WhisperGraph

Describe a single label: confirm it exists, get its node count, and enumerate the property keys observed on that label. Use this BEFORE writing a query that filters on a specific property. If you write WHERE h.fqdn = "..." but describe_label("HOSTNAME") returns properties = ["name", "threatScore", ...], your query will silently scan the entire label. Verify first. Argument: label (string, required) - uppercase letters, digits, and underscores only. Returns: {name, exists, count, properties[], edgesDoc}. Cached 5 minutes. Tip: edge types are NOT in the response - see the whisper://schema/relationships resource for which edges connect this label to others.

Generate typosquatting / brand-protection variants of a domain or brand name and check which ones actually exist in WhisperGraph. Runs 14 mutation algorithms - character omission, repetition, transposition, QWERTY-adjacent replacement/insertion, vowel-swap, bitsquatting, homoglyph / Unicode confusables, hyphenation, dot insertion/omission, TLD-swap, TLD-addition, and subdomain-add. Unicode input is accepted (and expected) so IDN homoglyph lookalikes resolve correctly. Returns { rows: [...] }. Each row: { variant, method, exists, nodeId, label, confidence (0.3-0.9), confidenceLabel (low/medium/high) }. By default only variants that EXIST as nodes are returned - the registered lookalikes worth investigating. Note that "exists" means registered/observed, NOT malicious: pivot each hit through explain_indicator for a threat verdict. Arguments: - name (string, required) - the domain or brand to mutate, e.g. "google.com". Allowed characters: letters (including Unicode), digits, '.', '-', '_'. - label (string, optional, default HOSTNAME) - node label to check existence against. - includeNonExistent (boolean, optional, default false) - when true, also return generated variants that do NOT exist in the graph (larger, noisier result set). Performance: typically <150ms. Results are capped at 500 rows.

Run a comprehensive threat assessment on a single indicator. The indicator can be an IPv4, IPv6, hostname, CIDR network, or ASN - the procedure auto-detects the type. Returns a single structured row: { indicator, type, available, cached, found, score, level (NONE/INFO/LOW/MEDIUM/HIGH/CRITICAL), explanation, factors[], sources[] }. For ASN inputs the row also includes a `breakdown` object with composite sub-scores (threatDensityScore, graphMetricsScore, historicalScore, prefixAgeScore). For CIDR inputs the explanation field carries threat-density stats (listed IPs, density %). Prefer this tool over manual ASN→PREFIX→IP→LISTED_IN walks - those time out on large ASNs (AWS, GCP, Azure, Cloudflare). Performance: 3-25ms for IP/domain/network, up to ~80ms for ASN. Argument: indicator (string, required). Allowed characters: letters, digits, '.', '-', ':', '/', '_'. Cypher-special characters are rejected.

List all node labels in WhisperGraph with their counts. Use this BEFORE writing a query when you're not sure which label to anchor on. It rules out hallucinated labels (e.g. there is no DOMAIN or FQDN - only HOSTNAME) and tells you which labels are large (HOSTNAME, IPV4) vs small (RIR, COUNTRY). Returns: an array of {label, count} rows. Cached server-side for 5 minutes. Tip: pair with describe_label to verify which properties exist on a label before referencing them in WHERE clauses.

List the whisper.security catalog of ready-made recipes - the full set exposed by this server. Two kinds: - `direct` recipes (keyless) are a single graph procedure: whisper.assess (threat posture), whisper.identify (vendor/operator), whisper.explain, whisper.variants (typosquats), whisper.origins (CDN de-cloak), whisper.history / whisper.history.whois (WHOIS timeline), whisper.walk, whisper.psl.*, whisper.asSet, whisper.lookupTorRelay, db.schema. These run WITHOUT an API key (rate-limited). - `flow` recipes (keyed) are curated multi-step investigations: attack-path, attack-surface, indicator-enrichment, infrastructure-mapping, subdomain-takeover, bgp-hijack-exposure, blast-radius, route-health, typosquat, nameserver-hijack-dns-consistency, map-supply-chain-concentration, discover-ai-agent-infrastructure, build-takedown-evidence-package, indicator, anycast-dns-root-sovereignty. These need a WhisperGraph API key. Each entry returns { slug, title, purpose, category, mode, access, requiresKey, inputs[], params[], columns[], docsUrl }. Run any of them with run_recipe(recipe=<slug>, ...). Optional filters: - mode ("direct" | "flow") - access ("keyless" | "keyed") The catalog is generated from the canonical whisper.security catalog, so this list stays in sync with what the platform ships.

