whisper-investigate

WhisperGraph investigation playbook — triage a domain, IP, ASN, CIDR or prefix against an internet-infrastructure graph covering DNS, BGP and RPKI, WHOIS ownership, GeoIP, email (SPF/DMARC/DKIM), certificate transparency, TLS fingerprints, web links and threat feeds. Use when the user asks whether an indicator is malicious or safe, says to investigate or enrich an IOC, asks who owns, hosts, registered or runs something, asks what a domain resolves to or depends on, wants an attack surface or supply chain mapped, wants a subdomain takeover, DNS delegation or BGP hijack check, or wants an investigation written up with evidence. Also use to check WhisperGraph connectivity. Chooses the right server-side workflow instead of hand-rolling queries, and reads the coverage fields so an unseen indicator is never reported as clean. Requires the WhisperGraph MCP connector.

License

MIT

Compatibility

Requires the WhisperGraph MCP connector at https://mcp.whisper.security. No local runtime, packages, or filesystem access needed.