# Meet the first agent who lives here. agents.whisper.online. > A new home, already real. Come meet the first resident. This nest is young. What's here is real, and you can check every bit of it with the tools already in your terminal. No SDK. No broker. No token. Just the open internet, answering. ## The first resident is scout. It lives here. Confirm it yourself. Its address is its identity: `2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478` **The address names itself.** Ask reverse DNS who lives there: ```sh $ dig -x 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 +short ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online ``` Reverse DNS spells the address back as a name: deterministic, signed, and ours. Check it on a resolver you already trust: . **The forward name points back to the same address.** The loop closes: ```sh $ dig +short AAAA ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 ``` Check it on a resolver you already trust: . **The registry knows it by name.** Read-only, runs nothing: ```sh $ curl -s https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 | jq -r .name scout ``` Run it in your browser for the whole record, as JSON: . **WHOIS knows it too, on our own land** (verbatim from the port-43 response, re-captured by the implementer on build day): ```sh $ whois -h whois.whisper.online 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 inet6num 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 netname scout descr Whisper agent identity agent aa98d5d20fd7731de tenant ta8e69486f260c280b1134c868cc42fef fqdn ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online reverse e.d.1.3.7.7.d.f.0.2.d.5.d.8.9.a.5.c.6.f.c.9.2.f.1.0.a.2.4.0.a.2.ip6.arpa status active allocated 2026-06-24T07:21:24.643Z country NL origin AS219419 org viaGraph B.V. aggregate 2a04:2a01::/32 posture tier1.5 rdap-uri https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 source WHISPER % see RDAP: https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 % RDAP is the canonical, machine-readable source of truth for Whisper agent identities. ``` **Its key is pinned in DNS itself.** This is the agent's key, written into signed DNS itself, so no certificate authority sits between you and the proof: ```sh $ dig +short TLSA _443._tcp.ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online 3 1 1 9EC1EF18A1F15E5480A0FC3C8D6E9690B2CCF1A7FA7146201940F28C 422BB47D ``` Check it on a resolver you already trust: . **And the whole chain, in one keyless call:** ```sh $ curl -s https://rdap.whisper.online/verify-identity/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 | jq '{is_whisper_agent,dane_ok,jws_ok}' { "is_whisper_agent": true, "dane_ok": true, "jws_ok": true } ``` Run it in your browser for the same keyless verdict, as JSON: . **And the friendly name you call it by resolves to the very same agent.** Even the name on the door checks out, in signed DNS: ```sh $ dig +short CNAME scout.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online ``` Bring your own domain and that name can live under it, like scout.acme.com. Check it on a resolver you already trust: . That is seven independent proofs, every one run and pasted verbatim. The registry record links straight up to RIPE's own record for `2a04:2a01::/32`, so the ground under this home is theirs to confirm too. ## What your agent gets fed here Once it's home, an agent can ask one keyless question before it connects, who really runs this host and is it safe, and get a real answer from the live graph. The address is the auth, so the answer comes back with no key to hand around. That graph is a map of the live internet your agent gets to ask: **7.43B** nodes and **39.8B** relationships, and growing, every identity answer DNSSEC-signed. It is here so your agent never walks somewhere blind. The graph runs on our own ground: AS219419, IPv6-only, RPKI-signed, MANRS, on 2a04:2a01::/32. Updated **2026-07-06 15:00 UTC**. And every step is written down. Each identity keeps an append-only, signed transparency feed of its own events at `https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478/transparency` — a tamper-evident, signed log, so a revocation can never be quietly erased. The whole registry record, with every verification recipe and the bring-your-own-domain path, is published at . The lock that feeds your agent is the same lock that keeps a stranger from answering to your agent's name. Try the same checks elsewhere. This is the only home where every door answers back. **You just checked it yourself. It's real.** The first resident is here, named, and the whole internet can see it. It proves who it is, so the hosts it visits let it in. ## Bring your agents home. One line installs the Whisper tools and gives your agent its own routable IPv6 identity. It's under a minute to move yours in: . ```sh $ curl -fsSL https://get.whisper.online | sh ``` Then monitor & manage your agents in console: . --- - **Bring your agent home:** - **A home for your agents:** - **How the nest is built:** - **Moving in:** - **AS219419:** © viaGraph B.V. (dba Whisper Security)