io.github.whisper-sec由 GitHub 帳號 whisper-sec 發布v0.256.1更新於 Nov 7, 2026
One routable IPv6 per AI agent, verifiable from the DNS root. Keyless tools need no signup.
Whisper 依網際網路基礎設施圖譜回答網域、IP、ASN 與檔案雜湊的安全問題，並為 AI 代理配置可驗證的 IPv6 身分。
Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。
把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。
閱讀 https://sourceweft.com/mcp/io.github.whisper-sec%2Fwhisper/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。把它新增到你客戶端的 mcpServers 設定中。
{
"mcpServers": {
"whisper": {
"type": "http",
"url": "https://whisper.online/mcp"
}
}
}Give your agent a real, routable Whisper IPv6 identity - one command.
whisper is the command-line client for Whisper: a single
static binary that gives an agent a real, routable IPv6 /128 on AS219419, wires
egress so the agent's traffic sources from that address, and verifies it end-to-end.
The address is the identity - DNSSEC-signed, DANE-pinned, and resolvable in public
RDAP. One binary, standard ports, no config to get
started.
It is two surfaces over one core: a fully scriptable Cobra
CLI, and a full-screen Bubble Tea TUI when
you run whisper on a terminal with no subcommand. And it talks to the
whisper.security graph: whisper query for raw Cypher,
whisper graph for the 29-recipe catalog (below).
No API key and no install. Put this in your client's config and seven tools appear, and every one
answers with no key. Add a key, by env var or by whisper login once on the machine, and the same
server lists 45:
Claude Desktop, Claude Code, Cursor, Windsurf, VS Code, Cline and Zed all take the same
three lines. Already installed the CLI? whisper mcp is the identical server.
The seven, measured against the server with no key anywhere on the machine:
whisper_verify - is this address or hostname a real agent, and whose? Checks the
DANE pin against DNSSEC-signed DNS, from the IANA root.whisper_rdap - the public registration record for any /128.whisper_assess - a verdict on a domain, IP, ASN or file hash, with its evidence.whisper_identify - what an indicator is: category, vendor, band.whisper_explain - the scored explanation behind a verdict, with its sources.read_docs - the whisper.security documentation, listed, searched or fetched page by page.list_workflows - the gallery of ready-made investigations, and what each one takes.Add a key and the same server lists 45: the graph in full, plus registering agents, setting resolver policy, handing out egress configuration, reading per-agent activity and revoking an identity.
Most clients take that URL and nothing else. Claude Code, for one:
claude mcp add --transport http whisper https://whisper.online/mcp.
Streamable HTTP. initialize and tools/list answer with no credential, so a client that takes
a bare URL needs nothing else. The HTTP transport is a different server from the stdio one above
and it lists a different set: 17 tools with no key, every one of which works with no key, and 41
once you send your key as the X-API-Key header (the stdio server's keyed set is the 45 above).
The keyless 17 are the identity checks and the graph: whisper_verify, whisper_rdap,
whisper_assess, whisper_identify, whisper_explain, whisper_walk, whisper_watch,
whisper_variants, whisper_origins, whisper_history, whisper_asset, whisper_psl,
whisper_threatintel, whisper_lookupTlsFingerprint, whisper_lookupTorRelay,
whisper_topAsnsByPrefixCount, and whisper_signup, which issues you an API key from an email
address alone. The 24 a key adds over HTTP are the provisioning and governance set, 23 of them
whisper_agents_* and the 24th whisper_submit, which writes a claim into the graph and so
needs to be attributable.
whisper_verify and whisper_rdap check somebody else's agent. whisper_agents_verify in the
keyed set verifies a domain you control, which is not the same thing.
Verifying somebody else's agent needs nothing at all, not even the client:
The one-liner fetches the signed binary straight from this repo's GitHub Releases,
verifies its SHA-256 (and its PGP signature when gpg is present), and puts it on your
PATH:
Windows (PowerShell):
Homebrew (macOS/Linux):
Scoop (Windows):
With Go:
With mise (GitHub-release backend, no plugin):
(asdf has no built-in GitHub-release backend, so on asdf use mise, or a community
ubi-style plugin.)
On Debian/Ubuntu (apt) - signed repo:
On Fedora/RHEL (dnf) - signed repo:
On Alpine (apk) - signed repo:
All three repos are served from our own infrastructure (AS219419) and signed with the
Whisper package key (get.whisper.online/whisper.gpg; the apk repo uses its own
whisper-apk.rsa.pub).
