# Whisper - a real, routable IPv6 address that is your AI agent's identity. > Give every AI agent a real, routable IPv6 address as its identity - with > controlled egress that sources from it and per-agent policy you set. Verify > any agent with stock `dig`, `whois`, and `openssl`, anchored in the IANA > DNSSEC root. No SDK, no account. **Give every AI agent a real, routable IPv6 address as its identity - and control what it does on the network.** Know and control what your agents do on the network. Today they leave as anonymous IPs from shared cloud ranges, carrying bearer tokens that leak. Give each one a `/128` that *is* its identity, controlled egress that sources from it, and policy you set - and let anyone confirm which agent it is. The address is real: `2a04:2a01::/32`, announced by **AS219419** - RIPE-allocated, RPKI-signed, MANRS, IPv6-only. Anyone can verify an agent with stock `dig`, `whois`, and `openssl`, anchored to the IANA DNSSEC root - no SDK, no broker, no account to check. Built and run by people who have operated the internet's address registry and one of its root DNS servers. - **Get a live key (verifiable in a minute):** - **Install the CLI (one line):** `curl -fsSL https://get.whisper.online | sh` Live key in under a minute - email and a 6-digit code, no card. First agents included, up to 1,000 per account. ## Four things this fixes Autonomous agents already run on your network - behind shared egress IPs, carrying bearer tokens, audited by "trust our dashboard." You have all four of these problems. The only question is whether you can see them yet. - **Stop agent API keys from leaking.** The identity is the agent's own routable address, forward-confirmed to RIPE - not a bearer token it carries, copies, or spills into a log. - **Give every agent a network identity and a policy boundary.** One `/128`, one resolver, one firewall - bound to the agent the moment it speaks. Not a shared egress IP that ten fleets hide behind. - **Know and control where every autonomous agent connects.** Per-agent resolver and egress policy: block by category, geo-fence to real infrastructure, deny by who owns the host, drop RPKI-invalid routes, cap and cut off by budget. - **Make every agent action attributable, revocable, and observable.** Every action traces to a `/128`; every identity is DNSSEC-signed; every issuance and revocation lands in a public, independently-verifiable ledger. One call tears an agent down. ## The product, as an object you can check A real allocation record for our live genesis resident, `scout` - a real object in the routing and DNS system, not a row in our database: ``` agent scout address 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 /128 prefix 2a04:2a01::/32 RIPE-allocated origin AS219419 RPKI: valid · MANRS ptr ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online forward-confirmed dane TLSA 3 1 1 pinned ``` Run the lookup yourself - no account, nothing installed: ```sh $ dig -x 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 +short ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online $ dig +short CNAME scout.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online # a human name of your own ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online ``` ## Built for people who put agents on the network **OEM & enterprise API providers.** You expose an API, and autonomous agents from a dozen vendors point at it. Today they arrive as opaque IPs from shared cloud ranges - you can't separate one customer's fleet from another. Give each a real `/128` identity and you allow-list, rate-shape, and bill by *verifiable* identity - forward-confirmed to RIPE, checkable at your own edge, no callback to us. ```sh $ dig -x 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 +short ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online $ dig ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online AAAA +short 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 # forward-confirmed - your edge already speaks this ``` **AI labs & agent builders.** You ship agents that act on the open internet. You want each to have an identity you didn't have to mint a secret for, egress you can point wherever policy allows, and an off-switch that actually works. One call gives an agent a routable address, its own resolver, and policy; `revoke` tears the `/128` and its DNS down in one call. ```sh $ whisper create --register --name worker-7 # → real /128, resolver, policy $ whisper kill --revoke worker-7 # → /128 + DNS torn down, one call ``` **MSSPs & security teams.** You run security for other people's agents, and "trust our dashboard" is not evidence. Every action is attributable to a `/128`, every identity is DNSSEC-signed and independently verifiable, and every issuance and revocation sits in a public RFC-6962 ledger. You can prove what happened to a customer or an auditor *without asking us anything*. ```sh $ whisper verify --trustless 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 # re-derives it client-side $ curl -s https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 # keyless RDAP ``` **Fleet & crawler operators.