virustotal-mcp-server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MCP_TRANSPORT | No | Transport mode: sse (default) or stdio | sse |
| VIRUSTOTAL_API_KEY | Yes | Your VirusTotal API key |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get_url_reportA | Get comprehensive URL analysis report with security results and relationships. Args: url: The URL to analyze Returns: str: Formatted analysis report with detection summary and relationships |
| get_file_reportA | Get a comprehensive file analysis report using its hash. Args: file_hash: MD5, SHA-1 or SHA-256 hash of the file Returns: str: Formatted analysis report with detection summary and relationships |
| get_ip_reportA | Get a comprehensive IP address analysis report. Args: ip: IP address to analyze Returns: str: Formatted analysis report with detection summary and relationships |
| get_domain_reportA | Get a comprehensive domain analysis report. Args: domain: Domain name to analyze relationships: Optional list of specific relationships to include Returns: str: Formatted analysis report with detection summary and relationships |
| get_url_relationshipA | Query a specific relationship type for a URL with pagination support. Args: url: The URL to get relationships for relationship: Type of relationship to query limit: Maximum number of related objects to retrieve (1-40) cursor: Continuation cursor for pagination Returns: str: Formatted relationship data |
| get_file_relationshipA | Query a specific relationship type for a file with pagination support. Args: file_hash: MD5, SHA-1 or SHA-256 hash of the file relationship: Type of relationship to query limit: Maximum number of related objects to retrieve (1-40) cursor: Continuation cursor for pagination Returns: str: Formatted relationship data |
| get_ip_relationshipA | Query a specific relationship type for an IP address with pagination support. Args: ip: IP address to analyze relationship: Type of relationship to query limit: Maximum number of related objects to retrieve (1-40) cursor: Continuation cursor for pagination Returns: str: Formatted relationship data |
| get_domain_relationshipA | Query a specific relationship type for a domain with pagination support. Args: domain: Domain name to analyze relationship: Type of relationship to query limit: Maximum number of related objects to retrieve (1-40) cursor: Continuation cursor for pagination Returns: str: Formatted relationship data |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 8 tools
Each tool targets a distinct resource type (URL, file, IP, domain) combined with a distinct action (report vs relationship). There is no overlap or ambiguity between tools; an agent can easily select the right one based on resource and intent.
All tool names follow a clear and consistent verb_noun pattern: get_<resource>_report and get_<resource>_relationship. The naming is uniform, predictable, and uses snake_case throughout.
With exactly 8 tools, the set is well-scoped for the domain. Each tool covers a core API operation for one of four resource types, and no redundant or unnecessary tools exist.
The tool surface covers report retrieval and relationship queries for all major VirusTotal resources (URL, file, IP, domain). It lacks submission/scanning tools, but for a read-focused MCP server the coverage is quite complete; only a minor gap.