Spec Driven Development
MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.
Descripción del creador (original en inglés)
One routable IPv6 per AI agent, verifiable from the DNS root. Keyless tools need no signup.
Estos tres nunca se combinan en una sola puntuación: las opiniones, las mediciones y la popularidad son cosas distintas.
Todavía no escribimos un resumen sencillo para este. Abajo están los datos que leímos del registro.
Elige la app de IA que usas y copia la configuración.
Necesitas
¿Qué app usas?
Elige tu app arriba. La recordamos, así que la próxima vez el botón dirá “Instalar en …”.
Funciona en Claude para web, escritorio y móvil:
https://whisper.online/mcpAbre Claude Desktop → Settings → Developer → Edit Config y pega esto en claude_desktop_config.json
{
"mcpServers": {
"whisper": {
"command": "npx",
"args": [
"-y",
"@whisper-security/whisper-mcp"
]
}
}
}Ejecuta esto en tu terminal
claude mcp add --transport http whisper https://whisper.online/mcpclaude mcp add whisper -- npx -y @whisper-security/whisper-mcpPégalo en .cursor/mcp.json de tu proyecto, o en ~/.cursor/mcp.json
{
"mcpServers": {
"whisper": {
"url": "https://whisper.online/mcp"
}
}
}Pégalo en .cursor/mcp.json de tu proyecto, o en ~/.cursor/mcp.json
{
"mcpServers": {
"whisper": {
"command": "npx",
"args": [
"-y",
"@whisper-security/whisper-mcp"
]
}
}
}Tu navegador te pide permiso para abrir la app; luego la app muestra la configuración y te pide confirmar. Los valores de las claves quedan vacíos para que los completes tú.
Pégalo en .vscode/mcp.json de tu proyecto
{
"servers": {
"whisper": {
"type": "http",
"url": "https://whisper.online/mcp"
}
}
}Pégalo en .vscode/mcp.json de tu proyecto
{
"servers": {
"whisper": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@whisper-security/whisper-mcp"
]
}
}
}Tu navegador te pide permiso para abrir la app; luego la app muestra la configuración y te pide confirmar. Los valores de las claves quedan vacíos para que los completes tú.
ChatGPT solo se conecta a servidores en internet:
https://whisper.online/mcpLos nombres de los menús pueden variar un poco según el plan y con el tiempo.
Tu elección se guarda en una cookie en este dispositivo; no necesitas cuenta.
Esta configuración se genera a partir de la ficha del creador en el registro. Si el README dice otra cosa, sigue el README.
Nombres y descripciones de las herramientas tal como los informó el servidor el 7 nov 2026. Los escribió el creador, no nosotros; los mostramos como texto sin formato.
whisper_signupStart or complete Whisper signup from an email address alone, and receive an API key that unlocks the provisioning and governance skills on this card. Send {"email":"..."} to start; a six-digit code arrives by email; send {"signup_id":"...","code":"123456"} to complete. No human
whisper_verifyIs this IPv6 address or hostname a real Whisper agent, and whose? Grades the full keyless trust chain: the reverse DNS record, the forward AAAA confirming it back to the same address, and the DANE-EE certificate pin published in DNSSEC-signed DNS. Returns is_whisper_agent with th
whisper_rdapThe public registration record for any address in Whisper's space, in RFC 9083 form: the handle, the agent's label, its country, and the entities behind it. The same document the RDAP service serves at /ip/{address}, which any RDAP client can already read. Answers without an API
whisper_identifyIdentify an indicator (domain, IP, hash, …) against the graph. Answers without an API key. Example call: {"skill":"identify","input":"example.com"}
whisper_assessAssess the risk/policy posture of one or more indicators. Answers without an API key. Example call: {"skill":"assess","input":"example.com"}
whisper_walkWalk the graph from an indicator across its relationships. Answers without an API key. Example call: {"skill":"walk","input":"example.com"}
whisper_watchWatch an indicator for change/activity over time. Answers without an API key. Example call: {"skill":"watch","input":{"action":"list"}}
whisper_submitSubmit an observation/claim into the graph. Writes to the graph, so it needs your API key: an anonymous claim would not be attributable. Example call: {"skill":"submit","input":{"host":"example.com","claim":"benign"}} Needs a linked Whisper account (OAuth) or your API key in the