** You run thousands of agents, and origins increasingly block murky proxy pools. Every node sources from a real, RIPE-registered address whose WHOIS/RDAP names *you* and your abuse contact - clean, attributable egress, RPKI-valid, yours to rotate. A runaway crawler is one call away from silent. ```sh $ whois 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 # real org + abuse contact, not a burner $ whisper list # every /128, its policy, its state $ whisper logs --agent worker-7 # per-agent, sourced from its own /128 ``` ## What actually passes through us Three ways an agent uses its `/128`. For each: where it runs, how the address reaches it, and - the question you'd otherwise have to guess - exactly what of yours we can see. Stated plainly, no overclaim. ### Resolver / DoH - Tier 2, keep your own address ``` DNS query · DoH :443 / :53 [ Your agent ] ───────────────────────────────▶ [ Whisper resolver ] keeps its own graph-first · your policy address │ └───────── all real traffic - TLS, direct ─────────▶ [ Origin ] (never passes through Whisper) ``` **What passes through us:** your DNS queries - logged per-tenant, as any resolver does - and nothing else about your traffic. We resolve names and apply your policy against a live graph of 7.48B nodes and 39.5B relationships. Every real connection goes straight from your agent to the origin and never touches Whisper. You keep your own address. **Best when** you want per-agent DNS policy without routing any traffic through us. ### Egress proxy - Tier 1.5, source from your /128 ``` SOCKS5 · HTTP CONNECT 🔒 TLS to origin · ciphertext [ Your agent ] ─────────────▶ [ Whisper egress ] ─────────────▶ [ Origin ] sources from your /128 sees metadata, not plaintext (no TLS keys held here) ``` **What passes through us:** your connection's metadata - where it's going (destination and SNI), when, and how much - and the encrypted bytes themselves, which we forward but cannot read. TLS stays end to end to the origin; **we do not terminate it and hold no keys to it.** In return, the world sees your agent's real, registered address. **Best when** the agent can't run a tunnel but you still want it to be its identity on the wire. ### Routed WireGuard - Tier 1, the /128 comes to your host ``` WireGuard tunnel · encrypted TLS to origin [ Your host · agent ] ═══════════════▶ [ Whisper edge ] ──────────▶ [ Origin ] WG key stays here only your public routes your /128 key reaches us ``` **What passes through us:** we route your packets to the internet - that's it. Your agent's address routes all the way to **your own machine** over a WireGuard tunnel whose **private key is generated on your host and never leaves it** - only its public half ever reaches us. It's still TLS from your agent to the origin; we route, we don't terminate. **Best when** you want the fullest ownership of the path. Pick the mode that fits your threat model. In every mode, your TLS to the origin stays yours - we are on the path as a network, never as a man in the middle. ## No asterisks - two honest lines you won't find on most "zero-trust" pages **Your plaintext stays yours.** In every mode your TLS runs end to end to the origin - we route or forward your packets, we never decrypt them. What we *can* see is stated plainly in each box above, and nothing beyond it. **Own the trust yourself - or let us host it.** *Own it:* bring your own domain and the identity anchors in a DNSSEC chain *you* control (the routable `/128` stays ours), and in the routed tier your tunnel keys are generated on your host and never reach us. *Or hosted* - zero-config, and honest about its one tradeoff: Whisper is the issuing CA and *can* reproduce that credential, the same as any managed-certificate provider - kept honest by an append-only **RFC-6962 transparency ledger** of every issuance, so nothing ever happens off the record. A real choice, stated plainly - no "not even we can" hand-waving. ## One verb governs all three modes ```sh $ curl -s https://graph.whisper.security/api/query \ -H "X-API-Key: whisper_live_xxx" \ --data-urlencode 'q=CALL whisper.agents({op:"policy", args:{ agent: "scout", deny_category: ["crypto-mining","malware-c2"], geo_allow: ["NL","DE"], drop_rpki_invalid: true, budget: { requests_per_min: 600, kill_switch: true } }})' ``` `register`, `policy`, `logs`, `revoke`, `list` - one call each, bound to the agent the moment it speaks. No shared state to forge, no header to spoof, no SDK to import. With no key, the keyless checks below still work; with your key, the full control plane and egress unlock. ## Install - four ways in, equal footing Same signed binary underneath every one. Whatever you run, you can verify it before it runs - and nothing here needs root to try. - **Shell** - `curl -fsSL