Whisper Graph MCP Server

Open-source MCP server for WhisperGraph - query the internet's infrastructure & threat-intel graph (DNS, BGP, GeoIP, WHOIS) via Cypher.

Remote serverstreamable-http

What is the Whisper Graph MCP MCP server?

Whisper Graph MCP MCP server exists for a simple reason — assistants are far more useful when they can act on Whisper Graph MCP directly instead of describing what you should do. Open-source MCP server for WhisperGraph - query the internet's infrastructure & threat-intel graph (DNS, BGP, GeoIP, WHOIS) via Cypher.

What you get

The internet's infrastructure graph for AI agents - 46B nodes and edges mapping DNS, IPs, ASNs, BGP, WHOIS, Web links and threat intel. Sign up programmatically in 2 HTTP calls.

What the assistant can call

Once Whisper Graph MCP is connected, these are the calls the assistant has available:

  • query — Execute a Cypher query against WhisperGraph. Validated against a safety rule set before it reaches the backend
  • list_labels — List every node label with counts. Call it before writing a query when you're unsure which label to anchor on
  • describe_label — Confirm a label exists and enumerate its property keys
  • explain_indicator — Threat assessment for an IP, hostname, CIDR, or ASN - score, level, factors, sources
  • whisper_history — Historical WHOIS or BGP data for an indicator
  • domain_variants — Typosquatting / brand-protection variants of a domain, checked against the graph
  • list_recipes — List the full whisper.security catalog of ready-made recipes (see below)
  • run_recipe — Run any catalog recipe by slug - a keyless direct procedure or a keyed multi-step flow
  • Resources — Six MCP resources: the full schema, the relationship map, a Cypher function reference, a query cookbook, plus live whisper://stats and
  • Prompts — Eight investigation-workflow prompt templates: investigate-ip, map-attack-surface, compare-domains, blast-radius, threat-triage, whois-pivot

Configuration and credentials

You will need 3 environment variables: WHISPER_API_KEY, HTTP_HOST, WHISPER_DB_URL. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.

Setting it up

Being a remote server, there is no local install. You register the endpoint with your client, authorise it once, and the tools appear.

Choosing this one

Among the AI and media services options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Whisper Graph MCP's toolset — query, list_labels, describe_label and 7 more — is a fair guide to whether it matches your workflow. It is maintained by whisper-sec; worth a glance at recent repository activity before you build anything load-bearing on it.

SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.

Before you rely on it

  • Your data travels to the provider's service, so the usual questions apply about what you send and what they retain.
  • With 10 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Whisper Graph MCP.
  • Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
  • MCP clients confirm each tool call by default. Leave that on until you have watched what the whisper graph mcp mcp server does with a few real requests.

Available tools

ToolWhat it does
queryExecute a Cypher query against WhisperGraph. Validated against a safety rule set before it reaches the backend.
list_labelsList every node label with counts. Call it before writing a query when you're unsure which label to anchor on.
describe_labelConfirm a label exists and enumerate its property keys.
explain_indicatorThreat assessment for an IP, hostname, CIDR, or ASN - score, level, factors, sources.
whisper_historyHistorical WHOIS or BGP data for an indicator.
domain_variantsTyposquatting / brand-protection variants of a domain, checked against the graph.
list_recipesList the full whisper.security catalog of ready-made recipes (see below).
run_recipeRun any catalog recipe by slug - a keyless direct procedure or a keyed multi-step flow.
ResourcesSix MCP resources: the full schema, the relationship map, a Cypher function reference, a query cookbook, plus live whisper://stats and whisper://quota.
PromptsEight investigation-workflow prompt templates: investigate-ip, map-attack-surface, compare-domains, blast-radius, threat-triage, whois-pivot, bgp-investigation, typosquat-sweep.

How to install the Whisper Graph MCP MCP server

{
  "mcpServers": {
    "whisper": {
      "url": "https://mcp.whisper.security",
      "headers": { "Authorization": "Bearer <your_api_key>" }
    }
  }
}

Configuration as documented by the project. Restart the client after saving.

Configuration

VariableDescriptionRequired
WHISPER_API_KEYCredential the server authenticates with.Yes
HTTP_HOSTEndpoint or connection string the server talks to.Optional
WHISPER_DB_URLEndpoint or connection string the server talks to.Yes

Example prompts to try

  • Use Whisper Graph MCP to query.
  • Use Whisper Graph MCP to list labels.
  • Use Whisper Graph MCP to describe label.

Frequently asked questions

It connects Whisper Graph MCP to MCP-compatible AI assistants such as Claude and Cursor, exposing 10 tools (query, list_labels, describe_label, and more) that the assistant can call on your behalf. Instead of copying data back and forth by hand, the assistant works with Whisper Graph MCP directly.