Skip to main content
Glama
VirusTotal

VirusTotal MCP

Official

Get a VTAI submission receipt

get_submission
Read-onlyIdempotent

Retrieve a submission receipt and original analysis ID using either a file's SHA256 hash or a network operation's request ID, without uploading or consuming query quota.

Instructions

Recover the current account's receipt with exactly one sha256 or request_id.

SHA256 identifies a file; a retained UUIDv4 request_id identifies a network operation. No upload, upstream call or query quota. Submitted yields the original analysis ID. Unknown can be permanent; do not automatically repeat a POST or generate a new request ID. Rejected is terminal for its request ID; correct the cause or wait before intentionally starting a new operation.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
sha256No
request_idNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.9.1

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly and idempotent, but the description adds substantial behavioral detail beyond that: it explains the no-quota/no-upload cost profile, and details the statuses (Submitted, Unknown, Rejected) with their consequences (yields analysis ID, can be permanent, terminal for request ID). This is rich, non-redundant context that materially helps an agent avoid harmful retries.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact yet information-dense. It opens with the core action and input rule, then explains the two identifiers, then the behavioral cautions. Every sentence earns its place; there is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there is no output schema, the description provides essential return semantics (Submitted yields the original analysis ID) and status behaviors, which covers most needs. However, it does not describe the full receipt structure or the exact response fields an agent would parse, leaving some ambiguity for programmatic handling. This is a minor gap given the otherwise thorough guidance.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must carry all meaning. It fully explains both parameters: SHA256 identifies a file, and a retained UUIDv4 request_id identifies a network operation. It also adds the mutual-exclusivity constraint, which the schema does not enforce. This completely compensates for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool recovers the current account's receipt, and immediately specifies the exact input constraints ('exactly one sha256 or request_id'). It distinguishes itself from siblings like get_file_report and get_analysis by focusing on receipts rather than reports, and the identifier semantics are explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear usage conditions: exactly one sha256 or request_id, and explains the meaning of each. It also warns against automatically repeating POSTs or generating new request IDs, which is critical guidance. However, it does not explicitly contrast with sibling report tools, so an agent must infer that this is for receipts rather than analyses.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.