Execute a Cypher query against WhisperGraph - the internet's largest infrastructure graph database (7.39B nodes, 39B edges, 5.6M threat intel edges). Returns JSON with columns, rows, and statistics. Use this tool for any question involving domains, hostnames, IPs, DNS, BGP, GeoIP, web links, email infrastructure, WHOIS, DNSSEC, or threat intelligence. NODE LABELS (20): HOSTNAME (2.6B), IPV4 (619M), IPV6 (820K), PREFIX (2.5M), ASN (116K), ASN_NAME (108K), ORGANIZATION (119M), CITY (54K), TLD (1.7K), COUNTRY (424), RIR (5), DNSSEC_ALGORITHM (8), TLD_OPERATOR (737), REGISTRAR (51K), EMAIL (237M), PHONE (60M), REGISTERED_PREFIX (326K, virtual), ANNOUNCED_PREFIX (1.4M, virtual), FEED_SOURCE (40, virtual), CATEGORY (18, virtual). All nodes have a "name" property. Threat-listed IPV4/IPV6/HOSTNAME nodes also carry: threatScore (Double), threatLevel (NONE/INFO/LOW/MEDIUM/HIGH/CRITICAL), threatSources, threatFirstSeen/threatLastSeen (epoch ms), and 13 boolean flags: isThreat, isAnonymizer, isC2, isMalware, isPhishing, isSpam, isBruteforce, isScanner, isBlacklist, isTor, isProxy, isVpn, isWhitelist. ANNOUNCED_PREFIX adds BGP-enrichment: isMoas, isAnycast, isWithdrawn, wasMoas, hasOriginChanged, threatScore, threatLevel, threatSourceCount, firstSeen, lastSeen. LISTED_IN edges carry firstSeen, lastSeen, weight. KEY EDGES: RESOLVES_TO (HOSTNAME→IPV4/IPV6, forward only), CHILD_OF (child→parent: HOSTNAME→HOSTNAME→TLD), ALIAS_OF (CNAME), NAMESERVER_FOR / MAIL_FOR (NS/MX → domain - to list a domain's MX use (domain)<-[:MAIL_FOR]-(mx)), SPF_INCLUDE/SPF_IP/SPF_A/SPF_MX/SPF_EXISTS/SPF_REDIRECT (SPF policy; SPF_IP targets IPV4|IPV6|PREFIX), LINKS_TO (web hyperlinks, 10.8B), BELONGS_TO (3 semantics: IPV4/IPV6→PREFIX, PREFIX→RIR, FEED_SOURCE→CATEGORY), LOCATED_IN (IPV4/IPV6→CITY only - for country, chain through HAS_COUNTRY), HAS_COUNTRY (ASN/CITY/IPV4/HOSTNAME/PHONE/ANNOUNCED_PREFIX/REGISTERED_PREFIX→COUNTRY), ANNOUNCED_BY (IPV4/IPV6→ANNOUNCED_PREFIX, then ROUTES→ASN), ROUTES (ASN/ANN…

Run a named whisper.security catalog recipe by its slug (see list_recipes for the full set). This is the highest-leverage tool for infrastructure & threat questions: instead of hand-writing Cypher, run the curated recipe. Arguments: - recipe (string, required) - the recipe slug, e.g. "assess", "identify", "indicator-enrichment", "infrastructure-mapping", "attack-path", "subdomain-takeover", "typosquat", "bgp-hijack-exposure". - inputs (object, optional) - the recipe's inputs keyed by name (see the recipe's inputs[] in list_recipes). Examples: {"v":"8.8.8.8"} for assess/identify; {"value":"github.com"} for indicator-enrichment / infrastructure-mapping; {"domain":"paypal.com"} for typosquat; {"country":"BR"} for anycast-dns-root-sovereignty; {"value":"paypal.com","other":"paypa1.com"} for attack-path. Omit to use the recipe's built-in example. - params (object, optional) - flow tuning params, e.g. {"level":"deep"} for attack-surface / infrastructure-mapping / attack-path, {"depth":3} for blast-radius, {"instanceType":"Global"} for anycast-dns-root-sovereignty. Behaviour: - `direct` recipes run keyless and return { success, recipe, mode:"direct", columns[], rows[], statistics }. - `flow` recipes need an API key (WHISPER_API_KEY over stdio, or the relayed X-API-Key / Authorization header over HTTP) and return { success, recipe, mode:"flow", steps[], totalLatencyMs } where each step carries { id, title, columns, rows }. - On an unknown slug or a keyless call to a keyed flow, returns { success:false, error, suggestion } - never throws. Prefer run_recipe over hand-written Cypher whenever a recipe fits the question; fall back to the query tool for bespoke traversals.

Retrieve historical WHOIS or BGP data for a single indicator. The indicator can be an IPv4, IPv6, hostname, CIDR, or ASN - the procedure auto-detects the type. Returns shape varies by indicator type: - IP / prefix (type=routing): { origin, prefix, startTime, endTime, peersSeing } - Domain (type=domain): WHOIS snapshots - { queryTime, createDate, updateDate, expiryDate, registrar, nameServers } - ASN (type=asn): prefix announcement history (slow, ~9s for large ASNs) On upstream failure (the data source is rate-limiting or temporarily down), the row shape is: { available: false, error: "timeout" | ..., retryAfter: <seconds> }. Surface the retryAfter to the user - DO NOT loop on retry. Argument: indicator (string, required). Allowed characters: letters, digits, '.', '-', ':', '/', '_'.