Whisper MCP Server

by whisper-sec Your server? Claim it

answering

Whisper is answering right now. Last checked 10 min ago. 519 installs a week from npm. It exposes 41 tools. Last commit 7 Nov 2026.

One routable IPv6 per AI agent, verifiable from the DNS root. Keyless tools need no signup.

Installs per day peak 398 · avg 39 · +557% w/w

a month agotoday

Uptime history 44 days of history · worst day 99%

44 days agonow

100.0%

Uptime 24h

91 of 91 checks

Tools

read from the server

192 ms

Response time

average over 24h

519

Installs / week

npm and PyPI

What changed 86

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 25 September 2026. No other catalogue keeps this.

7 Nov a tool changed version3 times that day

7 Nov 2 tool descriptions were rewritten whisper_agents_agent, whisper_agents_list

6 Nov a tool changed version

5 Nov 24 tools appeared whisper_agents_agent, whisper_agents_alert, whisper_agents_connect and 21 more

5 Nov a tool changed version3 times that day

4 Nov a tool changed version3 times that day

3 Nov a tool changed version4 times that day

28 Oct a tool changed version

27 Oct a tool changed version

26 Oct a tool changed version3 times that day

and 52 more, back to 25 September 2026

What the code does

We read the source, 20 h ago · tools taken from the live server · rules 995398eba69f

Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

Runs an external command npm-mcp/bin/whisper-mcp.js:278, [пакет] bin/whisper-mcp.js:278

  const child = spawn(exe, args, { stdio: 'inherit', env: process.env });

In the project's build, not in the package

Found in continuous integration, deployment or infrastructure files, or in a neighbouring package of the same monorepo. None of this is installed when you add the server: it describes how the project is built and released. We list it because a leaked key in a build pipeline is still a real problem, but it is not something this server does on your machine.

Builds a file path from a variable internal/cli/panel_show.go:73, internal/idkey/idkey.go:132, internal/cli/run_enforce_linux.go:116 и ещё 3

        filepath.Join("/opt/whisper", panelBundleName),

Builds a database query by concatenation internal/cli/contain_linux.go:112, internal/egress/proxy.go:782

        select {
        case sig := <-sigs:
            why = "released on " + sig.String()

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

This code can reach further than it looks

We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 10 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add whisper --transport http https://whisper.online/mcp

Settings → Connectors → Add custom connector, then paste this address

https://whisper.online/mcp

~/.codex/config.toml

[mcp_servers.whisper]
url = "https://whisper.online/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "whisper": {
      "url": "https://whisper.online/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "whisper": {
      "type": "http",
      "url": "https://whisper.online/mcp"
    }
  }
}

Available tools 41

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

whisper

whisper_agents_agent

The agent operation on the Whisper control plane, served as CALL whisper.agents({op:'agent', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Add include:'tombstones' to read an agent that is gone: its newest lifecycle row says whether it was revoked, released, erased or reaped, when, by whom and why. Example call: {"skill":"agents.agent","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_alert

The alert operation on the Whisper control plane, served as CALL whisper.agents({op:'alert', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.alert","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_connect

The connect operation on the Whisper control plane, served as CALL whisper.agents({op:'connect', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.connect","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_detect

The detect operation on the Whisper control plane, served as CALL whisper.agents({op:'detect', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.detect","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_disconnect

The disconnect operation on the Whisper control plane, served as CALL whisper.agents({op:'disconnect', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.disconnect","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_domain

The domain operation on the Whisper control plane, served as CALL whisper.agents({op:'domain', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.domain","input":{"name":"example.com"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_firewall

The firewall operation on the Whisper control plane, served as CALL whisper.agents({op:'firewall', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.firewall","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_history

The history operation on the Whisper control plane, served as CALL whisper.agents({op:'history', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.history","input":{"address":"2a04:2a01:f6d7:1ffe:a0be:ba8a:c355:bba1"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_host

The host operation on the Whisper control plane, served as CALL whisper.agents({op:'host', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.host","input":{"name":"my-host","type":"TXT","value":"hello"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_identity

The identity operation on the Whisper control plane, served as CALL whisper.agents({op:'identity', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.identity","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_list

The list operation on the Whisper control plane, served as CALL whisper.agents({op:'list', args:{...}}). Requires your Whisper API key. Add include:'tombstones' to list the agents that are gone as well, paged, each with its lifecycle state (never 'active'), actor and reason. Example call: {"skill":"agents.list","input":{"kind":"agents"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_logs

