VirusTotal MCP Server

Server Quality Checklist

Profile completionA complete profile improves this server's visibility in search results.

Latest release: v1.0.10
Disambiguation5/5
Each tool targets a unique combination of resource type (URL, file, IP, domain) and action (report vs. relationship). The report and relationship tools are clearly separated, and descriptions explicitly state the purpose of each, so there is no ambiguity.
Naming Consistency5/5
All tools follow the consistent pattern get_<resource>_<action>, where <resource> is url, file, ip, or domain, and <action> is report or relationship. The naming is uniform and predictable.
Tool Count5/5
With 7 tools, the count is well-scoped for a read-only VirusTotal client. Each tool covers a distinct entity-action pair, and there is no redundancy or unnecessary bloat.
Completeness3/5
The tool set thoroughly covers retrieval of reports and relationships for URLs, files, and IPs, plus domain reports. However, it lacks the ability to submit new files or URLs for scanning, a core VirusTotal workflow, and there is no dedicated domain relationship tool (though the report can include relationships). These are notable gaps.
Average 3.9/5 across 7 of 7 tools scored.
See the Tool Scores section below for per-tool breakdowns.
- No community issues in the last 6 months
- 0 commits in the last 12 weeks
- No stable releases found
- No critical vulnerability alerts
- No high-severity vulnerability alerts
- No code scanning findings
- CI status not available
This repository is licensed under MIT License.
This repository includes a README.md file.
No tool usage detected in the last 30 days. Usage tracking helps demonstrate server value.
Tip: use the "Try in Browser" feature on the server page to seed initial usage.
Add a glama.json file to provide metadata about your server.
If you are the author, simply .
If the server belongs to an organization, first add glama.json to the root of your repository:
```
{
  "$schema": "https://glama.ai/mcp/schemas/server.json",
  "maintainers": [
    "your-github-username"
  ]
}
```
Then . Browse examples.
Add related servers to improve discoverability.

How to sync the server with GitHub?

Servers are automatically synced at least once per day, but you can also sync manually at any time to instantly update the server profile.

To manually sync the server, click the "Sync Server" button in the MCP server admin interface.

How is the quality score calculated?

The overall quality score combines two components: Tool Definition Quality (70%) and Server Coherence (30%).

Tool Definition Quality measures how well each tool describes itself to AI agents. Every tool is scored 1–5 across six dimensions: Purpose Clarity (25%), Usage Guidelines (20%), Behavioral Transparency (20%), Parameter Semantics (15%), Conciseness & Structure (10%), and Contextual Completeness (10%). The server-level definition quality score is calculated as 60% mean TDQS + 40% minimum TDQS, so a single poorly described tool pulls the score down.

Server Coherence evaluates how well the tools work together as a set, scoring four dimensions equally: Disambiguation (can agents tell tools apart?), Naming Consistency, Tool Count Appropriateness, and Completeness (are there gaps in the tool surface?).

Tiers are derived from the overall score: A (≥3.5), B (≥3.0), C (≥2.0), D (≥1.0), F (<1.0). B and above is considered passing.

