`, `whisper verify

`, `whisper query `, `whisper graph\n`, `whisper login`, `whisper dash` (the full-screen dashboard), `whisper config`.\nRun `whisper --help` for details.\n\n---\n\n## Query the security graph\n\nThe same [whisper.security](https://www.whisper.security) graph the Whisper resolver\nconsults on every lookup - 7.4B nodes (hostnames, IPs, ASNs, certs, threat intel), 39B\nrelationships - is a first-class CLI surface. `whisper query` runs raw parameterised\nCypher; `whisper graph` runs a named recipe from the embedded catalog:\n\n```sh\nwhisper query \"CALL whisper.identify(['api.openai.com'])\" # who operates this host?\nwhisper query 'CALL whisper.assess([$v])' --param v=8.8.8.8 # threat posture, one row per host\nwhisper graph list # all 29 recipes, each with its docs URL\nwhisper graph variants paypal.com # registered typosquat look-alikes, one table\nwhisper graph typosquat paypal.com # the full brand-impersonation flow (streams NDJSON)\n```\n\nDirect recipes answer with one result table (`--json` emits the raw\n`{columns,rows,statistics}` envelope); flow recipes stream their steps as NDJSON - pipe\nthem to `jq`. Every recipe documents itself: `whisper graph --help`.\n\n`query` and `graph` authenticate with your API key (`whisper login`, `WHISPER_API_KEY`,\nor `--key`). The graph endpoint itself is two-tier: the direct read verbs\n(`whisper.identify`, `whisper.assess`, `whisper.variants`, `whisper.explain`,\n`db.schema`, ...) also answer keyless and rate-limited - no account needed:\n\n```sh\ncurl -s https://graph.whisper.online/api/query \\\n -H 'content-type: application/json' \\\n -d '{\"query\":\"CALL whisper.assess([\\\"8.8.8.8\\\"])\"}'\n```\n\nA key lifts the rate limit and unlocks raw Cypher and the multi-step flows. The same\ntools ride the MCP server (`whisper mcp`): `whisper_graph_query` plus one tool per\nrecipe. Docs: [www.whisper.security/docs](https://www.whisper.security/docs) - the raw\nCypher API at [/docs/cypher-api](https://www.whisper.security/docs/cypher-api), per-verb\npages under `/docs/whisper-graph`.\n\n---\n\n## Sign, verify & encrypt as your agent\n\nYour agent's `/128` carries a per-agent EC P-256 key, pinned in DNSSEC-signed DNS - so it can **sign** a document as itself and anyone can **verify** it with no account and no certificate authority. Trust is anchored by DANE, not a CA you have to install.\n\n```bash\n# Sign any file, PDF or email as your agent -> a detached S/MIME (.p7s):\nwhisper sign file contract.pdf\n\n# Verify with NO key: checks the CMS signature AND that the signer's key matches the\n# DNSSEC-validated SMIMEA (RFC 8162) pin for the signer - resolved from the IANA root, in-process:\nwhisper sign verify contract.pdf --sig contract.pdf.p7s\n\n# Encrypt a file so ONLY the named agent can read it (keyless), then decrypt as that agent (keyed):\nwhisper encrypt --to agent@a1b2c3.agents.whisper.online secret.txt # -> secret.txt.wenc\nwhisper decrypt secret.txt.wenc\n```\n\nThe **per-agent verification key** a stranger resolves is the agent's DANE `TLSA 3 1 1` (and, for signatures, its `SMIMEA 3 1 1`) - both DNSSEC-signed and checkable with `dig` + `openssl`, no Whisper account. Full guide, including the byte-exact signature envelope: .\n\n## What you get\n\n- **A real, routable `/128`** out of `2a04:2a01::/32`, announced by **AS219419** - your\n own internet address, not a shared NAT pool.\n- **Identity that's verifiable from the outside.** Forward DNS is DNSSEC-signed and\n DANE-pinned; reverse DNS (`ip6.arpa` PTR) resolves to the agent; the assignment is\n visible in public RDAP at [rdap.whisper.online](https://rdap.whisper.online).\n- **Egress that binds your identity.** `whisper connect` provisions a local proxy whose\n traffic sources *from* your `/128`; `whisper ip` proves the source address is yours,\n node-free and with no third party in the loop. `--tier wireguard` brings the `/128` up\n as a **routed** address over a userspace WireGuard tunnel (wireguard-go netstack - still\n no root, no kernel `wg`, no TUN device), fronted by the same local proxy so tools need\n no change.\n- **One binary, zero config.** Static, CGO-free, with an embedded CA bundle - it runs on\n a bare host or a stripped container and just works.\n\n---\n\n## Use it from your code\n\nSame identity + egress from your language of choice - thin wrappers over this CLI:\n\n**Python** - `pip install whisper-id`\n\n```python\nfrom whisper_id import register, egress\nagent = register(\"my-bot\") # a routable /128\nwith egress(): # this block leaves from your /128\n requests.get(\"https://api64.ipify.org\")\n```\n\n**Node** - `npm i whisper-id`\n\n```js\nimport { register, withEgress } from \"whisper-id\";\nconst agent = await register(\"my-bot\");\nawait withEgress(async () => { /* env-aware clients leave from your /128 */ });\n```\n\n## Run it in a container\n\nThe official image runs the CLI as an egress sidecar so any container leaves from your `/128`:\n\n```sh\ndocker run --rm ghcr.io/whisper-sec/whisper:latest --version\n```\n\n`whisper init compose` and `whisper init k8s` emit a ready-to-merge sidecar manifest.