Skip to main content
Glama
VirusTotal

VirusTotal MCP

Official

Get a VTAI submission receipt

get_submission
Read-onlyIdempotent

Recover the current account's submission receipt using exactly one SHA256 or request_id to retrieve the original analysis ID without uploads or query quota.

Instructions

Recover the current account's receipt with exactly one sha256 or request_id.

SHA256 identifies a file; a retained UUIDv4 request_id identifies a network operation. No upload, upstream call or query quota. Submitted yields the original analysis ID. Unknown can be permanent; do not automatically repeat a POST or generate a new request ID. Rejected is terminal for its request ID; correct the cause or wait before intentionally starting a new operation.

Input Schema

NameRequiredDescriptionDefault
sha256No
request_idNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.9.1

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive/closed-world, so the bar is lower, and the description still adds material context: no upload, upstream call, or query quota is consumed, and it documents the status lifecycle (Submitted, Unknown permanent, Rejected terminal). It does not describe what happens if zero or both identifiers are supplied, which is the main remaining gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core constraint is front-loaded in the first sentence and no sentence is pure filler. The remainder is telegraphic and dense ('Submitted yields the original analysis ID. Unknown can be permanent'), which costs some readability but not accuracy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, yet the description covers the return semantics an agent needs (Submitted yields the original analysis ID; status outcomes). It omits the degenerate input cases (neither/both identifiers) and the receipt's own shape, leaving a small but real gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% — the schema only has bare 'sha256' and 'request_id' names. The description fully compensates, defining sha256 as file identity, request_id as a retained UUIDv4 for a network operation, and imposing the mutual-exclusion rule the schema does not encode (both are nullable/optional).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: 'Recover the current account's receipt' keyed by sha256 or request_id. The sha256-vs-request_id distinction ('a file' vs 'a network operation') separates it from hash-only siblings like get_file_report, but it never explicitly names get_analysis or get_file_report as the alternative, so the differentiation is inferential rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives real context: 'exactly one' of the two identifiers, plus explicit state-dependent guidance ('do not automatically repeat a POST or generate a new request ID' on Unknown; 'Rejected is terminal... correct the cause or wait'). It stops short of naming which sibling to call instead in the retrieval case, so it is strong implied usage rather than full when/when-not routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.