MCP server trust

Before your agent hands tool-calling access to an MCP server it found in a registry or a README, it has no cheap way to ask "is this host known, and does it carry a bad reputation?"

The Model Context Protocol standardised how a client and a server talk. It left trust as someone else's problem. A server's tools/list name and description are self-asserted, and the fact that a host is reachable over TLS says nothing about who runs it or what the wider internet already knows about it.

Whisper closes the first, cheapest gap with a keyless verify endpoint. Give it a server host and it returns two independent, observe-only signals folded into one trust verdict, with no account and no key:

curl -s 'https://whisper.online/mcp/assess?server=api.example.com' | jq

This is the keyless verify tier. It complements, and is byte-consistent with, the keyed govern tier (allowlists and policy enforcement for your own agents, unlocked with your Whisper API key on the control plane). Together they are the two-tier surface every Whisper integration follows: real value with no key, full control behind one.

Two signals, folded honestly

The verdict rests on two axes a keyless caller can legitimately obtain for one host, and nothing it cannot:

• Graph reputation band. The same destination-reputation signal the Whisper resolver's graph-first policy reads, drawn from a live graph of 7.4B nodes and 39B relationships. A CRITICAL or HIGH band folds to a critical posture, MEDIUM to suspicious, anything lower to clean. A band is a reputation signal, never proof of malice.
• Official MCP-registry status. Whether the host matches an active publisher listed in the official MCP registry (KNOWN), a registered-but-withdrawn publisher (FLAGGED), or is not in the snapshot (UNKNOWN). Registry status recognises registry-listed servers, not arbitrary MCP servers behind opaque TLS.

Live, keyless

A host the graph flags as critical (here, a domain long documented in threat intelligence):

// curl -s 'https://whisper.online/mcp/assess?server=coinhive.com'
{
  "object": "mcp_assessment",
  "server": "coinhive.com",
  "port": 443,
  "verdict": "critical",
  "verdict_detail": "the host carries a CRITICAL Whisper graph reputation band; treat with caution before connecting",
  "band": "CRITICAL",
  "band_available": true,
  "registry_status": "UNKNOWN",
  "registry_listed": false,
  "score": 70,
  "tier": "connection",
  "feeds": [
    { "source": "whisper-graph-reputation", "available": true, "band": "CRITICAL" },
    { "source": "official-mcp-registry", "available": false, "status": "UNKNOWN" }
  ],
  "limits": [
    "band is a Whisper graph reputation signal, not proof of malice",
    "registry status recognises servers listed in the official MCP registry, not arbitrary MCP servers behind opaque TLS",
    "connection-tier only: host, reputation band and registry status, never the MCP tool, method or arguments",
    "an unrecognised (UNKNOWN-registry) server is unverified, not malicious"
  ],
  "note": "keyless verify tier: supply your Whisper API key to govern MCP allowlists and enforce policy for your own agents"
}

A host with a middling band reads suspicious, and a host nobody has any signal on reads unverified, which is a fact, not an accusation:

# curl -s '.../mcp/assess?server=paypa1.com'    -> band MEDIUM, verdict "suspicious", score 45
# curl -s '.../mcp/assess?server=<unseen-host>'  -> band UNKNOWN, verdict "unverified", score 10

The honesty boundary is in the answer

Every response carries its own limits, and it degrades rather than guesses:

• Connection tier only. The answer is the host, its reputation band, and its registry status. It is never the MCP tool, method, or arguments, which live behind opaque TLS. A clean verdict is not a promise the server is safe to call; it is the absence of a known-bad signal at the connection layer.
• Fail-soft, never a guess. If the graph or the registry snapshot cannot be consulted, that feed is marked available: false, the answer sets degraded: true, and the verdict rests only on the signals that were readable. The endpoint never manufactures a verdict from a feed it could not reach, and it never returns an opaque 500. A missing or malformed server is a clear 400.
• Registry snapshot warms in the background. The official-MCP-registry feed refreshes off the request path, so a caller is never blocked on it. In the captures above the registry axis reads UNKNOWN with degraded: true because the snapshot was still warming at capture time; the verdict there rests on the live graph-reputation band. Once the snapshot is warm, a registry-listed active publisher with a clean band reads trusted.

Postel, at the door

Liberal in what it accepts: ?server= on GET, a JSON {"server":"..."} or a form field on POST, a host with or without a scheme, port, path, or trailing dot. Conservative in what it emits: one typed, predictable JSON shape every time, a clean status on every error, and the limits of the answer stated in the body rather than hidden.

From verify to govern

Verifying a host is the keyless half. With your Whisper API key, the control plane governs your own agents' MCP posture: which servers they may reach, the policy the resolver enforces, and the per-agent activity you can read back. The keyless verdict a caller reads here is folded from the same signals as the keyed posture, so what an auditor checks from outside and what you enforce from inside stay consistent.

Next: MCP server the keyless whisper_verify tools any client can call · Compliance evidence the same keyless-verify posture as an audit grid · Transparency log the ledger the reputation and verify surfaces share · Integrations the two-tier design every surface follows.