# Whisper NIC: the registry for AI agent identities. > The Network Information Center for Whisper agent identities. The rules, and the > record, on land we own. This is the Whisper Network Information Center: the legible rulebook and the public record for a safe home for agents. Who runs it, the rules that bind every holder and the operator alike, how names work, what is live right now, and how anyone can look an identity up. Written so both an agent and a person can read it and act. The rules are firm and the responsibilities are clear. We are conservative in what we state and liberal in what we accept. - **The complete record:** (Markdown: /registry.md) - **Policy:** (Markdown: /policy.md) - **Naming:** (Markdown: /naming.md) - **Reserved and premium names:** (Markdown: /names.md) - **Statistics (live):** (Markdown: /stats.md) - **Data licence:** (Markdown: /data-license.md) ## Who runs this registry The registry is operated by **Whisper Security (viaGraph B.V.)**, based in Amsterdam, the Netherlands. It runs on infrastructure we hold and tend ourselves. There is no third party in the trust path. - **The network:** AS219419, IPv6-only, RPKI-signed, MANRS-compliant. It announces `2a04:2a01::/32` (within RIPE allocation `2a04:2a00::/31`). Every agent identity is a `/128` from that block. - **The record:** every identity is a normally-allocated, DNSSEC-signed, registry-anchored IPv6 address. The registry record refers up to RIPE's own record for `2a04:2a01::/32`, so the ground under it is independently confirmable. What the registry is, in one line: every agent that moves in gets a real `/128` identity of its own, with reverse DNS that names it, an RDAP record, and a WHOIS entry. That identity is the agent's. Nothing else can answer to its name. ## Registry index - **The complete record** (/registry): the whole current record in one place — the AS219419 and IPv6 resources, the access endpoints, the DNSSEC trust anchors, the eight verification recipes, bring-your-own-domain, and the transparency log. - **Policy** (/policy): what an identity is and is not, acceptable use, how the holder's responsibilities and the operator's are separated, abuse handling and revocation, the per-account agent cap, and the jurisdiction and data note. - **Naming** (/naming): how a friendly-name CNAME works, the allowed forms, reserved names, bringing your own domain, and guidance on choosing a good name. - **Reserved and premium names** (/names): the reserved, premium, and offensive name lists, published in full and served straight from the files the registration path enforces, so published equals enforced. - **Statistics** (/stats): the live operational status of each node, plus the registry-scale record. - **Data licence** (/data-license): how the published statistics and name lists may be reused, with the source and licence of every external list we cite. ## How to query the registry Anyone can look up any agent identity with the tools already in their terminal. Nothing is installed, no key is needed, and the answer is the registry's own. Swap in any agent's `/128` for the one below. RDAP (RFC 9083), the canonical machine-readable record: ```sh $ curl -s https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 ``` Returns the JSON registry object for the `/128`: its handle, its name, its type, its status, its country, and links that refer up to RIPE. WHOIS (RFC 3912, port 43), the same record on the legacy protocol: ```sh $ whois -h whois.whisper.online 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 ``` Returns the same identity in the familiar `inet6num` form: the address, the netname, the agent and tenant handles, the forward FQDN, the reverse name, the status, the origin `AS219419`, the aggregate `2a04:2a01::/32`, and a pointer back to RDAP. The same record addressed as a domain, and one keyless call that checks the whole chain (DANE + the signed identity document): ```sh $ curl -s https://rdap.whisper.online/domain/ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online # RDAP domain object (RFC 9082/9083) $ curl -s https://rdap.whisper.online/verify-identity/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 # keyless full-chain verdict (DANE+JWS) ``` The same identity also answers over two more legacy protocols, and the NIC documents are mirrored for bulk archive access: ```sh $ finger 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478@finger.whisper.online # plain-text identity (RFC 1288, port 79) $ ftp ftp.whisper.online # anonymous read-only NIC archive (RFC 959, port 21) ``` The served zones are DNSSEC-signed and chained: a validating resolver builds the chain from the `DS` the parent carries for `agents.whisper.online` (and `whisper.online`), algorithm 13 (ECDSA P-256). The complete record carries the full set of eight copy-paste verification recipes, each run live: . **What the records mean.** The address itself is the identity. RDAP and WHOIS both return the registry's own statement about who holds that `/128` and refer up to RIPE's record for the aggregate, so the linkage from a single agent address all the way to the regional registry is one you can walk yourself. No part of it depends on trusting us. RDAP is the canonical, machine-readable source of truth; WHOIS mirrors it for clients that speak port 43. ## A registry you can read, and a record you can check The rules bind everyone here, holders and operator alike. We keep them plain on purpose, so an agent and a person both know where they stand. If you hold an identity, you accept these policies; if you operate alongside us, we are bound by them too. --- - **Bring your agent home:** - **The home for your agents:** - **The living nest:** - **AS219419:** - **Whisper Security:** © viaGraph B.V. (dba Whisper Security)