Virustotal
burtthecoder/mcp-virustotal
A solid wrapper around the VirusTotal API that brings security analysis directly into Claude Desktop and other MCP clients. You get the standard quartet of URL, file hash, IP, and domain lookups, plus relationship queries for digging into connected threats, dropped files, network connections, and behavioral data. The automatic relationship fetching is handy since it pulls relevant context data alongside basic reports without extra API calls. Supports pagination for deep analysis and includes both stdio and HTTP streaming transports. Grab a VirusTotal API key, drop it in your config, and you're analyzing suspicious URLs and file hashes through natural language queries.
- GitHub stars
- 133
- tools
- 11
- auth
- Secret needed
- transport
- STDIO
- env var
- 1
- last updated
- Mar 3, 2026
Tools
11 toolsPublic tool metadata for what this MCP can expose to an agent.
get_file_reportFetches a file report with key relationships in one batched call.
Fetches a file report with key relationships in one batched call.
No parameter schema in public metadata yet.
get_url_reportReturns the cached VirusTotal report and only submits a scan on a cache miss.
Returns the cached VirusTotal report and only submits a scan on a cache miss.
No parameter schema in public metadata yet.
get_ip_reportFetches an IP address report with key relationships in one batched call.
Fetches an IP address report with key relationships in one batched call.
No parameter schema in public metadata yet.
get_domain_reportFetches a domain report with key relationships in one batched call.
Fetches a domain report with key relationships in one batched call.
No parameter schema in public metadata yet.
get_file_relationshipPages through file relationships with cursor pagination.
Pages through file relationships with cursor pagination.
No parameter schema in public metadata yet.
get_url_relationshipPages through URL relationships with cursor pagination.
Pages through URL relationships with cursor pagination.
No parameter schema in public metadata yet.
get_ip_relationshipPages through IP address relationships with cursor pagination.
Pages through IP address relationships with cursor pagination.
No parameter schema in public metadata yet.
get_domain_relationshipPages through domain relationships with cursor pagination.
Pages through domain relationships with cursor pagination.
No parameter schema in public metadata yet.
search_vtSearches the VirusTotal corpus using VTI-style modifiers.
Searches the VirusTotal corpus using VTI-style modifiers.
No parameter schema in public metadata yet.
get_file_behaviour_summaryReturns a merged sandbox behaviour summary for a file.
Returns a merged sandbox behaviour summary for a file.
No parameter schema in public metadata yet.
get_collectionRetrieves threat-actor and malware-family collections.
Retrieves threat-actor and malware-family collections.
No parameter schema in public metadata yet.
Sponsors
Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthly
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any language
Agent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any languageConfiguration
VIRUSTOTAL_API_KEY*secretYour VirusTotal API key
Readme
Details
- Repository
- github.com/burtthecoder/mcp-virustotal
- Category
- Security & Pentesting
- Package
@burtthecoder/mcp-virustotal- Transport
- STDIO
- Auth
- Required
- Registry
- MCP registry, active
