@whisper-security/whisper-mcp 0.219.2 → 0.220.0

package/README.md

@@ -20,17 +20,23 @@ Zed: same three lines.
 
 ## It does something useful with no account
 
-No key, no signup, 45 tools, real answers:
-
-- `whisper_verify` - is this address or hostname a real Whisper agent, and whose?
-- `whisper_rdap` - the IP-anchored registration record for a `/128`
-- `explain_indicator` - one-call threat assessment for a domain, IP, ASN or hash
-- `query` - Cypher against WhisperGraph, the internet's infrastructure graph
-- `read_docs`, `list_workflows`, `run_workflow` - documentation and ready-made investigations
-
-Add an API key and the same server also registers agents, sets resolver policy, hands out
-egress configuration and reads your agents' activity. Nothing is hidden behind the key
-that could have been answered without it.
+No key, no signup, five tools, real answers:
+
+- `whisper_verify` - is this address or hostname a real Whisper agent, and whose? The full
+  keyless trust chain: reverse DNS, the DANE-EE TLSA pin, DNSSEC, the signed identity document.
+- `whisper_rdap` - the IP-anchored registration record for a `/128`: who operates the
+  identity, since when, under which tenant.
+- `whisper_identify` - the vendor, category and operator roles behind a host or IP, with a
+  confidence band.
+- `whisper_assess` - a labelled threat posture for a host or IP: malicious, benign or
+  unknown, with the severity band, coverage and evidence behind it.
+- `whisper_explain` - an indicator scored against the threat feeds, with the feeds it is
+  listed in and exactly why.
+
+Add an API key and the same server lists 45 tools: it registers agents, sets resolver
+policy, hands out egress configuration, reads your agents' activity, and opens the graph
+(`query`, `explain_indicator`, `read_docs`, `list_workflows`, `run_workflow`, `text2cypher`
+and the investigation procedures).
 
 ## Getting a key
 

package/bin/whisper-mcp.js

@@ -24,9 +24,17 @@ const path = require('path');
 const crypto = require('crypto');
 const { spawn } = require('child_process');
 
-const VERSION = require('../package.json').version;
+const PKG = require('../package.json');
+/*
+ * The CLI release this wrapper resolves, which is NOT the wrapper's own version. They move
+ * independently: a packaging fix bumps `version` while still fetching the same audited binary,
+ * and a CLI release bumps `whisperCliVersion`. Deriving one from the other looked tidy and meant
+ * that publishing a patch pointed the download at a release tag that did not exist.
+ */
+const CLI_VERSION = PKG.whisperCliVersion || PKG.version;
+const VERSION = CLI_VERSION;
 const REPO = 'whisper-sec/whisper-cli';
-const BASE = `https://github.com/${REPO}/releases/download/v${VERSION}`;
+const BASE = `https://github.com/${REPO}/releases/download/v${CLI_VERSION}`;
 
 /** stderr only. See the header: stdout is the protocol. */
 function note(msg) {

package/package.json

@@ -1,6 +1,8 @@
 {
   "name": "@whisper-security/whisper-mcp",
-  "version": "0.219.2",
+  "version": "0.220.0",
+  "mcpName": "io.github.whisper-sec/whisper",
+  "whisperCliVersion": "0.220.0",
   "description": "Give an AI agent a real, routable IPv6 identity, verifiable egress and DNS policy. Keyless: verify any agent's identity and query the infrastructure graph. With a key: register, govern and route agents.",
   "keywords": [
     "mcp",