Log inSubmit server
Whisper Graph logo

Whisper Graph

Investigate DNS, BGP, WHOIS, web links, and threat intelligence through read-only MCP tools and Cypher queries.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Whisper Graph

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "whisper-graph": {
      "command": "npx",
      "args": [
        "-y",
        "@whisper-security/whisper-graph-mcp"
      ],
      "env": {
        "WHISPER_API_KEY": "YOUR_VALUE_HERE",
        "MCP_TRANSPORT": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y @whisper-security/whisper-graph-mcp

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 7d ago.

Overview

The whisper-graph MCP server gives agents read-only access to WhisperGraph, an internet-infrastructure and threat-intelligence graph covering DNS, IPs, ASNs, BGP, WHOIS, web links, and related data. It supports validated Cypher queries plus focused tools for indicator assessment, historical lookups, domain variants, schema discovery, and catalog recipes. Use it for infrastructure investigations, threat triage, attribution, brand protection, and routing or ownership analysis. Connect through Whisper's hosted Streamable HTTP endpoint or run the package locally over stdio, with a WhisperGraph API key.

Use cases

  • Investigate suspicious IPs, domains, CIDRs, or ASNs
  • Trace historical WHOIS and BGP changes
  • Map infrastructure and hosting relationships
  • Check domains for typosquatting variants
  • Run catalog-based threat and exposure investigations

Key features

  • Safety-checked Cypher queries
  • DNS, BGP, WHOIS, and threat-intelligence graph access
  • Indicator scoring with factors and sources
  • Historical infrastructure lookups
  • Domain-variant discovery
  • Catalog investigation recipes

Tools8

What Whisper Graph lets your agent do. Expand a tool for its parameters.

Self-reported~187 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 3d ago

Recent health check succeeded.

7/7 checks healthy over the last 46d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 8d ago via OSV.dev · @whisper-security/whisper-graph-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars1Stargazers on the source repository.
npm downloads186Package downloads in the last 30 days.
Last commit3mo agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Tools exposed8Callable tools this server registers over MCP.
Directory activity1 viewsConfig copies, upvotes, and views on AllMCPs.

How Whisper Graph works

What the whisper-graph MCP server does

The whisper-graph MCP server connects MCP clients to WhisperGraph, a graph database containing 46 billion nodes and edges across 20 entity types. Its data model covers domains, IP addresses, ASNs, prefixes, organizations, DNS relationships, BGP information, WHOIS records, web links, and threat-intelligence listings.

All eight exposed tools are read-only. The query tool accepts Cypher and checks the query against a safety rule set before sending it to the backend. Other tools provide narrower operations: inspect available labels and their properties, assess an IP, hostname, CIDR, or ASN, retrieve WHOIS or BGP history, and find domain variants that may be relevant to typosquatting or brand protection.

How it works

The server can use Whisper's hosted MCP endpoint at https://mcp.whisper.security, authenticated with an API key in the request header. For local use, an MCP client starts the npm package with npx and passes WHISPER_API_KEY in its environment. The repository also supports Streamable HTTP deployments with Docker or Docker Compose.

The whisper-graph MCP server includes list_recipes and run_recipe for the whisper.security catalog. The catalog contains direct procedures and keyed, multi-step investigation flows, including threat assessment, infrastructure mapping, attack-surface analysis, BGP-hijack exposure, indicator enrichment, typosquat checks, and other workflows. Recipe metadata includes documentation links, and some flows require an API key.

The package also provides six MCP resources, including the graph schema, relationship map, Cypher references, a query cookbook, and live statistics and quota resources. Eight prompt templates support investigation workflows such as IP investigation, attack-surface mapping, threat triage, WHOIS pivots, and BGP investigation.

Setup and configuration

Obtain a WhisperGraph API key through the dashboard or the documented two-request signup flow, which uses email verification. For stdio, configure the MCP client to run npx -y @whisper-security/whisper-graph-mcp and set WHISPER_API_KEY.

A self-hosted HTTP container listens on port 8080 when MCP_TRANSPORT=http. In that mode, inbound requests are not authenticated by the MCP layer. The server forwards a request's X-API-Key or bearer token to the hosted API, falling back to WHISPER_API_KEY when no header is supplied. Add an access-control gateway if the deployment needs one.

Node.js 20 or later is required by the package metadata.

Tools and capabilities

  • Run safety-checked Cypher queries.
  • Discover graph labels, counts, and property keys before querying.
  • Score indicators and return threat levels, factors, and sources.
  • Retrieve historical WHOIS and BGP information.
  • Check domain variants against the graph.
  • Browse and execute catalog recipes.

Limitations and notes

The tools do not mutate graph data. Query access depends on the WhisperGraph service and API-key quota. Direct catalog recipes may be rate-limited, while keyed flows require credentials. In self-hosted HTTP mode, authentication and authorization for inbound callers remain the deployer's responsibility.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Whisper Graph

whisper-graph is an MCP server that connects AI clients to WhisperGraph, an internet-infrastructure and threat-intelligence graph covering DNS, IPs, ASNs, BGP, WHOIS, web links, and more. Its main tools run validated Cypher queries, assess indicators, retrieve history, find domain variants, inspect schema, and execute investigation recipes.

Install it through an MCP client's stdio configuration by running `npx -y @whisper-security/whisper-graph-mcp` and setting `WHISPER_API_KEY`. You can instead use the hosted endpoint at `https://mcp.whisper.security`, or deploy the repository's HTTP mode with Docker.

whisper-graph requires a WhisperGraph API key for authenticated access. Get one through the dashboard or the documented signup flow, then provide it as `WHISPER_API_KEY` for stdio or as an authorization header when using the hosted or HTTP transport.

Yes, whisper-graph can run remotely through Whisper's hosted MCP endpoint or a self-hosted Streamable HTTP deployment. The hosted endpoint uses a bearer token, while self-hosted HTTP mode forwards caller credentials and does not authenticate inbound requests itself.

Related MCP servers

All in Speech-to-Text All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewWhisper Graph AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/whisper-graph?style=directory)](https://allmcps.com/mcp/whisper-graph)
HTML Embed
<a href="https://allmcps.com/mcp/whisper-graph"><img src="https://allmcps.com/api/badge/whisper-graph?style=directory" alt="Whisper Graph on AllMCPs" /></a>