How do I use mcp-virustotal?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-virustotal Look up SHA-256 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

mcp-virustotal

Q: Which integrations are available for this server?

Provides access to the VirusTotal v3 API for file, URL, IP, and domain reports, including relationship pivots such as contacted hosts, dropped files, resolutions, threat actors, and malware families. Also supports corpus search, sandbox behavior summaries, and cached URL reporting.

by wolfgang6744

Overview Schema Source Related Servers Discussions Admin

TypeScript

Hybrid

mcp-virustotal is an MCP server that gives AI agents access to the VirusTotal v3 API. Hand your agent a hash, URL, IP or domain and get back the detection report plus the relationships an analyst would pivot on: contacted hosts, dropped files, resolutions, threat actors.

NOTE

Independent project, not affiliated with VirusTotal or Google. You need your ownVirusTotal API key.

Highlights

Reports with relationships. File, URL, IP and domain reports fetch key relationships in one batched ?relationships= call to save quota.
Cache first. get_url_report returns the cached VirusTotal report and only submits a scan on a cache miss.
Pivot tools. Corpus search with VTI-style modifiers (type:peexe positives:5+), merged sandbox behaviour summaries, and threat-actor and malware-family collections.
Full relationship paging. 100+ relationship types across files, URLs, IPs and domains, with cursor pagination.
Two transports. stdio for desktop clients, HTTP streaming for a shared service.
Tested. Unit tests for the formatters and API layer run in CI on Node 20, 22 and 24.

Related MCP server: mcp-virustotal

How it works

flowchart LR
    A["AI agent<br/>(Claude, Codex, Gemini, VS Code)"] -->|"MCP over stdio or HTTP"| S["mcp-virustotal"]
    S -->|"validate input,<br/>HTTPS + API key"| V["VirusTotal v3 API"]
    V -->|"JSON"| S
    S -->|"formatted report text"| A

Quickstart

Requirements: Node.js 20 or newer and a VirusTotal API key.

# Claude Code
claude mcp add --transport stdio --env VIRUSTOTAL_API_KEY=your-key virustotal -- npx -y @burtthecoder/mcp-virustotal

# Codex CLI
codex mcp add virustotal --env VIRUSTOTAL_API_KEY=your-key -- npx -y @burtthecoder/mcp-virustotal

# Gemini CLI
gemini mcp add -e VIRUSTOTAL_API_KEY=your-key virustotal npx -y @burtthecoder/mcp-virustotal

For Claude Desktop, VS Code, Smithery and running from source, see Connect a client.

Then ask your agent: "Look up the SHA-256 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f (the EICAR test file) and show what it drops and contacts."

Tools

Eleven tools. Full parameters and relationship lists are in the tool reference.

Group	Tools
Reports (with relationships)	`get_file_report`, `get_url_report`, `get_ip_report`, `get_domain_report`
Relationship paging	`get_file_relationship`, `get_url_relationship`, `get_ip_relationship`, `get_domain_relationship`
Search and pivot	`search_vt`, `get_file_behaviour_summary`, `get_collection`

HTTP streaming transport

stdio is the default. Set MCP_TRANSPORT=httpStream to run a standalone HTTP service:

MCP_TRANSPORT=httpStream MCP_PORT=3000 VIRUSTOTAL_API_KEY=your-key node build/index.js

docker build -t mcp-virustotal .
docker run -p 127.0.0.1:3000:3000 -e VIRUSTOTAL_API_KEY=your-key -e MCP_TRANSPORT=httpStream mcp-virustotal

A health check is served at /health.

Environment variables

Variable	Default	Description
`VIRUSTOTAL_API_KEY`	(required)	Your VirusTotal API key
`MCP_TRANSPORT`	`stdio`	`stdio` or `httpStream`
`MCP_HOST`	`localhost`	Bind address (`httpStream` only). The Docker image sets `0.0.0.0`
`MCP_PORT`	`3000`	HTTP port (`httpStream` only)
`MCP_ENDPOINT`	`/mcp`	HTTP endpoint path (`httpStream` only)

Security

WARNING

The HTTP transport hasno authentication. Keep the port on localhost or behind an authenticating reverse proxy, or anyone who can reach it can spend your API quota.