The logs operation on the Whisper control plane, served as CALL whisper.agents({op:'logs', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.logs","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_lookups

The lookups operation on the Whisper control plane, served as CALL whisper.agents({op:'lookups', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.lookups","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_partner

The partner operation on the Whisper control plane, served as CALL whisper.agents({op:'partner', args:{...}}). Requires your Whisper API key. It is gated on partner authority rather than on arguments: without it the call is refused whatever you pass. Example call: {"skill":"agents.partner","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_policy

The policy operation on the Whisper control plane, served as CALL whisper.agents({op:'policy', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.policy","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_register

The register operation on the Whisper control plane, served as CALL whisper.agents({op:'register', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.register","input":{"label":"my-first-agent"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_rename

The rename operation on the Whisper control plane, served as CALL whisper.agents({op:'rename', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.rename","input":{"agent":"agent-a1f4c0b2d3e4f5a67","label":"renamed-agent"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_resolver

The resolver operation on the Whisper control plane, served as CALL whisper.agents({op:'resolver', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.resolver","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_revoke

The revoke operation on the Whisper control plane, served as CALL whisper.agents({op:'revoke', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.revoke","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_task

The task operation on the Whisper control plane, served as CALL whisper.agents({op:'task', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.task","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_token

The token operation on the Whisper control plane, served as CALL whisper.agents({op:'token', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example call: {"skill":"agents.token","input":{"agent":"agent-a1f4c0b2d3e4f5a67"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_trace

The trace operation on the Whisper control plane, served as CALL whisper.agents({op:'trace', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.trace","input":{"dest":"203.0.113.7"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_agents_verify

The verify operation on the Whisper control plane, served as CALL whisper.agents({op:'verify', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.verify","input":{"name":"example.com"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_assess

Assess the risk/policy posture of one or more indicators. Answers without an API key. Example call: {"skill":"assess","input":"example.com"}

whisper_asset

Resolve an asset and its catalog of attributes. Answers without an API key. Example call: {"skill":"asset","input":"example.com"}

whisper_explain

Explain a verdict - the evidence and reasoning behind it. Answers without an API key. Example call: {"skill":"explain","input":"example.com"}

whisper_history

Historical records for an indicator (incl. whois/bgp history). Answers without an API key. Example call: {"skill":"history","input":"example.com"}

whisper_identify

Identify an indicator (domain, IP, hash, …) against the graph. Answers without an API key. Example call: {"skill":"identify","input":"example.com"}

whisper_lookupTlsFingerprint

Look up a TLS (JA3/JA4) fingerprint in the graph. Answers without an API key. Example call: {"skill":"lookupTlsFingerprint","input":"ja3:771,4865-4866-4867"}

whisper_lookupTorRelay

Look up Tor relay metadata for an address. Answers without an API key. Example call: {"skill":"lookupTorRelay","input":"185.220.101.1"}

whisper_origins

Trace the origins/provenance of an indicator. Answers without an API key. Example call: {"skill":"origins","input":"example.com"}

whisper_psl

Public-suffix-list family (tld-plus-one, is-public-suffix, affiliation). A family verb: name the sub-verb as "sub" alongside the input. Sub-verbs: tldPlusOne, isPublicSuffix, affiliation.. Answers without an API key. Example call: {"skill":"psl","sub":"tldPlusOne","input":"a.b.example.co.uk"}

whisper_rdap

The public registration record for any address in Whisper's space, in RFC 9083 form: the handle, the agent's label, its country, and the entities behind it. The same document the RDAP service serves at /ip/{address}, which any RDAP client can already read. Answers without an API key. Example call: {"skill":"rdap","input":"2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478"}

whisper_signup

Start or complete Whisper signup from an email address alone, and receive an API key that unlocks the provisioning and governance skills on this card. Send {"email":"..."} to start; a six-digit code arrives by email; send {"signup_id":"...","code":"123456"} to complete. No human step, no account needed first. Example call: {"skill":"signup","input":{"email":"[email protected]"}}

whisper_submit

Submit an observation/claim into the graph. Writes to the graph, so it needs your API key: an anonymous claim would not be attributable. Example call: {"skill":"submit","input":{"host":"example.com","claim":"benign"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.