whisper_explainExplain a verdict - the evidence and reasoning behind it. Answers without an API key. Example call: {"skill":"explain","input":"example.com"}
whisper_variantsEnumerate variants/permutations of an indicator. Answers without an API key. Example call: {"skill":"variants","input":"example.com"}
whisper_originsTrace the origins/provenance of an indicator. Answers without an API key. Example call: {"skill":"origins","input":"example.com"}
whisper_historyHistorical records for an indicator (incl. whois/bgp history). Answers without an API key. Example call: {"skill":"history","input":"example.com"}
whisper_lookupTlsFingerprintLook up a TLS (JA3/JA4) fingerprint in the graph. Answers without an API key. Example call: {"skill":"lookupTlsFingerprint","input":"ja3:771,4865-4866-4867"}
whisper_lookupTorRelayLook up Tor relay metadata for an address. Answers without an API key. Example call: {"skill":"lookupTorRelay","input":"185.220.101.1"}
whisper_assetResolve an asset and its catalog of attributes. Answers without an API key. Example call: {"skill":"asset","input":"example.com"}
whisper_threatintelThreat-intelligence indicator family (candidate apex/CDN/hosting). A family verb: name the sub-verb as "sub" alongside the input. Sub-verbs: candidateCdnApex, candidateMultiTenantApex, candidateSharedHostingIp.. Answers without an API key. Example call: {"skill":"threatintel","su
whisper_pslPublic-suffix-list family (tld-plus-one, is-public-suffix, affiliation). A family verb: name the sub-verb as "sub" alongside the input. Sub-verbs: tldPlusOne, isPublicSuffix, affiliation.. Answers without an API key. Example call: {"skill":"psl","sub":"tldPlusOne","input":"a.b.ex
whisper_topAsnsByPrefixCountTop ASNs ranked by announced-prefix count. Answers without an API key. Example call: {"skill":"topAsnsByPrefixCount","input":10}
whisper_agents_agentThe agent operation on the Whisper control plane, served as CALL whisper.agents({op:'agent', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example c
whisper_agents_alertThe alert operation on the Whisper control plane, served as CALL whisper.agents({op:'alert', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.alert","input":{}
whisper_agents_connectThe connect operation on the Whisper control plane, served as CALL whisper.agents({op:'connect', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.connect","inp
whisper_agents_detectThe detect operation on the Whisper control plane, served as CALL whisper.agents({op:'detect', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.detect","input":{}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
whisper_agents_disconnectThe disconnect operation on the Whisper control plane, served as CALL whisper.agents({op:'disconnect', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.disconn
whisper_agents_domainThe domain operation on the Whisper control plane, served as CALL whisper.agents({op:'domain', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.domain","input":{"name":"example.com"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-K
whisper_agents_firewallThe firewall operation on the Whisper control plane, served as CALL whisper.agents({op:'firewall', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Exa
whisper_agents_historyThe history operation on the Whisper control plane, served as CALL whisper.agents({op:'history', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Examp
whisper_agents_hostThe host operation on the Whisper control plane, served as CALL whisper.agents({op:'host', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.host","input":{"name":"my-host","type":"TXT","value":"hello"}} Needs a linked Whisper account (OAuth) or your API
whisper_agents_identityThe identity operation on the Whisper control plane, served as CALL whisper.agents({op:'identity', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.identity","
whisper_agents_listThe list operation on the Whisper control plane, served as CALL whisper.agents({op:'list', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.list","input":{"kind":"agents"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key header.
