OSINT MCP Server

Implementation Reference

• src/tools/virustotal.ts:37-65 (handler)

  The handler implementation for getUrlReputation that fetches reputation data from VirusTotal API.

  async getUrlReputation(url: string): Promise<VirusTotalResult> {
    const apiKey = configManager.get("VIRUSTOTAL_API_KEY");
    if (!apiKey) {
      throw new McpError(
        ErrorCode.InvalidRequest,
        "VIRUSTOTAL_API_KEY is not configured"
      );
    }
  
    // URL ID is the base64 string of the URL (no padding)
    const urlId = Buffer.from(url).toString("base64").replace(/=/g, "");
  
    try {
      const data = await this.fetch<{ data: any }>(`urls/${urlId}`, {
        method: "GET",
        headers: {
          "x-apikey": apiKey,
        },
      });
  
      return VirusTotalResultSchema.parse(data.data);
    } catch (error) {
      if (error instanceof McpError) throw error;
      throw new McpError(
        ErrorCode.InternalError,
        `VirusTotal error: ${(error as Error).message}`
      );
    }
  }

• src/tools/virustotal.ts:6-25 (schema)

  Zod schema definition for the VirusTotal URL reputation result.

  export const VirusTotalResultSchema = z.object({
    id: z.string(),
    type: z.string(),
    attributes: z.object({
      last_analysis_stats: z.object({
        harmless: z.number(),
        malicious: z.number(),
        suspicious: z.number(),
        timeout: z.number(),
        undetected: z.number(),
      }),
      last_analysis_results: z.record(z.any()),
      reputation: z.number(),
      total_votes: z.object({
        harmless: z.number(),
        malicious: z.number(),
      }),
      url: z.string(),
    }),
  });

• src/index.ts:218-227 (registration)

  Registration of the 'url_reputation' tool in the MCP server.

  server.tool(
    "url_reputation",
    { url: z.string().url().describe("URL to check reputation on VirusTotal") },
    async ({ url }) => {
      const result = await vtClient.getUrlReputation(url);
      return {
        content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
      };
    }
  );