Or download the binary for your platform from the
Releases page, make it
executable, and put it on your PATH.
The installers (
scripts/install.sh,scripts/install.ps1) are published here so the whole install path is inspectable. They are the same scriptsget.whisper.onlineserves, differing only in where they download from by default: these fetchwhisper-<os>-<arch>(plus.sha256and.asc) from this repo's releases, the served copy fetches the same binaries fromcli.whisper.online/dl. Either way SHA-256 is a hard gate - a mismatch aborts the install - and the PGP check is an extra layer. PointWHISPER_CLI_BASEat any mirror to override the source.
Releases are signed with the AS219419 PGP key:
The public key is published at https://as219419.net/. To verify a binary you downloaded manually:
A good signature reports Good signature from the key with the fingerprint above.
Run whisper with no arguments for the guided flow. It signs you in (browser device
login or a pasted API key), helps you name and create an agent if you don't have one,
then connects and verifies:
Naming is mandatory - an agent's name is part of its identity, so the flow asks before it creates one. The same steps are scriptable:
whisper ip is exit-code-first: 0 when the observed egress address is inside
2a04:2a01::/32 and equals your selected agent's /128, 1 otherwise - so scripts
and agents can gate on it. Add --json to any command for the raw, scriptable envelope.
Per-project agent identity for Claude Code. whisper init claude makes a project
zero-config: run it once in a directory and Claude Code there - and every subagent it
spawns - egresses from that project's own /128, over SOCKS5 (default) or --tier wireguard. It pins the project's agent + tier in .whisper/config, wires a local proxy
into .claude/settings.local.json (merge-safe - it never clobbers your settings), and
keeps the connection up via a small auto-reconnecting daemon. Different projects, different
identities, nothing to remember. Pass --agent <name|/128> to reuse an existing agent or
--name <new> to mint one.
Other useful commands: whisper list, whisper logs, whisper policy, `whisper rdap
The same whisper.security graph the Whisper resolver
consults on every lookup - 6.9B nodes (hostnames, IPs, ASNs, certs, threat intel), 50.0B
relationships - is a first-class CLI surface. whisper query runs raw parameterised
Cypher; whisper graph runs a named recipe from the embedded catalog:
Direct recipes answer with one result table (--json emits the raw
{columns,rows,statistics} envelope); flow recipes stream their steps as NDJSON - pipe
them to jq. Every recipe documents itself: whisper graph <recipe> --help.
query and graph authenticate with your API key (whisper login, WHISPER_API_KEY,
or --key). The graph endpoint itself is two-tier: the direct read verbs
(whisper.identify, whisper.assess, whisper.variants, whisper.explain,
db.schema, ...) also answer keyless and rate-limited - no account needed:
A key lifts the rate limit and unlocks raw Cypher and the multi-step flows. The same
tools ride the MCP server (whisper mcp): whisper_graph_query plus one tool per
recipe. Docs: www.whisper.security/docs - the raw
Cypher API at /docs/cypher-api, per-verb
pages under /docs/whisper-graph.
Your agent's /128 carries a per-agent EC P-256 key, pinned in DNSSEC-signed DNS - so it can sign a document as itself and anyone can verify it with no account and no certificate authority. Trust is anchored by DANE, not a CA you have to install.
The per-agent verification key a stranger resolves is the agent's DANE TLSA 3 1 1 (and, for signatures, its SMIMEA 3 1 1) - both DNSSEC-signed and checkable with dig + openssl, no Whisper account. Full guide, including the byte-exact signature envelope: https://whisper.online/docs/sign-encrypt.
/128 out of 2a04:2a01::/32, announced by AS219419 - your
own internet address, not a shared NAT pool.ip6.arpa PTR) resolves to the agent; the assignment is
visible in public RDAP at rdap.whisper.online.whisper connect provisions a local proxy whose
traffic sources from your /128; whisper ip proves the source address is yours,
node-free and with no third party in the loop. --tier wireguard brings the /128 up
as a routed address over a userspace WireGuard tunnel (wireguard-go netstack - still
no root, no kernel wg, no TUN device), fronted by the same local proxy so tools need
no change.Same identity + egress from your language of choice - thin wrappers over this CLI:
Python - pip install whisper-id
Node - npm i whisper-id
The official image runs the CLI as an egress sidecar so any container leaves from your /128:
whisper init compose and whisper init k8s emit a ready-to-merge sidecar manifest.
Multi-arch (amd64/arm64), distroless, ~18 MB.
Requires Go 1.26.9+.
