VirusTotal MCP Server

get_file_relationship

Query a specific relationship type for a file with pagination support. Choose from 41 relationship types including behaviors, network connections, dropped files, embedded content, execution chains, and threat actors. Useful for detailed investigation of specific relationship types.

Input Schema

NameRequiredDescriptionDefault
cursorNo
hashYesMD5, SHA-1 or SHA-256 hash of the file
limitNo
relationshipYesType of relationship to query

Input Schema (JSON Schema)

{ "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { "cursor": { "type": "string" }, "hash": { "description": "MD5, SHA-1 or SHA-256 hash of the file", "pattern": "^[a-fA-F0-9]{32,64}$", "type": "string" }, "limit": { "default": 10, "maximum": 40, "minimum": 1, "type": "number" }, "relationship": { "description": "Type of relationship to query", "enum": [ "analyses", "behaviours", "bundled_files", "carbonblack_children", "carbonblack_parents", "ciphered_bundled_files", "ciphered_parents", "clues", "collections", "comments", "compressed_parents", "contacted_domains", "contacted_ips", "contacted_urls", "dropped_files", "email_attachments", "email_parents", "embedded_domains", "embedded_ips", "embedded_urls", "execution_parents", "graphs", "itw_domains", "itw_ips", "itw_urls", "memory_pattern_domains", "memory_pattern_ips", "memory_pattern_urls", "overlay_children", "overlay_parents", "pcap_children", "pcap_parents", "pe_resource_children", "pe_resource_parents", "related_references", "related_threat_actors", "similar_files", "submissions", "screenshots", "urls_for_embedded_js", "votes" ], "type": "string" } }, "required": [ "hash", "relationship" ], "type": "object" }