# Agent frameworks

One command puts Whisper's `whisper mcp` tools inside your agent framework - verify any peer with no key, and give your own agent a routable `/128` it egresses from with one.

Whisper ships one MCP server - `whisper mcp`, a mode of the same [`whisper` binary](/docs/cli) - and distributes it as a thin adapter for every major agent framework from one public source of truth, [`whisper-sec/whisper-adapters`](https://github.com/whisper-sec/whisper-adapters). Every adapter bundles the identical server; the wiring is always `{command:"whisper", args:["mcp"]}`. Install it in your framework and the model gains real network-identity tools: verify any peer, and - with your key - give your own agent a routable `/128` it egresses from.

## Two tiers, auth optional

Like every Whisper integration, the adapter is two-tier by design - liberal in what it asks of you ([Postel's Law](/docs/integrations)):

- **No API key** - the keyless tools work for everyone: `whisper_verify` (is an address or hostname a real Whisper agent, and whose?) and `whisper_rdap` (its RDAP registration). Real value, zero setup.
- **With your key** (`WHISPER_API_KEY` in the client's environment, or a saved `whisper login`) - the full control plane unlocks (`whisper_register`, `whisper_list`, `whisper_policy`, `whisper_logs`, `whisper_revoke`, `whisper_egress_config`), and the session can **egress from its routable `/128`**.

The full catalogue is two keyless tools and six key-gated ones - see the [MCP server](/docs/mcp) page for the wire protocol underneath:

| Tool | Gate | Does |
|---|---|---|
| `whisper_verify` | keyless | Full trust chain (reverse-DNS + DANE-EE TLSA + DNSSEC + JWS) for an address or FQDN → verdict JSON |
| `whisper_rdap` | keyless | RDAP registration record for a `/128` - operator, tenant, issued-since |
| `whisper_register` | key | Create an agent: name in, routable `/128` + DNS name out |
| `whisper_list` | key | List your tenant's agents, DNS records, or identities |
| `whisper_policy` | key | Read or set your tenant's resolver policy (block/allow/default) |
| `whisper_logs` | key | Query an agent's DNS/connection/allocation history |
| `whisper_revoke` | key | Irreversibly withdraw an agent's `/128`, reverse-DNS, and keys |
| `whisper_egress_config` | key | Return the proxy env + `whisper connect` command to source a workload from an agent's `/128` |

## Frameworks & status

Badges are honest. Only the six **Live** rows install from a registry with one command today; the rest ship a real add-step (a config snippet or a manual UI step) and are badged accordingly. In-chat tool invocation on Gemini, Codex, and Copilot additionally needs that framework's own login.

| Framework | Install | Status |
|---|---|---|
| [Claude Code](/docs/agents-claude-code) | `/plugin marketplace add whisper-sec/whisper-adapters` then `/plugin install whisper@whisper` | Live |
| [Gemini CLI](/docs/agents-gemini) | `gemini extensions install https://github.com/whisper-sec/whisper-adapters` | Live |
| [Codex](/docs/agents-codex) | `codex plugin marketplace add whisper-sec/whisper-adapters` then `codex plugin add whisper@whisper` | Live |
| [Copilot CLI](/docs/agents-copilot) | `copilot plugin marketplace add whisper-sec/whisper-adapters` then `copilot plugin install whisper@whisper` | Live |
| [OpenClaw](/docs/agents-openclaw) | `clawhub install whisper` | Live |
| [Agent Skill (SKILL.md)](/docs/agents-more) | `clawhub install whisper-identity` (or self-host via the `/.well-known/skills` manifest) | Live |
| [OpenCode](/docs/agents-opencode) | native MCP snippet in `opencode.json` (npm publish pending) | Staged |
| [Hermes](/docs/agents-hermes) | MCP config recipe in `~/.hermes/config.yaml` | Staged |
| [Devin · Qoder · Pi · Swival](/docs/agents-more) | add the MCP server by hand (SaaS / GUI IDE) | Manual |

> Only the six **Live** rows are install-and-go from a registry today. The **Staged** ones are built and proven end-to-end - you install them from source or a config snippet while the one-command registry publish lands. The Agent Skill row is the Whisper Identity skill (Anthropic `SKILL.md` standard): live on ClawHub, and self-hostable with no account from the manifest at `https://whisper.online/.well-known/skills/index.json`.

## One binary underneath

**Prerequisite:** the `whisper` CLI on your PATH - the adapter runs `whisper mcp` (the tool surface) and, for egress, `whisper connect`:

```bash
curl -fsSL https://get.whisper.online | sh
```

Because every adapter simply launches the same CLI, a tool behaves exactly as `whisper` does on your terminal - one mechanism, no re-implemented protocol, no host addresses baked into any manifest. Your key is read at runtime from your own environment or `whisper login` key file, never stored in an adapter.

---

**Next:** [Claude Code](/docs/agents-claude-code) - the first Live framework · [MCP server](/docs/mcp) - the server every adapter bundles.