Cross-compile every supported platform into dist/ (binaries + .sha256, named exactly
as the release assets):
platforms.txt is the single source of truth for the target matrix - shared by
build-all.sh and the installers.
This repository is the Whisper client: identity, egress, connect, verify, the security-graph surface and the TUI. It is MIT, and what you build from it is that client.
The published binaries are not only that. whisper also carries Whisper's endpoint
sensor - the service, sensor and posture commands - and the sensor is not open
source today. It ships as a binary and its sources stay closed, so a binary from a release,
from curl -fsSL https://get.whisper.online | sh, or from apt, dnf, apk, brew or scoop has those
commands. Anything BUILT from this tree does not: go install, a local go build, and the
snap, which snapcraft builds from source.
Two consequences worth stating plainly. The MIT licence covers the source in this repository, not the additional closed component in the published binaries. And if you want the endpoint sensor, install a released binary rather than building from source.
linux-arm is 32-bit ARMv7. Every target is a static, CGO-free build, and every one is
signed with the AS219419 release key.
Issues and pull requests are welcome - see CONTRIBUTING.md. Run
go build ./..., go vet ./..., go test ./..., and gofmt -l . before opening a PR.
To report a security issue, see SECURITY.md.
MIT © 2026 viaGraph B.V. (Whisper Security) - for the source in this repository. The published binaries additionally contain the closed-source endpoint sensor; see Source here, binaries there.
The embedded Mozilla CA certificate list
(internal/client/cabundle/mozilla-cacert.pem) is distributed under the Mozilla Public
License 2.0.
來源：README.md，提交 28d7c00
Get a Whisper API key
Start or complete Whisper signup from an email address alone, and receive an API key that unlocks the provisioning and governance skills on this card. Send {"email":"..."} to start; a six-digit code arrives by email; send {"signup_id":"...","code":"123456"} to complete. No human step, no account needed first. Example call: {"skill":"signup","input":{"email":"[email protected]"}}
input必填Verify a Whisper agent identity
Is this IPv6 address or hostname a real Whisper agent, and whose? Grades the full keyless trust chain: the reverse DNS record, the forward AAAA confirming it back to the same address, and the DANE-EE certificate pin published in DNSSEC-signed DNS. Returns is_whisper_agent with the evidence for the verdict either way, so a negative answer is an answer and not an error. Answers without an API key, and every leg of it is independently checkable from the DNS root with dig. Example call: {"skill":"verify","input":"2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478"}
input必填Look up an address in RDAP
The public registration record for any address in Whisper's space, in RFC 9083 form: the handle, the agent's label, its country, and the entities behind it. The same document the RDAP service serves at /ip/{address}, which any RDAP client can already read. Answers without an API key. Example call: {"skill":"rdap","input":"2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478"}
input必填identify
Identify an indicator (domain, IP, hash, …) against the graph. Answers without an API key. Example call: {"skill":"identify","input":"example.com"}
input必填assess
Assess the risk/policy posture of one or more indicators. Answers without an API key. Example call: {"skill":"assess","input":"example.com"}
input必填walk
Walk the graph from an indicator across its relationships. Answers without an API key. Example call: {"skill":"walk","input":"example.com"}
input必填watch
Watch an indicator for change/activity over time. Answers without an API key. Example call: {"skill":"watch","input":{"action":"list"}}
input必填submit
Submit an observation/claim into the graph. Writes to the graph, so it needs your API key: an anonymous claim would not be attributable. Example call: {"skill":"submit","input":{"host":"example.com","claim":"benign"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填explain
Explain a verdict - the evidence and reasoning behind it. Answers without an API key. Example call: {"skill":"explain","input":"example.com"}
input必填variants
Enumerate variants/permutations of an indicator. Answers without an API key. Example call: {"skill":"variants","input":"example.com"}
input必填origins
Trace the origins/provenance of an indicator. Answers without an API key. Example call: {"skill":"origins","input":"example.com"}
input必填history
Historical records for an indicator (incl. whois/bgp history). Answers without an API key. Example call: {"skill":"history","input":"example.com"}
input必填lookupTlsFingerprint
Look up a TLS (JA3/JA4) fingerprint in the graph. Answers without an API key. Example call: {"skill":"lookupTlsFingerprint","input":"ja3:771,4865-4866-4867"}
input必填lookupTorRelay
Look up Tor relay metadata for an address. Answers without an API key. Example call: {"skill":"lookupTorRelay","input":"185.220.101.1"}
input必填asset
Resolve an asset and its catalog of attributes. Answers without an API key. Example call: {"skill":"asset","input":"example.com"}
input必填threatintel
