osint-mcp-server

Instructions

Implementation Reference

• src/virustotal/index.ts:66-88 (handler)

  Handler implementation for the vt_domain tool.

  export async function vtDomain(domain: string, apiKey: string): Promise<VtDomainResult> {
    const cacheKey = `vt:domain:${domain}`;
    const cached = cache.get(cacheKey);
    if (cached) return cached;
  
    const data = await vtFetch(`/domains/${encodeURIComponent(domain)}`, apiKey);
    if (!data) throw new Error(`Domain ${domain} not found on VirusTotal`);
  
    const attrs = data.data?.attributes ?? {};
    const result: VtDomainResult = {
      domain,
      reputation: attrs.reputation ?? 0,
      analysisStats: attrs.last_analysis_stats ?? { malicious: 0, suspicious: 0, undetected: 0, harmless: 0 },
      categories: attrs.categories ?? {},
      registrar: attrs.registrar,
      creationDate: attrs.creation_date,
      lastAnalysisDate: attrs.last_analysis_date,
      dnsRecords: attrs.last_dns_records?.map((r: any) => ({ type: r.type, value: r.value })),
    };
  
    cache.set(cacheKey, result);
    return result;
  }

• src/protocol/tools.ts:182-192 (registration)

  Tool registration and schema definition for vt_domain.

  const vtDomainTool: ToolDef = {
    name: "vt_domain",
    description: "VirusTotal domain analysis: reputation score, detection stats, categories, registrar, DNS records. Requires VT_API_KEY.",
    schema: {
      domain: z.string().describe("Domain to analyze"),
    },
    execute: async (args, ctx) => {
      const key = requireApiKey(ctx.config.vtApiKey, "VirusTotal", "VT_API_KEY");
      return json(await vtDomain(args.domain as string, key));
    },
  };

• src/virustotal/index.ts:18-27 (schema)

  Result interface definition for the vt_domain tool.

  interface VtDomainResult {
    domain: string;
    reputation: number;
    analysisStats: VtAnalysisStats;
    categories: Record<string, string>;
    registrar?: string;
    creationDate?: number;
    lastAnalysisDate?: number;
    dnsRecords?: { type: string; value: string }[];
  }