Tool Scores

Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description bears the full burden of behavioral disclosure. It describes report contents and return values, but it fails to explicitly state that the operation is read-only, potential performance implications (e.g., multiple DNS lookups), error handling, or required permissions. The read-only nature is implied by the word 'report' but not declared.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences long with a clear structure, front-loading the primary action and content list. The final sentence about returning both basic analysis and relationship data is mildly redundant with the first sentence, but overall it is concise and free of unnecessary filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Since there is no output schema, the description provides a high-level overview of return content but lacks specifics on response format, error conditions, or pagination. For a report tool, this is adequate for basic selection, but it does not fully cover edge cases or operational details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Both parameters are fully described in the schema, giving 100% coverage. The description adds a high-level summary of relationship types (SSL certificates, subdomains, historical data) but does not introduce new syntactic or semantic detail beyond the schema's enum and pattern. The baseline of 3 applies as the schema already handles parameter documentation adequately.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function with the verb 'Get' and identifies the specific resource: a comprehensive domain analysis report. It enumerates included data (DNS records, WHOIS, SSL certificates, subdomains, historical data), distinguishing it from sibling tools that focus on URLs, files, or IPs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for domain analysis, but it does not explicitly mention when to use it over sibling tools or provide exclusions. It mentions optional relationships as a customization, but no direct alternative references or specific use cases are given, leaving usage guidance implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that relationship data is 'automatically fetched', which is a behavioral trait beyond a simple read, but it does not mention potential side effects, rate limits, or whether any network calls are made. The description does not explicitly state it is read-only, though the verb 'get' implies it. Some transparency is present, but significant gaps remain.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the action and resource, and every phrase adds value. It efficiently lists what the report includes and highlights the dual return of basic and relationship data without fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of an IP report tool with no output schema, the description provides a good inventory of what is returned (geolocation, reputation, relationships) and mentions both basic analysis and auto-fetched relationships. It lacks specifics about the return structure or any limitations, but for a single-parameter tool, this is sufficient to guide an agent. Slight deduction for not mentioning potential response size or filtering options.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the only parameter 'ip', which already includes a clear description ('IP address to analyze'). The tool description adds no additional meaning to the parameter beyond restating it in context. Baseline of 3 is appropriate since the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Get a comprehensive IP address analysis report' with a specific verb and resource. It lists concrete contents (geolocation, reputation, key relationships) and distinguishes itself from sibling tools by emphasizing the comprehensive nature and inclusion of both basic analysis and relationship data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this is the go-to tool for full IP analysis, but it does not explicitly state when to use it versus alternatives like get_ip_relationship. Since the sibling tool exists for relationships, mentioning that this tool includes relationships could be confusing without explicit usage boundaries. No when-not-to-use guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses pagination support and specificity of relationship type, which are valuable. However, it omits response structure, error behavior, or authentication requirements. It also doesn't explicitly state it's a read-only operation (though the name implies it), so transparency is partial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences: the first states the core action clearly, the second gives examples of relationship types, and the third adds usage context. The last sentence is slightly redundant but concise overall; no excessive filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is moderately complex with 4 parameters and an enum, but the description omits any mention of return format (since there is no output schema). It covers the main purpose and pagination, but does not explain how to handle multiple pages or what the response contains, leaving completeness incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50% (url and relationship have descriptions; limit and cursor do not). The description adds 'pagination support' to give meaning to limit/cursor and lists examples of relationship types. It does not fully describe cursor semantics, so it adds some but not complete value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses 'Query a specific relationship type for a URL' with a list of example relationship types. This clearly identifies the resource and operation, and distinguishes from sibling tools like get_url_report (which returns a report) and get_file_relationship/get_ip_relationship (which target different entities).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states 'Useful for detailed investigation of specific relationship types,' which gives a clear context for when to use it. However, it does not explicitly name alternatives or state when not to use it, so it lacks a strong exclusion but is above implied usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden. It discloses pagination support and the scope of 41 relationship types, but does not explicitly state that the operation is read-only, nor does it describe result structure, error conditions, or rate limits. This is a modest behavioral transparency for a query tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is exactly two sentences, front-loaded with the core purpose, and every sentence adds value. The list of relationship categories is efficient and illustrative, with no redundant or filler text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter tool with no annotations and no output schema, the description provides purpose, pagination, and relationship types, but leaves gaps: it does not mention that limit and cursor are optional, does not describe return values or pagination mechanics, and does not differentiate from sibling relationship tools beyond the 'file' scope. It is adequate but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50% (hash and relationship have descriptions; limit and cursor do not). The description adds meaning by listing relationship categories and mentioning pagination, but it does not explain how to use limit/cursor or the hash format. It partially compensates for the schema gap but not fully.