Threat-intelligence indicator family (candidate apex/CDN/hosting). A family verb: name the sub-verb as "sub" alongside the input. Sub-verbs: candidateCdnApex, candidateMultiTenantApex, candidateSharedHostingIp.. Answers without an API key. Example call: {"skill":"threatintel","sub":"candidateCdnApex","input":5}
sub必填input必填psl
Public-suffix-list family (tld-plus-one, is-public-suffix, affiliation). A family verb: name the sub-verb as "sub" alongside the input. Sub-verbs: tldPlusOne, isPublicSuffix, affiliation.. Answers without an API key. Example call: {"skill":"psl","sub":"tldPlusOne","input":"a.b.example.co.uk"}
sub必填input必填topAsnsByPrefixCount
Top ASNs ranked by announced-prefix count. Answers without an API key. Example call: {"skill":"topAsnsByPrefixCount","input":10}
input必填agents: agent
The agent operation on the Whisper control plane, served as CALL whisper.agents({op:'agent', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Add include:'tombstones' to read an agent that is gone: its newest lifecycle row says whether it was revoked, released, erased or reaped, when, by whom and why. Example call: {"skill":"agents.agent","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: alert
The alert operation on the Whisper control plane, served as CALL whisper.agents({op:'alert', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.alert","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: connect
The connect operation on the Whisper control plane, served as CALL whisper.agents({op:'connect', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.connect","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: detect
The detect operation on the Whisper control plane, served as CALL whisper.agents({op:'detect', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.detect","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: disconnect
The disconnect operation on the Whisper control plane, served as CALL whisper.agents({op:'disconnect', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.disconnect","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: domain
The domain operation on the Whisper control plane, served as CALL whisper.agents({op:'domain', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.domain","input":{"name":"example.com"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: firewall
The firewall operation on the Whisper control plane, served as CALL whisper.agents({op:'firewall', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.firewall","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: history
The history operation on the Whisper control plane, served as CALL whisper.agents({op:'history', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.history","input":{"address":"2a04:2a01:f6d7:1ffe:a0be:ba8a:c355:bba1"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: host
The host operation on the Whisper control plane, served as CALL whisper.agents({op:'host', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.host","input":{"name":"my-host","type":"TXT","value":"hello"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: identity
The identity operation on the Whisper control plane, served as CALL whisper.agents({op:'identity', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.identity","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: list
The list operation on the Whisper control plane, served as CALL whisper.agents({op:'list', args:{...}}). Requires your Whisper API key. Add include:'tombstones' to list the agents that are gone as well, paged, each with its lifecycle state (never 'active'), actor and reason. Example call: {"skill":"agents.list","input":{"kind":"agents"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: logs
The logs operation on the Whisper control plane, served as CALL whisper.agents({op:'logs', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.logs","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: lookups
The lookups operation on the Whisper control plane, served as CALL whisper.agents({op:'lookups', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.lookups","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: partner
The partner operation on the Whisper control plane, served as CALL whisper.agents({op:'partner', args:{...}}). Requires your Whisper API key. It is gated on partner authority rather than on arguments: without it the call is refused whatever you pass. Example call: {"skill":"agents.partner","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: policy
The policy operation on the Whisper control plane, served as CALL whisper.agents({op:'policy', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.policy","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: register
The register operation on the Whisper control plane, served as CALL whisper.agents({op:'register', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.register","input":{"label":"my-first-agent"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: rename
The rename operation on the Whisper control plane, served as CALL whisper.agents({op:'rename', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.rename","input":{"agent":"agent-a1f4c0b2d3e4f5a67","label":"renamed-agent"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: resolver
The resolver operation on the Whisper control plane, served as CALL whisper.agents({op:'resolver', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.resolver","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
