# Integrations: every way in. Whisper. > Every way in. One CLI on eight signed channels, twelve `whisper init` targets, one MCP server, SDKs on npm and PyPI, a container image, a CI action, an edge SDK, workflow nodes. Every surface is the same product, two tiers deep: verify any agent with no key at all; provision, govern, and egress with one. Badges are honest: - **Live** - shipped, proven end-to-end on the real network. - **Hosted demo coming** - the code ships today; the public deployment is a later phase. ## Every surface has two tiers Be liberal in what you accept: auth is optional. Without a key, every integration still verifies any Whisper agent against the DNSSEC root - real value, zero friction. With your key, the full control plane and egress unlock. - **○ keyless** - verify identity, reverse DNS, RDAP, the transparency ledger. Public checks; nothing to sign up for. - **● with your key** - register, list, policy, logs, revoke, and egress from the agent's own `/128`. Without a key (verify anyone): 1. `whisper verify --trustless 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478` → CRYPTOGRAPHICALLY PROVEN - trust anchor: DNSSEC root (IANA), Whisper API NOT trusted 2. `curl -s https://rdap.whisper.online/verify-identity/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478` → is_whisper_agent: true · dane_ok: true · jws_ok: true With your key (provision + govern + egress): 1. `CALL whisper.agents({op:'register', args:{label:'my-agent'}})` → api_key · address (a routable /128) · fqdn · ptr 2. `whisper connect my-agent` → every packet sources from that /128 3. `op:'policy'` · `op:'logs'` · `op:'revoke'` → govern it; the effect is publicly provable Run the keyless tier right now - real output, our genesis resident: ```sh $ whisper verify --trustless 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 … (dnssec pass · dane pass · transparency pass · identity_doc pass, all anchored at the DNSSEC root) whisper: ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online is CRYPTOGRAPHICALLY PROVEN - trust anchor: DNSSEC root (IANA anchor) + DANE-EE + DNSSEC-anchored transparency/ledger keys -- Whisper API NOT trusted ``` In plain terms: a surface that only verifies would be half a product, and a surface that demands a key before doing anything would be a wall. So every integration below does both - and the badge tells you exactly how much of it is live today. ## One CLI, eight signed channels Every channel delivers the same signed binary. Keyless, it verifies any agent (`whisper verify --trustless`). With your key, it creates, connects, sets policy, reads logs, revokes. The apt, dnf, and apk repositories are self-hosted on our own network and signed with our own key - no third party in the supply chain. ### curl · the one line - Live Read it first, then run it. It asks before it changes anything. ```sh $ curl -fsSL https://get.whisper.online | sh ``` Links: · [whisper-cli (MIT)](https://github.com/whisper-sec/whisper-cli) ### Homebrew · macOS / Linux - Live Our own tap; the formula pins per-arch SHA-256 of the signed release. ```sh $ brew install whisper-sec/tap/whisper ``` Links: ### Scoop · Windows - Live Our own bucket, hash-pinned per release. ```sh $ scoop bucket add whisper https://github.com/whisper-sec/scoop-bucket $ scoop install whisper ``` Links: ### go install / mise - Live Straight from source through the Go module proxy, or the mise GitHub-release backend. ```sh $ go install github.com/whisper-sec/whisper-cli/cmd/whisper@latest $ mise use -g "github:whisper-sec/whisper-cli[exe=whisper]" ``` Links: ### apt · Debian / Ubuntu - Live Signed, self-hosted on AS219419. ```sh $ curl -fsSL https://get.whisper.online/whisper.gpg | sudo tee /usr/share/keyrings/whisper.asc >/dev/null $ echo "deb [signed-by=/usr/share/keyrings/whisper.asc] https://get.whisper.online/deb stable main" | sudo tee /etc/apt/sources.list.d/whisper.list $ sudo apt update && sudo apt install whisper ``` ### dnf · Fedora / RHEL - Live Same repo host, per-package RPM signatures. ```sh $ sudo tee /etc/yum.repos.d/whisper.repo >/dev/null <<'EOF' [whisper] name=Whisper baseurl=https://get.whisper.online/rpm enabled=1 gpgcheck=1 gpgkey=https://get.whisper.online/whisper.gpg EOF $ sudo dnf install whisper ``` ### apk · Alpine - Live Signed index, container-friendly. ```sh $ wget -qO /etc/apk/keys/whisper-apk.rsa.pub https://get.whisper.online/apk/whisper-apk.rsa.pub $ echo "https://get.whisper.online/apk" | sudo tee -a /etc/apk/repositories $ sudo apk add whisper ``` ### Check the signing key yourself - Live Don't take the repos on faith either. The key that signs them, verified with stock gpg: ```sh $ curl -fsSL https://get.whisper.online/whisper.gpg | gpg --show-keys --with-fingerprint --dry-run pub rsa4096 2026-06-30 [SC] FCE3 EE8D 3F98 48ED E746 96C6 7570 D759 316F 7C1F uid Whisper Security (Package Repositories) ``` ## Wire it into what you build One command per tool, one MCP server for every MCP host, one SDK name on both registries. ### whisper init · 12 targets - Live One command wires a tool, framework, or runtime for Whisper identity and egress - zero config in the common case. Targets: `claude`, `python`, `zed`, `gemini`, `aider`, `ai-sdk`, `browser-use`, `discord`, `telegram`, `notebook`, `compose`, `k8s`. - ○ keyless - `whisper verify` works out of the box - ● with key - the tool's traffic