whisper_agents_logsThe logs operation on the Whisper control plane, served as CALL whisper.agents({op:'logs', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.logs","input":{}} N
whisper_agents_lookupsThe lookups operation on the Whisper control plane, served as CALL whisper.agents({op:'lookups', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.lookups","inp
whisper_agents_partnerThe partner operation on the Whisper control plane, served as CALL whisper.agents({op:'partner', args:{...}}). Requires your Whisper API key. It is gated on partner authority rather than on arguments: without it the call is refused whatever you pass. Example call: {"skill":"agent
whisper_agents_policyThe policy operation on the Whisper control plane, served as CALL whisper.agents({op:'policy', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.policy","input"
whisper_agents_registerThe register operation on the Whisper control plane, served as CALL whisper.agents({op:'register', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.register","input":{"label":"my-first-agent"}} Needs a linked Whisper account (OAuth) or your API key in t
whisper_agents_renameThe rename operation on the Whisper control plane, served as CALL whisper.agents({op:'rename', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example
whisper_agents_resolverThe resolver operation on the Whisper control plane, served as CALL whisper.agents({op:'resolver', args:{...}}). Requires your Whisper API key. With no arguments it describes what you already have, so the example below runs as published. Example call: {"skill":"agents.resolver","
whisper_agents_revokeThe revoke operation on the Whisper control plane, served as CALL whisper.agents({op:'revoke', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example
whisper_agents_taskThe task operation on the Whisper control plane, served as CALL whisper.agents({op:'task', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example cal
whisper_agents_tokenThe token operation on the Whisper control plane, served as CALL whisper.agents({op:'token', args:{...}}). Requires your Whisper API key. The identifier in the example is a placeholder for one of YOUR agents: list them with the "agents.list" skill and {"kind":"agents"}. Example c
whisper_agents_traceThe trace operation on the Whisper control plane, served as CALL whisper.agents({op:'trace', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.trace","input":{"dest":"203.0.113.7"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-Key
whisper_agents_verifyThe verify operation on the Whisper control plane, served as CALL whisper.agents({op:'verify', args:{...}}). Requires your Whisper API key. Example call: {"skill":"agents.verify","input":{"name":"example.com"}} Needs a linked Whisper account (OAuth) or your API key in the X-API-K
Revisamos información que cualquiera puede ver; no hemos leído el código. Las revisiones que no aplican no se cuentan. · Revisado el 7 nov 2026
El nombre en el registro se verificó con la cuenta de GitHub whisper-sec, dueña del repo
Todavía no hemos leído este repo en GitHub
Todavía no hemos leído este repo en GitHub
Respondió en 497 ms (HTTP 200)
No hace falta iniciar sesión
Leímos 41 descripciones de herramientas y no encontramos instrucciones ocultas para la IA
Comparado con todos los servidores activos de esta categoría en el registro. Las estrellas solo cuentan cuando quien lo publica es dueño del repo.
Superó 3 de 3 revisiones básicas aplicables. No hemos leído el código. Antes de agregar una clave o un token, revisa qué acceso pide el servidor y usa una clave que tenga solo los permisos que necesitas.
El registro no indica ninguna clave obligatoria, aunque algunos servidores te piden iniciar sesión la primera vez que los usas.
Funciona de las dos formas: instálalo en tu computadora o conéctate a la versión en la nube.
El repo de GitHub cambió por última vez –, y la última versión (0.256.0) llegó al registro hoy.
Las apps compatibles con MCP, como Claude Desktop, Claude Code, Cursor y VS Code. Se conecta por URL, así que también funcionan las apps que aceptan servidores MCP remotos, como ChatGPT en modo desarrollador.
En la misma categoría: Spec Driven Development, Remote Desktop Commander, Asset Notation
Servidores de la misma categoría hechos por otros creadores, ordenados por estrellas.
Cómo leer una tarjeta:★ Estrellas de GitHubiTres pilares: reseñas · revisiones · usoiActualizado = fecha en que se publicó la última versión en el registroi
MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
Read and maintain an Asset Notation file on disk: net worth, holdings, valuations, CSV import.
Copiado tal cual del repo del creador. PopNx MCP no lo ha revisado ni lo respalda. Se quitaron HTML, imágenes y scripts. Los enlaces llevan fuera de este sitio.
Give your agent a real, routable Whisper IPv6 identity - one command.
whisper is the command-line client for Whisper: a single static binary that gives an agent a real, routable IPv6 /128 on AS219419, wires egress so the agent's traffic sources *from* that address, and verifies it end-to-end. The address *is* the identity - DNSSEC-signed, DANE-pinned, and resolvable in public RDAP. One binary, standard ports, no config to get started.
It is two surfaces over one core: a fully scriptable Cobra CLI, and a full-screen Bubble Tea TUI when you run whisper on a terminal with no subcommand. And it talks to the whisper.security graph: whisper query for raw Cypher, whisper graph for the 29-recipe catalog (below).
No API key and no install. Put this in your client's config and seven tools appear, and every one answers with no key. Add a key, by env var or by whisper login once on the machine, and the same server lists 45:
{
"mcpServers": { "whisper": { "command": "npx", "args": ["-y", "@whisper-security/whisper-mcp"] } } }
Claude Desktop, Claude Code, Cursor, Windsurf, VS Code, Cline and Zed all take the same three lines. Already installed the CLI? whisper mcp is the identical server.
