"name":"example.com"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: firewall
The firewall operation on the Whisper control plane, served as CALL whisper.agents({op:'firewall', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.firewall","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: history
The history operation on the Whisper control plane, served as CALL whisper.agents({op:'history', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.history","input":{"address":"2a04:2a01:f6d7:1ffe:a0be:ba8a:c355:bba1"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: host
The host operation on the Whisper control plane, served as CALL whisper.agents({op:'host', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.host","input":{"name":"my-host","type":"TXT","value":"hello"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: identity
The identity operation on the Whisper control plane, served as CALL whisper.agents({op:'identity', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.identity","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: list
The list operation on the Whisper control plane, served as CALL whisper.agents({op:'list', args:{...}}). Requires your Whisper API key. Add include:'tombstones' to list the agents that are gone as well, paged, each with its lifecycle state (never 'active'), actor and reason. Example call: {"skill":"agents.list","input":{"kind":"agents"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: logs
The logs operation on the Whisper control plane, served as CALL whisper.agents({op:'logs', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.logs","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: lookups
The lookups operation on the Whisper control plane, served as CALL whisper.agents({op:'lookups', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.lookups","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: partner
The partner operation on the Whisper control plane, served as CALL whisper.agents({op:'partner', args:{...}}). Requires your Whisper API key. It is gated on partner authority rather than on arguments: without it the call is refused whatever you pass. Example call: {"skill":"agents.partner","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: policy
The policy operation on the Whisper control plane, served as CALL whisper.agents({op:'policy', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.policy","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: register
The register operation on the Whisper control plane, served as CALL whisper.agents({op:'register', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.register","input":{"label":"my-first-agent"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: rename
The rename operation on the Whisper control plane, served as CALL whisper.agents({op:'rename', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.rename","input":{"agent":"agent-a1f4c0b2d3e4f5a67","label":"renamed-agent"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: resolver
The resolver operation on the Whisper control plane, served as CALL whisper.agents({op:'resolver', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.resolver","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: revoke
The revoke operation on the Whisper control plane, served as CALL whisper.agents({op:'revoke', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.revoke","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: task
The task operation on the Whisper control plane, served as CALL whisper.agents({op:'task', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.task","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: token
The token operation on the Whisper control plane, served as CALL whisper.agents({op:'token', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.token","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: trace
The trace operation on the Whisper control plane, served as CALL whisper.agents({op:'trace', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.trace","input":{"dest":"203.0.113.7"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: verify
The verify operation on the Whisper control plane, served as CALL whisper.agents({op:'verify', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.verify","input":{"name":"example.com"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填已满足适用检查项的 100%
该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。
{ "mcpServers": { "whisper": { "command": "npx", "args": ["-y", "@whisper-security/whisper-mcp"] } }}https://whisper.online/mcpcurl -s https://rdap.whisper.online/verify-identity/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478curl -fsSL https://get.whisper.online | shirm https://get.whisper.online/install.ps1 | iexbrew install whisper-sec/tap/whisperscoop bucket add whisper https://github.com/whisper-sec/scoop-bucketscoop install whispergo install github.com/whisper-sec/whisper-cli/cmd/whisper@latestmise use -g "github:whisper-sec/whisper-cli[exe=whisper]"curl -fsSL https://get.whisper.online/whisper.gpg | sudo tee /usr/share/keyrings/whisper.gpg >/dev/nullecho "deb [signed-by=/usr/share/keyrings/whisper.gpg] https://get.whisper.online/deb stable main" | sudo tee /etc/apt/sources.list.d/whisper.listsudo apt update && sudo apt install whispersudo tee /etc/yum.repos.d/whisper.repo >/dev/null <<'EOF'[whisper]name=Whisperbaseurl=https://get.whisper.online/rpmenabled=1gpgcheck=1gpgkey=https://get.whisper.online/whisper.gpgEOFsudo dnf install whisperwget -qO /etc/apk/keys/whisper-apk.rsa.pub https://get.whisper.online/apk/whisper-apk.rsa.pubecho "https://get.whisper.online/apk" | sudo tee -a /etc/apk/repositoriessudo apk add whisperFingerprint: EFF1663D992539682106A5EAD0F70908CF3B7929# 1. SHA-256 - compare against the asset's .sha256 (and the release checksums.txt)sha256sum -c whisper-linux-amd64.sha256
# 2. PGP - import the AS219419 key, then verify the detached signaturecurl -fsSL https://as219419.net/whisper-release.asc | gpg --importgpg --verify whisper-linux-amd64.asc whisper-linux-amd64$ whisperwhisper: signed in.whisper: name your agent: my-first-agentwhisper: created my-first-agent → 2a04:2a01:…::1whisper: connecting…2a04:2a01:…::1 ✓ egress verifiedConnected ✓whisper connect # bring up egress bound to your /128 (Tier-1.5 SOCKS5/HTTPS)whisper connect --tier wireguard # Tier-1: routed /128 over a userspace WireGuard tunnel (no root)whisper ip # print your egress IP and verify it IS your /128 (exit 0 = verified)whisper run -- curl ifconfig.co # run any command with your Whisper egress wired inwhisper claude # run Claude Code through your Whisper egress, one stepwhisper init claude # wire THIS project so Claude Code always egresses from its own /128whisper use my-agent # choose the agent the rest of `whisper` binds towhisper status # key state, selected agent, connection statewhisper query "CALL whisper.identify(['api.openai.com'])" # who operates this host?whisper query 'CALL whisper.assess([$v])' --param v=8.8.8.8 # threat posture, one row per hostwhisper graph list # all 29 recipes, each with its docs URLwhisper graph variants paypal.com # registered typosquat look-alikes, one tablewhisper graph typosquat paypal.com # the full brand-impersonation flow (streams NDJSON)curl -s https://graph.whisper.online/api/query \ -H 'content-type: application/json' \ -d '{"query":"CALL whisper.assess([\"8.8.8.8\"])"}'# Sign any file, PDF or email as your agent -> a detached S/MIME (.p7s):whisper sign file contract.pdf
# Verify with NO key: checks the CMS signature AND that the signer's key matches the# DNSSEC-validated SMIMEA (RFC 8162) pin for the signer - resolved from the IANA root, in-process:whisper sign verify contract.pdf --sig contract.pdf.p7s
# Encrypt a file so ONLY the named agent can read it (keyless), then decrypt as that agent (keyed):whisper encrypt --to [email protected] secret.txt # -> secret.txt.wencwhisper decrypt secret.txt.wencfrom whisper_id import register, egressagent = register("my-bot") # a routable /128with egress(): # this block leaves from your /128 requests.get("https://api64.ipify.org")import { register, withEgress } from "whisper-id";const agent = await register("my-bot");await withEgress(async () => { /* env-aware clients leave from your /128 */ });docker run --rm ghcr.io/whisper-sec/whisper:latest --versiongit clone https://github.com/whisper-sec/whisper-clicd whisper-cligo build -o whisper ./cmd/whisper./whisper --version./build-all.sh # → dist/whisper-<os>-<arch>[.exe] + .sha256./build-all.sh dist v1.0.0 # stamp a version into `whisper --version`