\nMulti-arch (amd64/arm64), distroless, ~18 MB.\n\n---\n\n## Build from source\n\nRequires Go 1.25+.\n\n```sh\ngit clone https://github.com/whisper-sec/whisper-cli\ncd whisper-cli\ngo build -o whisper ./cmd/whisper\n./whisper --version\n```\n\nCross-compile every supported platform into `dist/` (binaries + `.sha256`, named exactly\nas the release assets):\n\n```sh\n./build-all.sh # → dist/whisper--[.exe] + .sha256\n./build-all.sh dist v1.0.0 # stamp a version into `whisper --version`\n```\n\n`platforms.txt` is the single source of truth for the target matrix - shared by\n`build-all.sh` and the installers.\n\n### Source here, binaries there\n\nThis repository is the Whisper **client**: identity, egress, connect, verify, the\nsecurity-graph surface and the TUI. It is MIT, and what you build from it is that client.\n\nThe published binaries are not only that. `whisper` also carries Whisper's **endpoint\nsensor** - the `service`, `sensor` and `posture` commands - and the sensor is not open\nsource today. It ships as a binary and its sources stay closed, so a binary from a release,\nfrom `curl -fsSL https://get.whisper.online | sh`, or from apt, dnf, apk, brew or scoop has those\ncommands. Anything BUILT from this tree does not: `go install`, a local `go build`, and the\nsnap, which snapcraft builds from source.\n\nTwo consequences worth stating plainly. The MIT licence covers the source in this\nrepository, not the additional closed component in the published binaries. And if you\nwant the endpoint sensor, install a released binary rather than building from source.\n\n### Platforms\n\n| OS \\ Arch | amd64 | arm64 | arm | riscv64 | mips | mipsle | 386 |\n|-----------|:-----:|:-----:|:---:|:-------:|:----:|:------:|:---:|\n| linux | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| darwin | ✓ | ✓ | | | | | |\n| windows | ✓ | ✓ | | | | | |\n\n`linux-arm` is 32-bit ARMv7. Every target is a static, CGO-free build, and every one is\nsigned with the AS219419 release key.\n\n---\n\n## Links\n\n- **Whisper** - [whisper.online](https://whisper.online)\n- **Docs (graph procedures, recipes, the Cypher API)** - [www.whisper.security/docs](https://www.whisper.security/docs)\n- **Registry / NIC** - [nic.whisper.online](https://nic.whisper.online)\n- **RDAP** - [rdap.whisper.online](https://rdap.whisper.online)\n- **AS219419** (release-signing key, network info) - [as219419.net](https://as219419.net)\n\n---\n\n## Contributing\n\nIssues and pull requests are welcome - see [CONTRIBUTING.md](https://github.com/whisper-sec/whisper-cli/blob/main/CONTRIBUTING.md). Run\n`go build ./...`, `go vet ./...`, `go test ./...`, and `gofmt -l .` before opening a PR.\n\nTo report a security issue, see [SECURITY.md](https://github.com/whisper-sec/whisper-cli/blob/main/SECURITY.md).\n\n---\n\n## License\n\n[MIT](https://github.com/whisper-sec/whisper-cli/blob/main/LICENSE) © 2026 viaGraph B.V. (Whisper Security) - for the source in this\nrepository. The published binaries additionally contain the closed-source endpoint\nsensor; see [Source here, binaries there](#source-here-binaries-there).\n\nThe embedded Mozilla CA certificate list\n(`internal/client/cabundle/mozilla-cacert.pem`) is distributed under the Mozilla Public\nLicense 2.0.\n","changelogMarkdown","videoKey","requiredSecretsJson","publishedAt",1790258999000,"priceCents","trialDays","iconType","image","upstream",{"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126},"requiredSecrets",[],"tags",[103,104,105,106,107,108,109,110,111,112,113,114],"assets",[],"stats",{"_101":45,"_102":45},"ratingAvg","reviewCount","agent-identity","ai-agents","cli","dane","dns","dnssec","egress","golang","ipv6","rdap","security","static-ip","topics",[103,104,105,106,107,108,109,110,111,136,137,112,113,114],"license","MIT","language","Go","registryName","io.github.whisper-sec/whisper","homepage","https://whisper.online","packages",[127,128],{"_129":133,"_131":134,"_78":135},{"_129":130,"_131":132,"_78":-5},"registryType","oci","identifier","ghcr.io/whisper-sec/whisper:0.219.2","npm","@whisper-security/whisper-mcp","0.219.3","mcp","model-context-protocol","ENV",{"_140":141,"_142":143,"_144":145,"_146":-7},"ENVIRONMENT","production","TURNSTILE_SITE_KEY","0x4AAAAAAB8-rEI2gNDf_QhU","SENTRY_DSN","https://45fd1229f78089d5c3ee78be128030e1@o4510583261757440.ingest.de.sentry.io/4510584253448272","SENTRY_ENABLE_LOCAL"]