The seven, measured against the server with no key anywhere on the machine:
whisper_verify - is this address or hostname a real agent, and whose? Checks the DANE pin against DNSSEC-signed DNS, from the IANA root.whisper_rdap - the public registration record for any /128.whisper_assess - a verdict on a domain, IP, ASN or file hash, with its evidence.whisper_identify - what an indicator is: category, vendor, band.whisper_explain - the scored explanation behind a verdict, with its sources.read_docs - the whisper.security documentation, listed, searched or fetched page by page.list_workflows - the gallery of ready-made investigations, and what each one takes.Add a key and the same server lists 45: the graph in full, plus registering agents, setting resolver policy, handing out egress configuration, reading per-agent activity and revoking an identity.
https://whisper.online/mcp
Most clients take that URL and nothing else. Claude Code, for one: claude mcp add --transport http whisper https://whisper.online/mcp.
Streamable HTTP. initialize and tools/list answer with no credential, so a client that takes a bare URL needs nothing else. The HTTP transport is a different server from the stdio one above and it lists a different set: 17 tools with no key, every one of which works with no key, and 41 once you send your key as the X-API-Key header (the stdio server's keyed set is the 45 above).
The keyless 17 are the identity checks and the graph: whisper_verify, whisper_rdap, whisper_assess, whisper_identify, whisper_explain, whisper_walk, whisper_watch, whisper_variants, whisper_origins, whisper_history, whisper_asset, whisper_psl, whisper_threatintel, whisper_lookupTlsFingerprint, whisper_lookupTorRelay, whisper_topAsnsByPrefixCount, and whisper_signup, which issues you an API key from an email address alone. The 24 a key adds over HTTP are the provisioning and governance set, 23 of them whisper_agents_* and the 24th whisper_submit, which writes a claim into the graph and so needs to be attributable.
whisper_verify and whisper_rdap check somebody else's agent. whisper_agents_verify in the keyed set verifies a domain you control, which is not the same thing.
Verifying somebody else's agent needs nothing at all, not even the client:
curl -s https://rdap.whisper.online/verify-identity/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478
The one-liner fetches the signed binary straight from this repo's GitHub Releases, verifies its SHA-256 (and its PGP signature when gpg is present), and puts it on your PATH:
curl -fsSL https://get.whisper.online | sh
Windows (PowerShell):
irm https://get.whisper.online/install.ps1 | iex
Homebrew (macOS/Linux):
brew install whisper-sec/tap/whisper
Scoop (Windows):
scoop bucket add whisper https://github.com/whisper-sec/scoop-bucket
scoop install whisper
With Go:
go install github.com/whisper-sec/whisper-cli/cmd/whisper@latest
With mise (GitHub-release backend, no plugin):
mise use -g "github:whisper-sec/whisper-cli[exe=whisper]"
(asdf has no built-in GitHub-release backend, so on asdf use mise, or a community ubi-style plugin.)
On Debian/Ubuntu (apt) - signed repo:
curl -fsSL https://get.whisper.online/whisper.gpg | sudo tee /usr/share/keyrings/whisper.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/whisper.gpg] https://get.whisper.online/deb stable main" | sudo tee /etc/apt/sources.list.d/whisper.list sudo apt update && sudo apt install whisper
On Fedora/RHEL (dnf) - signed repo:
sudo tee /etc/yum.repos.d/whisper.repo >/dev/null <<'EOF'
[whisper] name=Whisper baseurl=https://get.whisper.online/rpm enabled=1 gpgcheck=1 gpgkey=https://get.whisper.online/whisper.gpg EOF sudo dnf install whisper
On Alpine (apk) - signed repo:
wget -qO /etc/apk/keys/whisper-apk.rsa.pub https://get.whisper.online/apk/whisper-apk.rsa.pub
echo "https://get.whisper.online/apk" | sudo tee -a /etc/apk/repositories sudo apk add whisper
All three repos are served from our own infrastructure (AS219419) and signed with the Whisper package key (get.whisper.online/whisper.gpg; the apk repo uses its own whisper-apk.rsa.pub).
Or download the binary for your platform from the Releases page, make it executable, and put it on your PATH.
The installers (
scripts/install.sh,scripts/install.ps1) are published here so the
whole install path is inspectable. They are the same scripts
get.whisper.onlineserves,
differing only in where they download from by default: these fetch
whisper- -(plus.sha256and.asc) from this repo's releases, the served
copy fetches the same binaries from
cli.whisper.online/dl. Either way SHA-256 is a hard
gate - a mismatch aborts the install - and the PGP check is an extra layer. Point
WHISPER_CLI_BASEat any mirror to override the source.
