Open-source MCP server for WhisperGraph - query the internet's infrastructure & threat-intel graph (DNS, BGP, GeoIP, WHOIS) via Cypher.
Whisper Graph MCP MCP server exists for a simple reason — assistants are far more useful when they can act on Whisper Graph MCP directly instead of describing what you should do. Open-source MCP server for WhisperGraph - query the internet's infrastructure & threat-intel graph (DNS, BGP, GeoIP, WHOIS) via Cypher.
The internet's infrastructure graph for AI agents - 46B nodes and edges mapping DNS, IPs, ASNs, BGP, WHOIS, Web links and threat intel. Sign up programmatically in 2 HTTP calls.
Once Whisper Graph MCP is connected, these are the calls the assistant has available:
query — Execute a Cypher query against WhisperGraph. Validated against a safety rule set before it reaches the backendlist_labels — List every node label with counts. Call it before writing a query when you're unsure which label to anchor ondescribe_label — Confirm a label exists and enumerate its property keysexplain_indicator — Threat assessment for an IP, hostname, CIDR, or ASN - score, level, factors, sourceswhisper_history — Historical WHOIS or BGP data for an indicatordomain_variants — Typosquatting / brand-protection variants of a domain, checked against the graphlist_recipes — List the full whisper.security catalog of ready-made recipes (see below)run_recipe — Run any catalog recipe by slug - a keyless direct procedure or a keyed multi-step flowResources — Six MCP resources: the full schema, the relationship map, a Cypher function reference, a query cookbook, plus live whisper://stats andPrompts — Eight investigation-workflow prompt templates: investigate-ip, map-attack-surface, compare-domains, blast-radius, threat-triage, whois-pivotYou will need 3 environment variables: WHISPER_API_KEY, HTTP_HOST, WHISPER_DB_URL. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.
Being a remote server, there is no local install. You register the endpoint with your client, authorise it once, and the tools appear.
Among the AI and media services options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Whisper Graph MCP's toolset — query, list_labels, describe_label and 7 more — is a fair guide to whether it matches your workflow. It is maintained by whisper-sec; worth a glance at recent repository activity before you build anything load-bearing on it.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
| Tool | What it does |
|---|---|
| query | Execute a Cypher query against WhisperGraph. Validated against a safety rule set before it reaches the backend. |
| list_labels | List every node label with counts. Call it before writing a query when you're unsure which label to anchor on. |
| describe_label | Confirm a label exists and enumerate its property keys. |
| explain_indicator | Threat assessment for an IP, hostname, CIDR, or ASN - score, level, factors, sources. |
| whisper_history | Historical WHOIS or BGP data for an indicator. |
| domain_variants | Typosquatting / brand-protection variants of a domain, checked against the graph. |
| list_recipes | List the full whisper.security catalog of ready-made recipes (see below). |
| run_recipe | Run any catalog recipe by slug - a keyless direct procedure or a keyed multi-step flow. |
| Resources | Six MCP resources: the full schema, the relationship map, a Cypher function reference, a query cookbook, plus live whisper://stats and whisper://quota. |
| Prompts | Eight investigation-workflow prompt templates: investigate-ip, map-attack-surface, compare-domains, blast-radius, threat-triage, whois-pivot, bgp-investigation, typosquat-sweep. |
{
"mcpServers": {
"whisper": {
"url": "https://mcp.whisper.security",
"headers": { "Authorization": "Bearer <your_api_key>" }
}
}
}Configuration as documented by the project. Restart the client after saving.
| Variable | Description | Required |
|---|---|---|
| WHISPER_API_KEY | Credential the server authenticates with. | Yes |
| HTTP_HOST | Endpoint or connection string the server talks to. | Optional |
| WHISPER_DB_URL | Endpoint or connection string the server talks to. | Yes |
Build a programmable telecommunications stack for connecting telephony services with the Internet via a cloud-based utility.
Search built for AI, not humans — semantic web search that returns model-ready content, plus code context.
Answers, not links — delegate questions to Perplexity's search-grounded models and get cited responses back.
Give your assistant a voice — text-to-speech, voice cloning and audio tools from the ElevenLabs API.
Give your assistant a real code sandbox — isolated cloud VMs for actually running the code it writes.
The ML hub in your context window — search models, datasets, papers and run Spaces from the official server.