Agent frameworks
One command puts Whisper's whisper mcp tools inside your agent framework — verify any peer with no key, and give your own agent a routable /128 it egresses from with one.
Whisper ships one MCP server — whisper mcp, a mode of the same whisper binary — and distributes it as a thin adapter for every major agent framework from one public source of truth, whisper-sec/whisper-adapters. Every adapter bundles the identical server; the wiring is always {command:"whisper", args:["mcp"]}. Install it in your framework and the model gains real network-identity tools: verify any peer, and — with your key — give your own agent a routable /128 it egresses from.
Two tiers, every framework
Like every Whisper integration, the adapter is two-tier by design — liberal in what it asks of you (Postel's Law):
- No API key — the keyless tools work for everyone:
whisper_verify(is an address or hostname a real Whisper agent, and whose?) andwhisper_rdap(its RDAP registration). Real value, zero setup. - With your key (
WHISPER_API_KEYin the client's environment, or a savedwhisper login) — the full control plane unlocks (whisper_register,whisper_list,whisper_policy,whisper_logs,whisper_revoke,whisper_egress_config), and the session can egress from its routable/128.
The full catalogue is two keyless tools and six key-gated ones — see the MCP server page for the wire protocol underneath:
| Tool | Gate | Does |
|---|---|---|
whisper_verify |
keyless | Full trust chain (reverse-DNS + DANE-EE TLSA + DNSSEC + JWS) for an address or FQDN → verdict JSON |
whisper_rdap |
keyless | RDAP registration record for a /128 — operator, tenant, issued-since |
whisper_register |
key | Create an agent: name in, routable /128 + DNS name out |
whisper_list |
key | List your tenant's agents, DNS records, or identities |
whisper_policy |
key | Read or set your tenant's resolver policy (block/allow/default) |
whisper_logs |
key | Query an agent's DNS/connection/allocation history |
whisper_revoke |
key | Irreversibly withdraw an agent's /128, reverse-DNS, and keys |
whisper_egress_config |
key | Return the proxy env + whisper connect command to source a workload from an agent's /128 |
Frameworks & status
Badges are honest. Only the four Live frameworks install and register on their own CLI today; the rest ship a real add-step (a config snippet or a manual UI step) and are badged accordingly. In-chat tool invocation on Gemini, Codex, and Copilot additionally needs that framework's own login.
| Framework | Install | Status |
|---|---|---|
| Claude Code | /plugin marketplace add whisper-sec/whisper-adapters then /plugin install whisper@whisper |
Live |
| Gemini CLI | gemini extensions install https://github.com/whisper-sec/whisper-adapters |
Live |
| Codex | codex plugin marketplace add whisper-sec/whisper-adapters then codex plugin add whisper@whisper |
Live |
| Copilot CLI | copilot plugin marketplace add whisper-sec/whisper-adapters then copilot plugin install whisper@whisper |
Live |
| OpenClaw | install from source (ClawHub publish pending) | Staged |
| OpenCode | native MCP snippet in opencode.json (npm publish pending) |
Staged |
| Hermes | MCP config recipe in ~/.hermes/config.yaml |
Staged |
| Devin · Qoder · Pi · Swival | add the MCP server by hand (SaaS / GUI IDE) | Manual |
Only the four Live frameworks are install-and-go from a registry today. The Staged ones are built and proven end-to-end — you install them from source or a config snippet while the one-command registry publish lands.
One binary underneath
Prerequisite: the whisper CLI on your PATH — the adapter runs whisper mcp (the tool surface) and, for egress, whisper connect:
curl -fsSL https://get.whisper.online | sh
Because every adapter simply launches the same CLI, a tool behaves exactly as whisper does on your terminal — one mechanism, no re-implemented protocol, no host addresses baked into any manifest. Your key is read at runtime from your own environment or whisper login key file, never stored in an adapter.
Next: Claude Code — the first Live framework · MCP server — the server every adapter bundles.