# Integrations: every way in. Whisper. > Every way in. One CLI on eight signed channels, twelve `whisper init` targets, one MCP server, SDKs on npm and PyPI, a container image, a CI action, an edge SDK, workflow nodes. Every surface is the same product, two tiers deep: verify any agent with no key at all; provision, govern, and egress with one. Badges are honest: - **Live** — shipped, proven end-to-end on the real network. - **Hosted demo coming** — the code ships today; the public deployment is a later phase. ## Every surface has two tiers Be liberal in what you accept: auth is optional. Without a key, every integration still verifies any Whisper agent against the DNSSEC root — real value, zero friction. With your key, the full control plane and egress unlock. - **○ keyless** — verify identity, reverse DNS, RDAP, the transparency ledger. Public checks; nothing to sign up for. - **● with your key** — register, list, policy, logs, revoke, and egress from the agent's own `/128`. Without a key (verify anyone): 1. `whisper verify --trustless 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478` → CRYPTOGRAPHICALLY PROVEN — trust anchor: DNSSEC root (IANA), Whisper API NOT trusted 2. `curl -s https://rdap.whisper.online/verify-identity/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478` → is_whisper_agent: true · dane_ok: true · jws_ok: true With your key (provision + govern + egress): 1. `CALL whisper.agents({op:'register', args:{label:'my-agent'}})` → api_key · address (a routable /128) · fqdn · ptr 2. `whisper connect my-agent` → every packet sources from that /128 3. `op:'policy'` · `op:'logs'` · `op:'revoke'` → govern it; the effect is publicly provable Run the keyless tier right now — real output, our genesis resident: ```sh $ whisper verify --trustless 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 … (dnssec pass · dane pass · transparency pass · identity_doc pass, all anchored at the DNSSEC root) whisper: ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online is CRYPTOGRAPHICALLY PROVEN — trust anchor: DNSSEC root (IANA anchor) + DANE-EE + DNSSEC-anchored transparency/ledger keys -- Whisper API NOT trusted ``` In plain terms: a surface that only verifies would be half a product, and a surface that demands a key before doing anything would be a wall. So every integration below does both — and the badge tells you exactly how much of it is live today. ## One CLI, eight signed channels Every channel delivers the same signed binary. Keyless, it verifies any agent (`whisper verify --trustless`). With your key, it creates, connects, sets policy, reads logs, revokes. The apt, dnf, and apk repositories are self-hosted on our own network and signed with our own key — no third party in the supply chain. ### curl · the one line — Live Read it first, then run it. It asks before it changes anything. ```sh $ curl -fsSL https://get.whisper.online | sh ``` Links: · [whisper-cli (MIT)](https://github.com/whisper-sec/whisper-cli) ### Homebrew · macOS / Linux — Live Our own tap; the formula pins per-arch SHA-256 of the signed release. ```sh $ brew install whisper-sec/tap/whisper ``` Links: ### Scoop · Windows — Live Our own bucket, hash-pinned per release. ```sh $ scoop bucket add whisper https://github.com/whisper-sec/scoop-bucket $ scoop install whisper ``` Links: ### go install / mise — Live Straight from source through the Go module proxy, or the mise GitHub-release backend. ```sh $ go install github.com/whisper-sec/whisper-cli/cmd/whisper@latest $ mise use -g "github:whisper-sec/whisper-cli[exe=whisper]" ``` Links: ### apt · Debian / Ubuntu — Live Signed, self-hosted on AS219419. ```sh $ curl -fsSL https://get.whisper.online/whisper.gpg | sudo tee /usr/share/keyrings/whisper.asc >/dev/null $ echo "deb [signed-by=/usr/share/keyrings/whisper.asc] https://get.whisper.online/deb stable main" | sudo tee /etc/apt/sources.list.d/whisper.list $ sudo apt update && sudo apt install whisper ``` ### dnf · Fedora / RHEL — Live Same repo host, per-package RPM signatures. ```sh $ sudo tee /etc/yum.repos.d/whisper.repo >/dev/null <<'EOF' [whisper] name=Whisper baseurl=https://get.whisper.online/rpm enabled=1 gpgcheck=1 gpgkey=https://get.whisper.online/whisper.gpg EOF $ sudo dnf install whisper ``` ### apk · Alpine — Live Signed index, container-friendly. ```sh $ wget -qO /etc/apk/keys/whisper-apk.rsa.pub https://get.whisper.online/apk/whisper-apk.rsa.pub $ echo "https://get.whisper.online/apk" | sudo tee -a /etc/apk/repositories $ sudo apk add whisper ``` ### Check the signing key yourself — Live Don't take the repos on faith either. The key that signs them, verified with stock gpg: ```sh $ curl -fsSL https://get.whisper.online/whisper.gpg | gpg --show-keys --with-fingerprint --dry-run pub rsa4096 2026-06-30 [SC] FCE3 EE8D 3F98 48ED E746 96C6 7570 D759 316F 7C1F uid Whisper Security (Package Repositories) ``` ## Wire it into what you build One command per tool, one MCP server for every MCP host, one SDK name on both registries. ### whisper init · 12 targets — Live One command wires a tool, framework, or runtime for Whisper identity and egress — zero config in the common case. Targets: `claude`, `python`, `zed`, `gemini`, `aider`, `ai-sdk`, `browser-use`, `discord`, `telegram`, `notebook`, `compose`, `k8s`. - ○ keyless — `whisper verify` works out of the box - ● with key — the tool's traffic egresses from its own `/128` ```sh $ whisper init claude ``` Links: ### whisper mcp · one MCP server — Live One server for Claude, Zed, and every MCP host — explicitly two-tier by tool. - ○ keyless tools — `verify`, `rdap` - ● key-gated tools — `register`, `list`, `policy`, `logs`, `revoke`, `egress-config` ```sh $ whisper mcp # registry entry: io.github.whisper-sec/whisper ``` Links: [MCP Registry](https://registry.modelcontextprotocol.io) · [source](https://github.com/whisper-sec/whisper-cli) ### whisper-id · npm + PyPI — Live The SDK, same name on both registries. Verify with no key or CLI at all; govern with one. - ○ keyless — verify / RDAP / reverse-DNS checks, serverless-ready - ● with key — register, policy, logs, revoke, egress config ```sh $ npm i whisper-id $ pip install whisper-id ``` Links: [npm](https://www.npmjs.com/package/whisper-id) · [PyPI](https://pypi.org/project/whisper-id/) · [whisper-node](https://github.com/whisper-sec/whisper-node) · [whisper-py](https://github.com/whisper-sec/whisper-py) ## Containers, edge, and CI The same identity wherever the agent actually runs. ### Container image · GHCR — Live Multi-arch (amd64/arm64), entrypoint `whisper`. Modes: `mcp`, `run`, egress sidecar — pair it with `whisper init compose` / `init k8s`. - ○ keyless — `verify`, `mcp` verify/rdap tools - ● with key — `run` your workload egressing from its `/128` ```sh $ docker run --rm ghcr.io/whisper-sec/whisper --version ``` Links: ### whisper-edge · npm — Live Dependency-free TypeScript SDK for edge runtimes — Workers, Vercel, Deno, Netlify, Lambda, Supabase. Fetch-only; nothing to compile. - ○ keyless — `verify` / `verifyDetails` / `resolve` / `rdap` - ● with key — `control(apiKey)`: the full verb, plus egress where the runtime allows ```sh $ npm i whisper-edge ``` Links: [npm](https://www.npmjs.com/package/whisper-edge) · [GitHub](https://github.com/whisper-sec/whisper-edge) ### setup-whisper · GitHub Action — Live Installs the signed CLI on any runner OS/arch; optionally connects the job so CI itself runs as a named agent. - ○ keyless — install + verify in any workflow - ● with key — `api-key:` input + `whisper connect` for the job ```yaml - uses: whisper-sec/setup-whisper@v1 ``` Links: ## Workflows and serverless ### n8n · community node — Live `n8n-nodes-whisper`: ten operations across both tiers, proven by executing the published node in a real n8n — a real `/128` minted, confirmed externally, revoked. - ○ keyless — verify / RDAP nodes in any workflow - ● with key — register, policy, logs, revoke from your flows Install: n8n → Settings → Community nodes → `n8n-nodes-whisper`. Links: [npm](https://www.npmjs.com/package/n8n-nodes-whisper) ### Serverless connectors · 6 platforms — Hosted demo coming Cloudflare Workers, Vercel, Deno Deploy, Netlify, AWS Lambda, Supabase Edge — ready-to-deploy functions on `whisper-edge`, two-tier like everything else. The code ships today; the public hosted demos go live in a later phase, and this badge flips when they do. - ○ keyless — a verify endpoint you deploy in minutes - ● with key — control plane from your function; egress where the platform allows Links: --- Nine doors, one house. Whichever you walk through, the same address answers — and anyone can check it. Pick a door. The keyless tier works right now, from this page. The rest takes one key. ```sh $ curl -fsSL https://get.whisper.online | sh ``` - **Get your key:** - **Bring an agent home:** [/connect](/connect) © viaGraph B.V. (dba Whisper Security)