inputagents: revoke
The revoke operation on the Whisper control plane, served as CALL whisper.agents({op:'revoke', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.revoke","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: task
The task operation on the Whisper control plane, served as CALL whisper.agents({op:'task', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.task","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: token
The token operation on the Whisper control plane, served as CALL whisper.agents({op:'token', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.token","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: trace
The trace operation on the Whisper control plane, served as CALL whisper.agents({op:'trace', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.trace","input":{"dest":"203.0.113.7"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填agents: verify
The verify operation on the Whisper control plane, served as CALL whisper.agents({op:'verify', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.verify","input":{"name":"example.com"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
input必填已滿足適用檢查項的 100%
該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。
{ "mcpServers": { "whisper": { "command": "npx", "args": ["-y", "@whisper-security/whisper-mcp"] } }}https://whisper.online/mcpcurl -s https://rdap.whisper.online/verify-identity/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478curl -fsSL https://get.whisper.online | shirm https://get.whisper.online/install.ps1 | iexbrew install whisper-sec/tap/whisperscoop bucket add whisper https://github.com/whisper-sec/scoop-bucketscoop install whispergo install github.com/whisper-sec/whisper-cli/cmd/whisper@latestmise use -g "github:whisper-sec/whisper-cli[exe=whisper]"curl -fsSL https://get.whisper.online/whisper.gpg | sudo tee /usr/share/keyrings/whisper.gpg >/dev/nullecho "deb [signed-by=/usr/share/keyrings/whisper.gpg] https://get.whisper.online/deb stable main" | sudo tee /etc/apt/sources.list.d/whisper.listsudo apt update && sudo apt install whispersudo tee /etc/yum.repos.d/whisper.repo >/dev/null <<'EOF'[whisper]name=Whisperbaseurl=https://get.whisper.online/rpmenabled=1gpgcheck=1gpgkey=https://get.whisper.online/whisper.gpgEOFsudo dnf install whisperwget -qO /etc/apk/keys/whisper-apk.rsa.pub https://get.whisper.online/apk/whisper-apk.rsa.pubecho "https://get.whisper.online/apk" | sudo tee -a /etc/apk/repositoriessudo apk add whisperFingerprint: EFF1663D992539682106A5EAD0F70908CF3B7929# 1. SHA-256 - compare against the asset's .sha256 (and the release checksums.txt)sha256sum -c whisper-linux-amd64.sha256
# 2. PGP - import the AS219419 key, then verify the detached signaturecurl -fsSL https://as219419.net/whisper-release.asc | gpg --importgpg --verify whisper-linux-amd64.asc whisper-linux-amd64$ whisperwhisper: signed in.whisper: name your agent: my-first-agentwhisper: created my-first-agent → 2a04:2a01:…::1whisper: connecting…2a04:2a01:…::1 ✓ egress verifiedConnected ✓whisper connect # bring up egress bound to your /128 (Tier-1.5 SOCKS5/HTTPS)whisper connect --tier wireguard # Tier-1: routed /128 over a userspace WireGuard tunnel (no root)whisper ip # print your egress IP and verify it IS your /128 (exit 0 = verified)whisper run -- curl ifconfig.co # run any command with your Whisper egress wired inwhisper claude # run Claude Code through your Whisper egress, one stepwhisper init claude # wire THIS project so Claude Code always egresses from its own /128whisper use my-agent # choose the agent the rest of `whisper` binds towhisper status # key state, selected agent, connection statewhisper query "CALL whisper.identify(['api.openai.com'])" # who operates this host?whisper query 'CALL whisper.assess([$v])' --param v=8.8.8.8 # threat posture, one row per hostwhisper graph list # all 29 recipes, each with its docs URLwhisper graph variants paypal.com # registered typosquat look-alikes, one tablewhisper graph typosquat paypal.com # the full brand-impersonation flow (streams NDJSON)curl -s https://graph.whisper.online/api/query \ -H 'content-type: application/json' \ -d '{"query":"CALL whisper.assess([\"8.8.8.8\"])"}'# Sign any file, PDF or email as your agent -> a detached S/MIME (.p7s):whisper sign file contract.pdf
# Verify with NO key: checks the CMS signature AND that the signer's key matches the# DNSSEC-validated SMIMEA (RFC 8162) pin for the signer - resolved from the IANA root, in-process:whisper sign verify contract.pdf --sig contract.pdf.p7s
# Encrypt a file so ONLY the named agent can read it (keyless), then decrypt as that agent (keyed):whisper encrypt --to [email protected] secret.txt # -> secret.txt.wencwhisper decrypt secret.txt.wencfrom whisper_id import register, egressagent = register("my-bot") # a routable /128with egress(): # this block leaves from your /128 requests.get("https://api64.ipify.org")import { register, withEgress } from "whisper-id";const agent = await register("my-bot");await withEgress(async () => { /* env-aware clients leave from your /128 */ });docker run --rm ghcr.io/whisper-sec/whisper:latest --versiongit clone https://github.com/whisper-sec/whisper-clicd whisper-cligo build -o whisper ./cmd/whisper./whisper --version./build-all.sh # → dist/whisper-<os>-<arch>[.exe] + .sha256./build-all.sh dist v1.0.0 # stamp a version into `whisper --version`