Install & verify · keyless-first

Verify a /128 in your own terminal. Then, if you want, install the sensor.

The identity comes first and needs no agent and no API key. The calm sensor is the optional power-up that adds per-process detection at about 1% of one core and 11 MB.

Verify a /128, keyless → dig · delv · openssl · RDAP are enough

or jump to the sensor

$ curl -fsSL https://get.whisper.online | sh

1tier one · keyless · no agent, no key

Audit an identity with stock tools.

Our API is never in the trust path. Anyone can forward-confirm the reverse DNS, validate the DNSSEC chain with delv, pin the DANE leaf and read the public RDAP record. This works on a PLC, a printer or an ephemeral AI agent, with nothing installed on the device.

verify a /128 · keyless captures

# 1 · reverse DNS names the address, forward-confirmed
$ dig +noall +answer -x 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 @1.1.1.1
...ip6.arpa. 60 IN PTR ae3b051ff3bf7f478.t...e4f9.agents.whisper.online.

# 2 · the answer's signatures validate to the IANA root (delv, re-derived locally)
$ delv +rtrace -x 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478
; fully validated

# 3 · the DANE-EE leaf is pinned in DNS (TLSA 3 1 1)
$ openssl s_client -dane_tlsa_domain ... -dane_tlsa_rrdata "3 1 1 ..."
Verification: OK · DANE TLSA 3 1 1 ...  matched EE certificate

# 4 · the public RDAP record, IP-anchored
$ curl -s https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478
"status": ["active"] · "name": "scout" · "country": "NL"

All four are ordinary internet plumbing anchored at the IANA root. Revoke a /128 and the same commands return authenticated NXDOMAIN and an RDAP record that shows no assignment, worldwide at DNS-TTL.

Two tiers, one primitive: the left half needs no agent and no API key, so a PLC, a printer or an ephemeral AI agent gets a verifiable identity with nothing installed; the calm sensor is the optional power-up that adds per-process detection at about 1% of one core and 11 MB.

2tier two · the calm sensor · optional power-up

One command, a bounded unit, zero config.

When you want per-process detection, one line installs the calm Linux sensor and mints the identity you just audited. Observing a host is an explicit choice, never a side effect of minting a /128, so the sensor is opt-in: add WHISPER_SENSOR=1 and a key. It runs under a systemd unit you can read, not a black box.

$ curl -H "X-API-Key: $WHISPER_KEY" https://get.whisper.online | WHISPER_SENSOR=1 sh

systemctl cat whisper-sensor · the bounded unit

$ systemctl cat whisper-sensor
[Service]
# the kernel enforces these; the sensor cannot exceed them
CPUQuota=25%
MemoryMax=250M
Nice=19
IOSchedulingClass=idle

Those are the hard ceilings, the same numbers on every host, one you can plan a fleet against. On a real box the sensor measured far below them:

Live capture from srv-fin-01: cpu 1.01% of the 25% quota · mem 11 MB of the 150 MB soft ceiling (250 MB hard) · within SLA; the quota is the ceiling we promise never to need.

Supported today

The same one line, on every supported distro.

The sensor is pure Go and fails open below kernel 5.3, so a missing feature degrades gracefully rather than breaking the host.

Debian family

Debian · Ubuntu

apt

Signed apt repo at get.whisper.online; the installer wires it for you.

RHEL family

Rocky · Alma · RHEL

dnf

Signed dnf repo; RPMs signed with the release key.

everything else

any Linux

keyless tier

No sensor needed to enroll and verify a /128; that tier is OS-independent.

Then check it yourself

Install, then audit the identity you just minted.

Re-run the four keyless checks against your fresh /128. See how it works, layer by layer.

Verify a /128, keyless → no agent, no API key

or open the console

$ curl -fsSL https://get.whisper.online | sh