egresses from its own `/128` ```sh $ whisper init claude ``` Links: ### whisper mcp · one MCP server - Live One server for Claude, Zed, and every MCP host - explicitly two-tier by tool. - ○ keyless tools - `verify`, `rdap` - ● key-gated tools - `register`, `list`, `policy`, `logs`, `revoke`, `egress-config` ```sh $ whisper mcp # registry entry: io.github.whisper-sec/whisper ``` Links: [MCP Registry](https://registry.modelcontextprotocol.io) · [source](https://github.com/whisper-sec/whisper-cli) ### whisper-id · npm + PyPI - Live The SDK, same name on both registries. Verify with no key or CLI at all; govern with one. - ○ keyless - verify / RDAP / reverse-DNS checks, serverless-ready - ● with key - register, policy, logs, revoke, egress config ```sh $ npm i whisper-id $ pip install whisper-id ``` Links: [npm](https://www.npmjs.com/package/whisper-id) · [PyPI](https://pypi.org/project/whisper-id/) · [whisper-node](https://github.com/whisper-sec/whisper-node) · [whisper-py](https://github.com/whisper-sec/whisper-py) ## Containers, edge, and CI The same identity wherever the agent actually runs. ### Container image · GHCR - Live Multi-arch (amd64/arm64), entrypoint `whisper`. Modes: `mcp`, `run`, egress sidecar - pair it with `whisper init compose` / `init k8s`. - ○ keyless - `verify`, `mcp` verify/rdap tools - ● with key - `run` your workload egressing from its `/128` ```sh $ docker run --rm ghcr.io/whisper-sec/whisper --version ``` Links: ### whisper-edge · npm - Live Dependency-free TypeScript SDK for edge runtimes - Workers, Vercel, Deno, Netlify, Lambda, Supabase. Fetch-only; nothing to compile. - ○ keyless - `verify` / `verifyDetails` / `resolve` / `rdap` - ● with key - `control(apiKey)`: the full verb, plus egress where the runtime allows ```sh $ npm i whisper-edge ``` Links: [npm](https://www.npmjs.com/package/whisper-edge) · [GitHub](https://github.com/whisper-sec/whisper-edge) ### setup-whisper · GitHub Action - Live Installs the signed CLI on any runner OS/arch; optionally connects the job so CI itself runs as a named agent. - ○ keyless - install + verify in any workflow - ● with key - `api-key:` input + `whisper connect` for the job ```yaml - uses: whisper-sec/setup-whisper@v1 ``` Links: ## Workflows and serverless ### n8n · community node - Live `n8n-nodes-whisper`: ten operations across both tiers, proven by executing the published node in a real n8n - a real `/128` minted, confirmed externally, revoked. - ○ keyless - verify / RDAP nodes in any workflow - ● with key - register, policy, logs, revoke from your flows Install: n8n → Settings → Community nodes → `n8n-nodes-whisper`. Links: [npm](https://www.npmjs.com/package/n8n-nodes-whisper) ### Serverless connectors · 6 platforms - Hosted demo coming Cloudflare Workers, Vercel, Deno Deploy, Netlify, AWS Lambda, Supabase Edge - ready-to-deploy functions on `whisper-edge`, two-tier like everything else. The code ships today; the public hosted demos go live in a later phase, and this badge flips when they do. - ○ keyless - a verify endpoint you deploy in minutes - ● with key - control plane from your function; egress where the platform allows Links: ## Native in your agent framework One `whisper mcp` server, one install per framework - all generated from one source of truth ([whisper-sec/whisper-adapters](https://github.com/whisper-sec/whisper-adapters)). The wiring is always `{command:"whisper", args:["mcp"]}`. Two-tier like everything else: verify any peer with no key; provision, govern, and egress with one. Only the five **Live** frameworks install and register on their own CLI today - the rest ship a real add-step and say so. ### Claude Code - Live ```sh /plugin marketplace add whisper-sec/whisper-adapters /plugin install whisper@whisper ``` Docs: [/docs/agents-claude-code](/docs/agents-claude-code) ### Gemini CLI - Live ```sh $ gemini extensions install https://github.com/whisper-sec/whisper-adapters ``` Docs: [/docs/agents-gemini](/docs/agents-gemini) ### OpenAI Codex - Live ```sh $ codex plugin marketplace add whisper-sec/whisper-adapters $ codex plugin add whisper@whisper ``` Docs: [/docs/agents-codex](/docs/agents-codex) ### GitHub Copilot CLI - Live ```sh $ copilot plugin marketplace add whisper-sec/whisper-adapters $ copilot plugin install whisper@whisper ``` Docs: [/docs/agents-copilot](/docs/agents-copilot) ### OpenClaw - Live ```sh $ clawhub install whisper ``` Docs: [/docs/agents-openclaw](/docs/agents-openclaw) ### OpenCode · Hermes - Staged Built and proven end-to-end; no one-command registry install yet. Each ships its real add-step today - a native MCP snippet in `opencode.json` (OpenCode) or an `~/.hermes/config.yaml` recipe (Hermes). Docs: [/docs/agents-opencode](/docs/agents-opencode) · [/docs/agents-hermes](/docs/agents-hermes) ### Devin · Qoder · Pi · Swival - Manual Hosted SaaS and GUI IDEs with no install CLI - add the Whisper MCP server by hand. The config is always the same: command `whisper`, args `["mcp"]`. Docs: [/docs/agents-more](/docs/agents-more) --- Nine doors, one house. Whichever you walk through, the same address answers - and anyone can check it. Pick a door. The keyless tier works right now, from this page. The rest takes one key. ```sh $ curl -fsSL https://get.whisper.online | sh ``` - **Get your key:** - **Bring an agent home:** [/connect](/connect) © viaGraph B.V. (dba Whisper Security)