Releases are signed with the AS219419 PGP key:
Fingerprint: EFF1663D992539682106A5EAD0F70908CF3B7929
The public key is published at https://as219419.net/. To verify a binary you downloaded manually:
# 1. SHA-256 - compare against the asset's .sha256 (and the release checksums.txt)
sha256sum -c whisper-linux-amd64.sha256
curl -fsSL https://as219419.net/whisper-release.asc | gpg --import gpg --verify whisper-linux-amd64.asc whisper-linux-amd64
A good signature reports Good signature from the key with the fingerprint above.
Run whisper with no arguments for the guided flow. It signs you in (browser device login or a pasted API key), helps you name and create an agent if you don't have one, then connects and verifies:
$ whisper
whisper: signed in. whisper: name your agent: my-first-agent whisper: created my-first-agent → 2a04:2a01:…::1 whisper: connecting… 2a04:2a01:…::1 ✓ egress verified Connected ✓
Naming is mandatory - an agent's name is part of its identity, so the flow asks before it creates one. The same steps are scriptable:
whisper connect # bring up egress bound to your /128 (Tier-1.5 SOCKS5/HTTPS)
whisper connect --tier wireguard # Tier-1: routed /128 over a userspace WireGuard tunnel (no root) whisper ip # print your egress IP and verify it IS your /128 (exit 0 = verified) whisper run -- curl ifconfig.co # run any command with your Whisper egress wired in whisper claude # run Claude Code through your Whisper egress, one step whisper init claude # wire THIS project so Claude Code always egresses from its own /128 whisper use my-agent # choose the agent the rest of whisper binds to whisper status # key state, selected agent, connection state
whisper ip is exit-code-first: 0 when the observed egress address is inside 2a04:2a01::/32 *and* equals your selected agent's /128, 1 otherwise - so scripts and agents can gate on it. Add --json to any command for the raw, scriptable envelope.
Per-project agent identity for Claude Code. whisper init claude makes a project zero-config: run it once in a directory and Claude Code there - and every subagent it spawns - egresses from that project's own /128, over SOCKS5 (default) or --tier wireguard. It pins the project's agent + tier in .whisper/config, wires a local proxy into .claude/settings.local.json (merge-safe - it never clobbers your settings), and keeps the connection up via a small auto-reconnecting daemon. Different projects, different identities, nothing to remember. Pass --agent to reuse an existing agent or --name to mint one.
Other useful commands: whisper list, whisper logs, whisper policy, whisper rdap , whisper verify , whisper query , whisper graph , whisper login, whisper dash (the full-screen dashboard), whisper config. Run whisper --help for details.
The same whisper.security graph the Whisper resolver consults on every lookup - 6.9B nodes (hostnames, IPs, ASNs, certs, threat intel), 50.0B relationships - is a first-class CLI surface. whisper query runs raw parameterised Cypher; whisper graph runs a named recipe from the embedded catalog:
whisper query "CALL whisper.identify(['api.openai.com'])" # who operates this host?
whisper query 'CALL whisper.assess([$v])' --param v=8.8.8.8 # threat posture, one row per host whisper graph list # all 29 recipes, each with its docs URL whisper graph variants paypal.com # registered typosquat look-alikes, one table whisper graph typosquat paypal.com # the full brand-impersonation flow (streams NDJSON)
Direct recipes answer with one result table (--json emits the raw {columns,rows,statistics} envelope); flow recipes stream their steps as NDJSON - pipe them to jq. Every recipe documents itself: whisper graph --help.
query and graph authenticate with your API key (whisper login, WHISPER_API_KEY, or --key). The graph endpoint itself is two-tier: the direct read verbs (whisper.identify, whisper.assess, whisper.variants, whisper.explain, db.schema, ...) also answer keyless and rate-limited - no account needed:
curl -s https://graph.whisper.online/api/query \
-H 'content-type: application/json' \ -d '{"query":"CALL whisper.assess([\"8.8.8.8\"])"}'
A key lifts the rate limit and unlocks raw Cypher and the multi-step flows. The same tools ride the MCP server (whisper mcp): whisper_graph_query plus one tool per recipe. Docs: www.whisper.security/docs - the raw Cypher API at /docs/cypher-api, per-verb pages under /docs/whisper-graph.
Your agent's /128 carries a per-agent EC P-256 key, pinned in DNSSEC-signed DNS - so it can sign a document as itself and anyone can verify it with no account and no certificate authority. Trust is anchored by DANE, not a C
Solo se muestra el principio; lee el resto en el repo