vulnerability-exposure-mcp

Overview Schema Source Related Servers Discussions Admin

VirusTotal reputation

virustotal_check

Read-onlyIdempotent

Check a public IP or domain against VirusTotal to see how many security engines flag it as malicious or suspicious, helping assess reputation and exposure.

Instructions

VirusTotal reputation: how many security engines flag the IP/domain as malicious or suspicious. Needs VIRUSTOTAL_API_KEY.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "target": "<target>",
      "target_type": "<target_type>"
    },
    "name": "virustotal_check"
  }
}

Input Schema

Name	Required	Description
`target`	Yes	The public IP or domain to check.
`target_type`	Yes	Whether target is an IP or a domain.
`investigation_id`	No	The investigation_id from investigate_target. Pass it so the result counts toward that investigation's evidence, budget and key facts; without it the lookup runs on its own.

Schema Changelog

Changes observed during successful MCP inspections.

Changed3 schema fields changedv1.0.1Oct 29, 2026

addedInput schema / properties / investigation_id / description

Added value: +"The investigation_id from investigate_target. Pass it so the result counts toward that investigation's evidence, budget and key facts; without it the lookup runs on its own."

addedInput schema / properties / target / description
```
Added value: +"The public IP or domain to check."
```
addedInput schema / properties / target_type / description
```
Added value: +"Whether target is an IP or a domain."
```

First observedv0.1.0Oct 25, 2026

TDQS

B3.2/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint and destructiveHint=false, so the safety profile is covered. The description adds two genuinely useful facts beyond that: the API key dependency and the qualitative shape of the answer (engine flag counts). It does not mention the well-known VirusTotal rate limit, which materially affects how an agent should call this.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with purpose and followed by the one hard prerequisite. No waste, though it is arguably over-compressed given the tool's complexity and the missing rate-limit caveat.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With full schema coverage and annotations present, the description need only frame purpose and prerequisites, which it does. However, for an open-world external API tool with no output schema, it omits rate-limit/quotas and result-format expectations that an agent needs to call it correctly and to interpret throttling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with clear descriptions for target, target_type (enum ip/domain) and investigation_id, so the schema does the heavy lifting. The description adds no parameter-level meaning beyond what is already structured, which is the expected baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific resource (VirusTotal reputation for an IP/domain) and what the result means: how many security engines flag it as malicious or suspicious. An agent can tell this is a reputation lookup without opening the schema, though it never explicitly contrasts itself with abuseipdb_check or threat_lists_check, which are similar siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The only guidance is the prerequisite 'Needs VIRUSTOTAL_API_KEY.' There is no statement of when to prefer this over abuseipdb_check, threat_lists_check, or shodan_search, and no exclusions (e.g. rate limits, private IPs). Usage must be inferred from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.