whisper_threatintel

Threat-intelligence indicator family (candidate apex/CDN/hosting). A family verb: name the sub-verb as "sub" alongside the input. Sub-verbs: candidateCdnApex, candidateMultiTenantApex, candidateSharedHostingIp.. Answers without an API key. Example call: {"skill":"threatintel","sub":"candidateCdnApex","input":5}

whisper_topAsnsByPrefixCount

Top ASNs ranked by announced-prefix count. Answers without an API key. Example call: {"skill":"topAsnsByPrefixCount","input":10}

whisper_variants

Enumerate variants/permutations of an indicator. Answers without an API key. Example call: {"skill":"variants","input":"example.com"}

whisper_verify

Is this IPv6 address or hostname a real Whisper agent, and whose? Grades the full keyless trust chain: the reverse DNS record, the forward AAAA confirming it back to the same address, and the DANE-EE certificate pin published in DNSSEC-signed DNS. Returns is_whisper_agent with the evidence for the verdict either way, so a negative answer is an answer and not an error. Answers without an API key, and every leg of it is independently checkable from the DNS root with dig. Example call: {"skill":"verify","input":"2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478"}

whisper_walk

Walk the graph from an indicator across its relationships. Answers without an API key. Example call: {"skill":"walk","input":"example.com"}

whisper_watch

Watch an indicator for change/activity over time. Answers without an API key. Example call: {"skill":"watch","input":{"action":"list"}}

Tools removed

Tools this server used to expose. Anything built against them stopped working on the day they went.

whisper_lookuptlsfingerprint

removed 25 Sep 2026

whisper_lookuptorrelay

removed 25 Sep 2026

whisper_topasnsbyprefixcount

removed 25 Sep 2026

Endpoints

URL	Transport	State	Latency	Checked
https://whisper.online/mcp	streamable-http	answering	131 ms	10 min ago

Alternatives to Whisper

same job, measured the same way

Aga MCP Server

by attestedintelligence

Verifiable decision records for AI agents: signed receipts for calls to its own governed tools.

120 installs/wk local only

Agishub

by agishub

AgisHub — 34 pay-per-call tools for AI agents over x402 (USDC on Base). No API key, no signup.

21 installs/wk 34 tools answering

Recta

by rectabuild

Cheaper cross-chain stablecoin routes for AI agents; 5 % of the verified saving, nothing if none.

9 tools answering

MimirAPI

by latimer-woods-tech

Pay-per-call agent tools over x402 (USDC on Base) — no signup or API key.

6 tools answering

AgentScout

by agentscouthq

Read-only search over 2,065+ AI agent tools and 276 MCP servers. Free, no sign-up needed.

5 tools answering

AgentBIT

by agentbit

x402 router-proxy + 79 keyless pay-per-call tools on Base. Pay once, we run the best tool.

105 tools answering

Andreax

by moralito311-andr

270 pay-per-call AI tools for agents, paid via x402 (USDC on Base). No signup, no API keys.

298 tools answering

Vynly MCP

by vovala14

Publish AI images & video to Vynly, the AI-only social feed. Verified provenance, no signup.

74 installs/wk local only

Whisper — questions

Answers built from our own checks of this server.

What can Whisper do?

It exposes 41 tools, read directly from the server on our last check. Among them: whisper_agents_agent, whisper_agents_alert, whisper_agents_connect, whisper_agents_detect, whisper_agents_disconnect, whisper_agents_domain and 35 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is Whisper working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 192 ms. The bar chart above shows every period we have measured.

Did Whisper ever remove tools?

Yes. whisper_lookuptlsfingerprint, whisper_lookuptorrelay, whisper_topasnsbyprefixcount are no longer exposed — we recorded the date each one disappeared. A tool vanishing usually means a breaking change for anything that depended on it.

How do I connect Whisper?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does Whisper need an API key?

No. Whisper completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 41 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is Whisper?

It answers our handshake in 192 ms on average, which is faster than 75% of all working MCP servers we measure. That puts it in the quick quarter of the ecosystem. The comparison comes from our own checks across the whole registry, every 15 minutes.

How many people use Whisper?

The npm package @whisper-security/whisper-mcp was installed 519 times in the last week. Week over week that is +557%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.

Is Whisper open source?

The code is open source: it is published under the MIT licence, written in Go, 3 stars on GitHub and 7 open issues. The licence covers the code in the repository, not the hosted service at whisper.online, which runs on its operator's own terms.