WhisperGraph

Official

by whisper-sec

Overview Schema Related Servers Score Discussions

TypeScript

Remote

Server Quality Checklist

Profile completionA complete profile improves this server's visibility in search results.

Latest release: v0.2.0
Disambiguation5/5
Each tool has a clearly distinct purpose: schema inspection, typosquatting, threat assessment, label listing, recipe listing, general querying, recipe execution, and historical data retrieval. No overlap or ambiguity.
Naming Consistency3/5
Most tools use a verb_noun pattern (describe_label, list_labels, run_recipe), but domain_variants and whisper_history start with nouns, breaking consistency. Overall pattern is still readable but not uniform.
Tool Count5/5
8 tools is well-scoped for a graph intelligence server, covering essential operations without bloat or deficiency.
Completeness5/5
The tool set covers schema exploration, query execution, domain-specific analysis (typosquatting, threat assessment, historical data), and curated recipe execution. No obvious gaps for the stated purpose of infrastructure and threat intelligence analysis.
Average 4.7/5 across 8 of 8 tools scored.
See the Tool Scores section below for per-tool breakdowns.
- 2 of 8 community issues answered or closed in the last 6 months
- 3 commits in the last 12 weeks
- Last stable release on July 19, 2026
- No critical vulnerability alerts
- No high-severity vulnerability alerts
- No code scanning findings
- CI is failing
This repository is licensed under Apache 2.0.
This repository includes a README.md file.
No tool usage detected in the last 30 days. Usage tracking helps demonstrate server value.
Tip: use the "Try in Browser" feature on the server page to seed initial usage.
This repository includes a glama.json configuration file.
If you are the author, simply .
If the server belongs to an organization, first add glama.json to the root of your repository:
```
{
  "$schema": "https://glama.ai/mcp/schemas/server.json",
  "maintainers": [
    "your-github-username"
  ]
}
```
Then . Browse examples.
View related servers

How to sync the server with GitHub?

Servers are automatically synced at least once per day, but you can also sync manually at any time to instantly update the server profile.

To manually sync the server, click the "Sync Server" button in the MCP server admin interface.

How is the quality score calculated?

The overall quality score combines two components: Tool Definition Quality (70%) and Server Coherence (30%).

Tool Definition Quality measures how well each tool describes itself to AI agents. Every tool is scored 1–5 across six dimensions: Purpose Clarity (25%), Usage Guidelines (20%), Behavioral Transparency (20%), Parameter Semantics (15%), Conciseness & Structure (10%), and Contextual Completeness (10%). The server-level definition quality score is calculated as 60% mean TDQS + 40% minimum TDQS, so a single poorly described tool pulls the score down.

Server Coherence evaluates how well the tools work together as a set, scoring four dimensions equally: Disambiguation (can agents tell tools apart?), Naming Consistency, Tool Count Appropriateness, and Completeness (are there gaps in the tool surface?).

Tiers are derived from the overall score: A (≥3.5), B (≥3.0), C (≥2.0), D (≥1.0), F (<1.0). B and above is considered passing.