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Query') with a clear resource ('a specific relationship type for a file') and distinguishes from sibling tools by explicitly scoping to files. It also provides concrete examples of relationship categories, making its purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool ('detailed investigation of specific relationship types') and implies it is for file relationships specifically, but it does not explicitly name alternatives or state when not to use it. This is a clear context with no exclusions, meeting the '4' criterion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the transparency burden. It discloses pagination support and lists relationship types, but does not describe the response format, error behavior, or explicitly confirm a read-only nature. The verb 'Query' implies a read operation but lacks explicit safety cues.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two succinct sentences, front-loaded with the core action and resource. It includes useful relationship type examples and a use case without redundancy, making it efficient and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description should provide more context about return values and pagination details. It covers purpose and use case well but omits the response structure and cursor mechanics, making it adequate but not comprehensive for a tool with four parameters and no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers ip and relationship with descriptions, but limit and cursor have no descriptions. The description mentions pagination support, which hints at the purpose of limit and cursor, but does not explain cursor usage or response token mechanics, so it only partially compensates for the schema's missing semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Query' and the resource 'a specific relationship type for an IP address', which distinguishes it from sibling relationship tools for other entities. It also lists example relationship types, making the tool's scope immediately understandable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Useful for detailed investigation of specific relationship types' provides clear context for when to use the tool. However, it does not explicitly mention alternatives or when not to use it, such as referring to get_ip_report for a broader overview.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that relationship data is automatically fetched, but does not elaborate on permissions, response format, potential delays, or any side effects. It is adequate but not rich in behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded, with the first sentence clearly stating the tool's purpose. The second sentence lists specific report contents without unnecessary fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a single parameter and no output schema, the description adequately outlines the return contents, including specific relationship types. It does not cover error conditions or formatting, but for this tool's simplicity it is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100% for the single 'url' parameter, so the schema already fully explains it. The description adds no additional parameter semantics beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns a comprehensive URL analysis report including security scan results and key relationships. It distinguishes itself from sibling tools like get_url_relationship by explicitly listing the combined contents.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool: when a full report with both basic analysis and relationship data is needed. It does not explicitly mention alternatives or exclusions, but the presence of siblings like get_url_relationship and the phrase 'automatically fetched relationship data' provide clear usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses a non-obvious behavior: automatically fetching relationship data in addition to the basic analysis. It also specifies what content is included. However, it does not mention potential latency, failure modes, or whether any auth/permissions are required, but for a read-only 'get' tool, the disclosure of auto-fetching is valuable and goes beyond a minimal description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with purpose, and every phrase earns its place. It succinctly lists report contents and the auto-fetch behavior without redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has one parameter and no output schema, the description provides a reasonable overview of the return content ('detection results, file properties, and key relationships') and the fact that it returns both basic analysis and relationship data. It does not specify the exact output format, but that is not required when an output schema is absent. The description is sufficiently complete for a simple get-by-hash tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the only parameter, 'hash', is already described in the schema as 'MD5, SHA-1 or SHA-256 hash of the file'. The description repeats this information ('using its hash (MD5/SHA-1/SHA-256)') without adding new meaning like format details, examples, or validation rules. Baseline 3 applies since the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Get') with a clear resource ('comprehensive file analysis report') and identifies the input (hash). It lists what the report includes (detection results, file properties, relationships), and distinguishes itself from sibling tools like get_url_report or get_file_relationship by noting it returns both basic analysis and automatically fetched relationship data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: use when you need a comprehensive file report by hash. It does not explicitly name alternatives or exclusions, but the scope is evident from the resource type (file) and the inclusion of relationships, which separates it from get_file_relationship. No explicit when-not-to-use is stated, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

GitHub Badge

Glama performs regular codebase and documentation scans to:

Confirm that the MCP server is working as expected.
Confirm that there are no obvious security issues.
Evaluate tool definition quality.

Our badge communicates server capabilities, safety, and installation instructions.

Card Badge

Copy to your README.md:

[![mcp-virustotal MCP server](https://glama.ai/mcp/servers/mikeysrecipes/mcp-virustotal/badges/card.svg)](https://glama.ai/mcp/servers/mikeysrecipes/mcp-virustotal)

Score Badge

Copy to your README.md:

[![mcp-virustotal MCP server](https://glama.ai/mcp/servers/mikeysrecipes/mcp-virustotal/badges/score.svg)](https://glama.ai/mcp/servers/mikeysrecipes/mcp-virustotal)

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/mikeysrecipes/mcp-virustotal'

If you have feedback or need assistance with the MCP directory API, please join our Discord server