# whisper-graph [Health: Active]

**Category:** 🎙️ Speech-to-Text  
**Repository:** https://github.com/whisper-sec/whisper-graph-mcp  
**GitHub Stars:** 1  
**npm Downloads (last month):** 186  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/whisper-graph

## Description
Query WhisperGraph: the internet's infrastructure & threat-intel graph (DNS, BGP, GeoIP, WHOIS).

## Tools
Capabilities this server exposes over MCP:

- **query** — Execute a Cypher query against WhisperGraph. Validated against a safety rule set before it reaches the backend.
- **list_labels** — List every node label with counts. Call it before writing a query when you're unsure which label to anchor on.
- **describe_label** — Confirm a label exists and enumerate its property keys.
- **explain_indicator** — Threat assessment for an IP, hostname, CIDR, or ASN - score, level, factors, sources.
- **whisper_history** — Historical WHOIS or BGP data for an indicator.
- **domain_variants** — Typosquatting / brand-protection variants of a domain, checked against the graph.
- **list_recipes** — List the full whisper.security catalog of ready-made recipes (see below).
- **run_recipe** — Run any catalog recipe by slug - a keyless direct procedure or a keyed multi-step flow.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "whisper-graph": {
    "command": "npx",
    "args": ["-y","@whisper-security/whisper-graph-mcp"],
    "env": {
      "WHISPER_API_KEY": "",
      "MCP_TRANSPORT": ""
    }
  }
}
```

**Requires environment variables:** `WHISPER_API_KEY`, `MCP_TRANSPORT` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What the whisper-graph MCP server does

The whisper-graph MCP server connects MCP clients to WhisperGraph, a graph database containing 46 billion nodes and edges across 20 entity types. Its data model covers domains, IP addresses, ASNs, prefixes, organizations, DNS relationships, BGP information, WHOIS records, web links, and threat-intelligence listings.

All eight exposed tools are read-only. The `query` tool accepts Cypher and checks the query against a safety rule set before sending it to the backend. Other tools provide narrower operations: inspect available labels and their properties, assess an IP, hostname, CIDR, or ASN, retrieve WHOIS or BGP history, and find domain variants that may be relevant to typosquatting or brand protection.

## How it works

The server can use Whisper's hosted MCP endpoint at `https://mcp.whisper.security`, authenticated with an API key in the request header. For local use, an MCP client starts the npm package with `npx` and passes `WHISPER_API_KEY` in its environment. The repository also supports Streamable HTTP deployments with Docker or Docker Compose.

The whisper-graph MCP server includes `list_recipes` and `run_recipe` for the whisper.security catalog. The catalog contains direct procedures and keyed, multi-step investigation flows, including threat assessment, infrastructure mapping, attack-surface analysis, BGP-hijack exposure, indicator enrichment, typosquat checks, and other workflows. Recipe metadata includes documentation links, and some flows require an API key.

The package also provides six MCP resources, including the graph schema, relationship map, Cypher references, a query cookbook, and live statistics and quota resources. Eight prompt templates support investigation workflows such as IP investigation, attack-surface mapping, threat triage, WHOIS pivots, and BGP investigation.

## Setup and configuration

Obtain a WhisperGraph API key through the dashboard or the documented two-request signup flow, which uses email verification. For stdio, configure the MCP client to run `npx -y @whisper-security/whisper-graph-mcp` and set `WHISPER_API_KEY`.

A self-hosted HTTP container listens on port 8080 when `MCP_TRANSPORT=http`. In that mode, inbound requests are not authenticated by the MCP layer. The server forwards a request's `X-API-Key` or bearer token to the hosted API, falling back to `WHISPER_API_KEY` when no header is supplied. Add an access-control gateway if the deployment needs one.

Node.js 20 or later is required by the package metadata.

## Tools and capabilities

- Run safety-checked Cypher queries.
- Discover graph labels, counts, and property keys before querying.
- Score indicators and return threat levels, factors, and sources.
- Retrieve historical WHOIS and BGP information.
- Check domain variants against the graph.
- Browse and execute catalog recipes.

## Limitations and notes

The tools do not mutate graph data. Query access depends on the WhisperGraph service and API-key quota. Direct catalog recipes may be rate-limited, while keyed flows require credentials. In self-hosted HTTP mode, authentication and authorization for inbound callers remain the deployer's responsibility.

_Full upstream README: https://allmcps.com/mcp/whisper-graph/readme_