Skip to content

whisper-sec/whisper-graph

v2.0.0MIT

Investigation playbooks for the WhisperGraph internet-infrastructure graph: indicator triage that reads coverage before it reports a verdict, bulk triage over a SIEM export, Cypher that passes the server's validator, and brand-protection sweeps.

whisper-cypher

WhisperGraph Cypher authoring — write read-only queries that pass the server's safety validator and return in milliseconds instead of timing out on billion-node labels. Use when a question has no ready-made WhisperGraph workflow and needs a custom query, when a query was rejected, rewritten, timed out, or returned zero rows unexpectedly, when the user asks about the graph schema, node labels, edge types or edge directions, when an aggregate or comparison across many entities is needed, or when the user asks how to reach the graph over its HTTP API instead of the connector. Covers anchoring, the physical versus query-time edge distinction, the edge directions that silently return nothing, the traps that succeed while matching nothing, and the typed error and self-correction contract. Requires the WhisperGraph MCP connector for the query tool.

License
MIT
Compatibility
Requires the WhisperGraph MCP connector at https://mcp.whisper.security for the query tool. The HTTP API notes need only curl or any HTTP client.
Read SKILL.md at the source

Pinned to revision ee13f53e4d63, so it is the text this page describes rather than whatever the author pushed since.

Files

Every link opens the file at its source, pinned to the revision this page describes.