Tool arguments are validated with zod schemas before any request is built.
The API key is read from the environment and sent only to VirusTotal.
Lookups send your indicators to VirusTotal. A URL scan on a cache miss submits that URL for analysis.

Report vulnerabilities privately; see SECURITY.md.

Troubleshooting

Wrong API key: the key is usually 64 characters with no spaces or quotes. Restart the client after changing config.
429 errors: the public tier allows 4 requests per minute.
Logs: logs/mcp-virustotal-server.log in the package directory.

Development

git clone https://github.com/w0h1v/mcp-virustotal && cd mcp-virustotal
npm ci
npm test                                  # build + unit tests, no key or network
VIRUSTOTAL_API_KEY=your-key npm run smoke # all 11 tools against the real API

The smoke test paces calls at 20 s for the public-tier limit and isn't suited to free tiers reduced to a few lookups a day. See CONTRIBUTING.md and the changelog.

License

MIT. See LICENSE.

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityActive

ResponsivenessResponsive

Resources

Related MCP Connectors

VirusTotalOAuth
io.github.VirusTotal
Official VirusTotal MCP server: threat reports, file and URL submissions, and analysis recovery.
Security Penetration Testing
121
https://ai.virustotal.com/mcp
Virustotal A
io.github.pipeworx-io
VirusTotal MCP — file / URL / domain / IP reputation (BYO key)
Security Monitoring
462
https://gateway.pipeworx.io/virustotal/mcp
Security Intel MCP A
com.datakoot
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Penetration Testing Security
51
https://security.datakoot.com/mcp
Security Intel MCP A
io.github.selflabbs
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Security Penetration Testing
2
https://security.selflabbs.com/mcp

Related MCP Servers

mcp-virustotal
Security Penetration Testing Search
NereaLebedev7767
F
license
Not graded
quality
A
maintenance
Enables AI agents to look up files, URLs, IPs, and domains through the VirusTotal v3 API, returning detection reports along with pivotable relationships such as contacted hosts, dropped files, resolutions, and threat actors. Also supports corpus search, sandbox behaviour summaries, and cursor-paginated relationship queries over either stdio or HTTP streaming transport.
Updated 10 days ago (2026-10-17 21:26 UTC)
-
mcp-virustotal
Security Penetration Testing Search
SerkanHartmann706
A
license
Not graded
quality
A
maintenance
Enables AI agents to look up files, URLs, IPs, and domains through the VirusTotal v3 API, returning detection reports alongside analyst-pivot relationships such as contacted hosts, dropped files, resolutions, and threat actors. Adds corpus search, sandbox behaviour summaries, cursor-paginated relationship traversal, and a choice of stdio or HTTP streaming transport.
Updated 9 days ago (2026-10-18 19:59 UTC)
MIT
mcp-virustotal
Security Search
Konstantinos02772
A
license
Not graded
quality
A
maintenance
Enables AI agents to query the VirusTotal v3 API for detection reports and relationship data on files, URLs, IPs, and domains, including contacted hosts, dropped files, resolutions, and threat actors. Supports corpus search, sandbox behaviour summaries, paginated relationship lookups, and both stdio and HTTP streaming transports.
Updated 8 days ago (2026-10-19 06:28 UTC)
MIT
mcp-virustotal
Security Search Research & Data
PieterDupuis03803
A
license
Not graded
quality
A
maintenance
Enables AI agents to retrieve VirusTotal v3 detection reports for files, URLs, IPs, and domains, then pivot on the relationships an analyst would pursue, such as contacted hosts, dropped files, resolutions, threat actors, and malware families. Includes corpus search with VTI-style modifiers, merged sandbox behaviour summaries, and cursor-paginated access to 100+ relationship types over stdio or HTTP streaming.
Updated 8 days ago (2026-10-19 14:44 UTC)
MIT