https://get.whisper.online | sh` - plain shell; pipe it to `less` and read it first. It asks before it changes anything on your machine. - **Signed binary** - `gpg --verify whisper-linux-amd64.asc` - download the binary and its detached signature, verify against the **AS219419 release key** (`Good signature … AS219419`), then run. - **Homebrew** - `brew install whisper-sec/tap/whisper` - macOS and Linux. Public tap; the formula pins the signed release. - **Container** - `docker run --rm ghcr.io/whisper-sec/whisper verify --trustless 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478` - pull from GHCR. Same CLI, zero host install. Same binary, four channels, equal billing. Pick the one your supply chain already trusts. ## Don't take our word for it. Take dig's. Everything above is verifiable with tools you already have, anchored to the IANA DNSSEC root, with Whisper nowhere in the trust path. Here's the whole receipt - run it against `scout`, our live genesis resident. Forward-confirmed reverse DNS, both directions DNSSEC-signed: ```sh $ dig -x 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 +short ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online $ dig ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online AAAA +short 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 ``` Add `+dnssec` and check the `ad` (authenticated) bit yourself. Registry, up to RIPE - keyless, no account: ```sh $ whois 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 # RFC 3912 $ curl -s https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 # RFC 9083 ``` Object data chains up to RIPE's own record for `2a04:2a01::/32`. The public ledger speaks SCITT too: pull a receipt for any leaf, keyless, and validate it with stock COSE tooling (RFC 9943/9942): ```sh $ curl -s -H 'Accept: application/cose' https://whisper.online/entries/ ``` It folds to the same root `curl whisper.online/checkpoint` shows. One command, full trustless re-derivation - the live verdict for `scout`: ```sh $ whisper verify --trustless 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 CHECK RESULT TRUST DETAIL dnssec pass DNSSEC-root AAAA, PTR and TLSA(3 1 1) all DNSSEC-validated to the IANA root; address <-> fqdn consistent dane pass DNSSEC-root served leaf SPKI-SHA256 == TLSA pin; DNS-SAN=ae3b051ff3bf7f478...agents.whisper.online, IP-SAN=2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478; issuer "Whisper Agent Identity Issuing CA" transparency pass DNSSEC-root root signature verified; 1 event(s), root_hash bound; 1 ledger leaf/leaves included (RFC-6962) identity_doc pass DNSSEC-root JWS verified against the DNSSEC-anchored key; address/fqdn/tlsa claims match the DNSSEC-validated facts whisper: ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online is CRYPTOGRAPHICALLY PROVEN - trust anchor: DNSSEC root (IANA anchor) + DANE-EE + DNSSEC-anchored transparency/ledger keys -- Whisper API NOT trusted ``` ``` THE PROOF CHAIN - every hop DNSSEC-signed [ IANA DNSSEC root ] the trust anchor | | dig +dnssec [ .online ] | | dig +dnssec +-------------+ [ whisper.online ] x···| Whisper API | | +-------------+ | dig +dnssec not in the trust path [ agents.whisper.online ] | | dig -x · dig TLSA · curl /checkpoint [ AAAA · PTR · TLSA · ledger · JWS ] the agent's records | | openssl · key == TLSA pin [ the agent's /128 ] 2a04:2a01:… routable, yours ``` Once an agent is home, its own address is also its authorization. From its `/128` it can ask *who runs this host, is it safe, how should I act on it* and get an evidence chain back in under 300ms. The same request from a machine that isn't a registered agent is refused with an HTTP `403` - no key changes hands. No account, no token, no SDK. **The address is the authorization.** The evidence chain comes back against a live graph of 7.48B nodes and 39.5B relationships. Prefer no terminal? The same verdict, keyless, in your browser: - and every leg is reproducible with stock `dig`, `curl`, and `openssl`, named down to the RFC on the [Under the hood](/under-the-hood) page. Four checks, one trust anchor: the IANA DNSSEC root. The proof holds even if you don't believe a word we say. ## Give your next agent a real address Live key in under a minute - email and a 6-digit code, no card. First agents included, up to 1,000 per account. ```sh $ curl -fsSL https://get.whisper.online | sh ``` Trial keys: 10 graph requests/min, 500/day. Bring your own domain any time. --- - **Get a live key:** - **Install the CLI:** `curl -fsSL https://get.whisper.online | sh` - **How it's built:** [/platform](/platform) - **Under the hood:** [/under-the-hood](/under-the-hood) - **Trust (zero trust, for your estate):** [/trust](/trust) - **Integrations (every way in):** [/integrations](/integrations) - **Bring your own identity:** [/bring-your-own-identity](/bring-your-own-identity) - **The living nest:** - **Registry & policy:** - **AS219419:** - **Whisper Security:** © viaGraph B.V. (dba Whisper Security)