whisper-bulk-triage

WhisperGraph bulk indicator triage — score a list of hostnames, IPs, ASNs, CIDRs or prefixes in one pass and return a ranked table an analyst can act on. Use when the user pastes or points at many indicators at once, mentions a list, batch, spreadsheet, CSV, SIEM export, EDR export, firewall log, proxy log, alert queue or blocklist, asks which of these are malicious, asks to prioritise or rank a set of hosts, or asks for a first pass over an estate before deciding what to dig into. Uses the bulk band mode rather than scoring each indicator individually, splits results into assessed, never-seen and check-failed so an unobserved indicator is never counted as clean, and reports what was truncated. Requires the WhisperGraph MCP connector.

License

MIT

Compatibility

Requires the WhisperGraph MCP connector at https://mcp.whisper.security. No local runtime, packages, or filesystem access needed.