Tool Scores

Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide readOnlyHint, destructiveHint=false. Description adds beyond that: confirms caching for 5 minutes, output format as array of {label, count} rows. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences: what, when, output+tip. Front-loaded with purpose. Every sentence adds value. No redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No parameters, output schema exists. Description covers return format, caching, and usage tip. Fully informative for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters; baseline 4 applies. Description doesn't need to add parameter detail since none exist. Schema coverage is 100% irrelevant here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'List all node labels in WhisperGraph with their counts' - a specific verb+resource+scope. It distinguishes from sibling tools by explaining its use case: 'Use this BEFORE writing a query when you're not sure which label to anchor on.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly advises when to use: before writing a query when unsure of label. It explains benefits: avoids hallucinated labels, reveals label sizes. Tips to pair with describe_label provides context. Doesn't explicitly state when not to use, but guidance is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds value beyond annotations: performance timings, result caps, default behavior (existent-only), and clarifies that 'exists' does not imply malicious intent. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured and informative, but slightly verbose with algorithm list. Could be more concise without losing essential details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (14 algorithms), the description covers purpose, algorithms, output schema, parameters, performance, and sibling tool recommendation. Very complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers all parameters fully (100%). Description adds allowed characters, default values, and behavioral implications (e.g., includeNonExistent noisiness), enhancing beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool generates typosquatting/brand-protection variants and checks existence, distinguishing it from siblings like query or explain_indicator.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit context for use (brand-protection, threat investigation) and suggests pivoting to explain_indicator, but lacks explicit when-not-to-use or comparison to alternative tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true. The description adds behavioral context: it's a listing operation, non-destructive, and mentions rate limits for keyless recipes. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections (two kinds, filters, usage). While slightly lengthy, every sentence provides value, and it's front-loaded with the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (two recipe types, filters, linking to run_recipe), the description is comprehensive. Output schema exists, so return values are not needed. Covers all necessary context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions and enums for both parameters. The description adds meaning by linking mode and access filters to the two recipe categories (direct/flow, keyless/keyed), enhancing understanding beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists recipes from the WhisperGraph catalog, distinguishes between 'direct' and 'flow' recipes, and uses specific verbs. It differentiates from sibling tools like run_recipe.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit context for when to use this tool (e.g., to list available recipes) and mentions optional filters. It indirectly points to run_recipe for execution, offering some guidance on alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnlyHint, idempotentHint, destructiveHint), the description discloses caching behavior ('Cached 5 minutes') and limitations ('edge types are NOT in the response'). This adds significant context for an agent to understand freshness and completeness.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (around 150 words), well-structured with clear sections, and every sentence adds value. The tip at the end is a useful, non-redundant addition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity and the presence of an output schema, the description covers all necessary aspects: what it does, when to use, caching, limitations, and parameter constraints. It feels complete for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with the input schema already describing the label format (uppercase, digits, underscores, examples). The description repeats this but adds no new meaning, meeting the baseline for high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Describe a single label: confirm it exists, get its node count, and enumerate the property keys observed on that label.' This specific verb-resource combination distinguishes it from siblings like list_labels, which lists labels without details.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines5/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly advises using this tool 'BEFORE writing a query that filters on a specific property' and warns against silent scans if properties are not verified. It also points to the schema resource for edge types, providing clear guidance on when and how to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description discloses auto-detection of indicator type, output structure including conditional fields for ASN and CIDR, and allowed character constraints. This adds significant detail beyond annotations (readOnly, idempotent, non-destructive). No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is well-organized with clear sections: purpose, output format, special cases, usage advice, performance, and argument details. No superfluous sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (handles multiple indicator types, conditional output), the description covers all relevant aspects: purpose, input, output, edge cases, and performance. Output schema exists, so return values are adequately described.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While the input schema provides examples, the description adds auto-detection of type and allowed characters, which are not present in schema. Schema coverage is 100%, so description enhances but is not essential.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Run a comprehensive threat assessment on a single indicator.' It specifies acceptable indicator types and auto-detection. It differentiates from siblings by focusing on threat assessment for indicators, contrasting with other tools like 'describe_label'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description advises to prefer this tool over manual ASN-to-IP walks, and provides performance timings. It implies when to use (threat assessment on indicators) but lacks explicit when-not-to-use or direct sibling comparisons.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only (readOnlyHint=true, destructiveHint=false). The description adds rich behavioral context: graph schema, node/edge details, traversal patterns, query rules, example queries, and caveats (e.g., SIGNED_WITH returns 0 rows). This far exceeds what annotations alone provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is lengthy but well-structured with clear sections (NODE LABELS, KEY EDGES, etc.) and front-loaded purpose. Every part earns its place given the tool's complexity, though some details (e.g., full documentation URLs) could be slightly trimmed without loss.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (7.39B nodes, 39B edges, numerous node/edge types), the description is comprehensive. It covers node labels, edges, traversal chains, rules, procedures, examples, and documentation links. Output format is described as 'JSON with columns, rows, and statistics', which is sufficient for a Cypher query tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single 'cypher' parameter benefits from an immensely detailed description that explains the graph structure, supported patterns, and constraints. The schema's brief description is supplemented by the full tool description, enabling the agent to construct correct queries.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Execute a Cypher query against WhisperGraph' and provides a comprehensive scope (domains, IPs, DNS, etc.). It clearly distinguishes this general query tool from sibling tools like 'explain_indicator' and 'whisper_history' by listing specific use cases.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives extensive guidance on when to use the tool (any question involving the listed domains) and includes query rules (LIMIT, indexed properties, avoid direct FEED_SOURCE scans) and traversal chains. However, it does not explicitly contrast with sibling tools, leaving the agent to infer when to use alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description goes beyond annotations by detailing return shapes per indicator type, upstream failure behavior (available: false, retryAfter), and explicitly instructing not to loop on retry. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-organized into logical sections (indicator types, return shapes, failure mode) with no wasted words. It is front-loaded with the core action and then expands with necessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (multiple indicator types, varying return shapes, performance caveats, failure handling), the description covers all essential aspects. Output schema exists, so return values are documented.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds extra meaning by giving examples, allowed characters, and explaining auto-detection. This compensates for any missing schema detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it retrieves historical WHOIS or BGP data for a single indicator, specifying auto-detection of indicator types (IPv4, IPv6, hostname, CIDR, ASN). This distinguishes it from sibling tools like explain_indicator or query.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides usage context (e.g., ASN queries are slow) and examples of allowed indicators. However, it does not explicitly state when to use this tool vs alternatives, nor does it provide when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Details direct vs flow recipe behavior, error handling, and output format. Annotations (readOnlyHint, etc.) are consistent and the description adds significant context beyond them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear sections (arguments, behaviour). A bit verbose in places but every sentence adds value; could be slightly tighter but no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool complexity (3 params, nested objects, output schema), the description covers all necessary aspects: argument details, behavior modes, error handling, and usage advice.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but description adds concrete examples for each parameter (e.g., inputs, params) and explains the distinction between them, greatly aiding usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Run a named whisper.security catalog recipe by its slug' and contrasts with hand-writing Cypher and using the query tool, distinguishing it from siblings like 'query'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines5/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit guidance: 'Prefer run_recipe over hand-written Cypher whenever a recipe fits the question; fall back to the query tool for bespoke traversals.' Also notes key requirements for flow recipes.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

GitHub Badge

Glama performs regular codebase and documentation scans to:

Confirm that the MCP server is working as expected.
Confirm that there are no obvious security issues.
Evaluate tool definition quality.

Our badge communicates server capabilities, safety, and installation instructions.

Card Badge

Copy to your README.md:

[![whisper-graph-mcp MCP server](https://glama.ai/mcp/servers/whisper-sec/whisper-graph-mcp/badges/card.svg)](https://glama.ai/mcp/servers/whisper-sec/whisper-graph-mcp)

Score Badge

Copy to your README.md:

[![whisper-graph-mcp MCP server](https://glama.ai/mcp/servers/whisper-sec/whisper-graph-mcp/badges/score.svg)](https://glama.ai/mcp/servers/whisper-sec/whisper-graph-mcp)

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/whisper-sec/whisper-graph-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server