VirusTotal is a free online service that analyzes files and URLs for viruses, worms, trojans and other kinds of malicious content. It aggregates many antivirus products and online scan engines to check for threats that the user's own antivirus may have missed.
Exposes an OSINT investigation toolkit to any MCP-compatible AI client, which can drive passive checks such as DNS, WHOIS/RDAP, breach, IP reputation, GitHub and news-geo lookups and chain findings across them. The server lists 20 tools by default (16 passive plus 4 graph and batch helpers) and 25 when active checks are explicitly allowed, running via uvx with no separate install.
8
20
MIT
Why this server?
Provides VirusTotal intelligence tools for files, URLs, domains, and IP addresses, including report lookups, file submission, and analysis recovery via VTAI.
AI-powered OSINT framework exposing 10 tools (email, username, breach, WHOIS, IP, subdomain, phone, Shodan, dorks, Pastebin) as an MCP server for Claude Code and Claude Desktop, with an autonomous agent REPL and direct CLI.
20
901 PyPI
1,829
MIT
Why this server?
Enables querying VirusTotal/Google Threat Intelligence for file hash, URL, domain, and IP analysis, providing reputation data and threat intelligence reports.
Enables MCP clients to interact with SentinelOne's cybersecurity platform for security analysis, threat investigation, and asset management through natural language queries. Provides read-only access to alerts, vulnerabilities, misconfigurations, and inventory data.
33
101
MIT
Why this server?
Provides IP and domain reputation checks using VirusTotal engines when a VirusTotal API key is configured.
Checks public IPs, domains, CVE IDs and software versions for confirmed vulnerabilities and exposure, using NVD version ranges, CISA KEV, EPSS, distro backports and published exploits. All API keys are optional.
19
420 PyPI
1
MIT
Why this server?
Provides threat intelligence lookups via VirusTotal, including file hash reputation, URL safety checks, and related malware/ransomware intelligence capabilities.
Enables vulnerability lookup and triage across NVD, EPSS, CISA KEV, OSV, and many other sources, while tracking an estate's exposure changes from SBOMs and lockfiles through snapshots and prioritized diffs.
32
Apache 2.0
Why this server?
Provides optional threat-intelligence enrichment for URL, domain, and IP checks by querying the VirusTotal API when enrichment is enabled and an API key is configured. It sends the indicator to VirusTotal and returns additional reputation data alongside USOM results.
Enables AI agents to check whether URLs, domains, and IPv4/IPv6 addresses appear on Türkiye's national malicious-link list, returning verdicts with match type, record date, source, category, and criticality. It also lets users register their own domains and networks on a local watch list and scan them in a single call, backed by a local SQLite cache for millisecond lookups with live-API fallback.
10
MIT
Why this server?
Provides tools for querying VirusTotal reports on files, URLs, domains, and IP addresses, and retrieving analysis results from the VirusTotal API.
Enables AI agents to access VirusTotal intelligence through MCP, supporting file, URL, domain, and IP lookups, plus analysis, via remote HTTP or local stdio.
8
MIT
Why this server?
Provides access to VirusTotal threat intelligence, enabling security analysts to enrich investigations with reputation data on files, URLs, domains, and IP addresses.
Enables security analysts to investigate Microsoft Entra ID security logs through natural language, exposing read-only tools for user context, sign-ins, risky users, risk detections, directory audits, and conditional access policies.
