VirusTotal is a free online service that analyzes files and URLs for viruses, worms, trojans and other kinds of malicious content. It aggregates many antivirus products and online scan engines to check for threats that the user's own antivirus may have missed.
AI-powered OSINT framework exposing 10 tools (email, username, breach, WHOIS, IP, subdomain, phone, Shodan, dorks, Pastebin) as an MCP server for Claude Code and Claude Desktop, with an autonomous agent REPL and direct CLI.
Last updated
2
20
1,177
MIT
Why this server?
Provides tools for domain reputation analysis, threat detections, and subdomain enumeration by querying the VirusTotal API.
A comprehensive reconnaissance toolset that provides AI agents with 37 tools across 12 data sources like Shodan and VirusTotal for automated intelligence gathering. It enables agents to perform domain reconnaissance, attack surface mapping, and cross-platform data correlation within a single conversational interface.
Last updated
2
37
281
2
MIT
Why this server?
Automatically routes requests to VirusTotal through Tor to anonymize the origin IP, as it is a default OSINT/security target.
Routes web requests from AI tools through Tor for anonymized fetching, with selective per-URL routing to bypass Tor-blocking sites.
Last updated
8
4
1
MIT
Why this server?
Enables querying VirusTotal/Google Threat Intelligence for file hash, URL, domain, and IP analysis, providing reputation data and threat intelligence reports.
Enables MCP clients to interact with SentinelOne's cybersecurity platform for security analysis, threat investigation, and asset management through natural language queries. Provides read-only access to alerts, vulnerabilities, misconfigurations, and inventory data.
Last updated
33
86
MIT
Why this server?
Enriches threat intelligence by querying VirusTotal for malware and reputation data (optional API key).
A universal digital fingerprinting MCP server that combines 103 techniques across TCP, TLS, SSH, HTTP, DNS, and more into a single interface for AI agents, enabling full-spectrum fingerprinting on demand.
Last updated
2
13
181
3
AGPL 3.0
Why this server?
Provides security scanning capabilities through Domain Shield and Threat Pulse endpoints, utilizing VirusTotal's 70+ engine malware detection and threat intelligence for comprehensive domain security analysis.
Universal x402 buyer agent — discover, pay for, and call any x402 paid API endpoint from Claude Desktop, Cursor, or Claude Code with automatic USDC payment via AgentCash.
Last updated
4
17
MIT
Why this server?
Leverages VirusTotal's malware scanning capabilities for domain security analysis (SPF, DKIM, DMARC, SSL, MX, DNSSEC + 70+ malware engines) and threat intelligence (blacklists, ports, SSL analysis, IP abuse reports).
MCP server for Alderpost Intelligence API — 8 x402 endpoints bundling premium data sources (VirusTotal, People Data Labs, Hunter.io, AbuseIPDB, SSL Labs, NIH RxNorm) into scored intelligence responses. Pay per call via USDC on Base.
Last updated
8
16
1
MIT
Why this server?
Allows querying the VirusTotal API for comprehensive security analysis reports including URL analysis, file analysis, IP analysis, domain analysis, and relationship tools.
An MCP server for the Cortex observable analysis and active response engine. It enables LLMs to automate security investigations by running analyzers on observables like IPs and URLs and executing automated response actions.
