VirusTotal MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| VIRUSTOTAL_API_KEY | Yes | Your VirusTotal API key |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get_url_reportA | Get a comprehensive URL analysis report including security scan results and key relationships (communicating files, contacted domains/IPs, downloaded files, redirects, threat actors). Returns both the basic security analysis and automatically fetched relationship data. |
| get_url_relationshipA | Query a specific relationship type for a URL with pagination support. Choose from 17 relationship types including analyses, communicating files, contacted domains/IPs, downloaded files, graphs, referrers, redirects, and threat actors. Useful for detailed investigation of specific relationship types. |
| get_file_reportA | Get a comprehensive file analysis report using its hash (MD5/SHA-1/SHA-256). Includes detection results, file properties, and key relationships (behaviors, dropped files, network connections, embedded content, threat actors). Returns both the basic analysis and automatically fetched relationship data. |
| get_file_relationshipA | Query a specific relationship type for a file with pagination support. Choose from 41 relationship types including behaviors, network connections, dropped files, embedded content, execution chains, and threat actors. Useful for detailed investigation of specific relationship types. |
| get_ip_reportA | Get a comprehensive IP address analysis report including geolocation, reputation data, and key relationships (communicating files, historical certificates/WHOIS, resolutions). Returns both the basic analysis and automatically fetched relationship data. |
| get_ip_relationshipA | Query a specific relationship type for an IP address with pagination support. Choose from 12 relationship types including communicating files, historical SSL certificates, WHOIS records, resolutions, and threat actors. Useful for detailed investigation of specific relationship types. |
| get_domain_reportB | Get a comprehensive domain analysis report including DNS records, WHOIS data, and key relationships (SSL certificates, subdomains, historical data). Optionally specify which relationships to include in the report. Returns both the basic analysis and relationship data. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Each tool targets a unique combination of resource type (URL, file, IP, domain) and action (report vs. relationship). The report and relationship tools are clearly separated, and descriptions explicitly state the purpose of each, so there is no ambiguity.
All tools follow the consistent pattern get_<resource>_<action>, where <resource> is url, file, ip, or domain, and <action> is report or relationship. The naming is uniform and predictable.
With 7 tools, the count is well-scoped for a read-only VirusTotal client. Each tool covers a distinct entity-action pair, and there is no redundancy or unnecessary bloat.
The tool set thoroughly covers retrieval of reports and relationships for URLs, files, and IPs, plus domain reports. However, it lacks the ability to submit new files or URLs for scanning, a core VirusTotal workflow, and there is no dedicated domain relationship tool (though the report can include relationships). These are notable gaps.