VirusTotal MCP Server

@BurtTheCoder

リポジトリホームページ

基本情報

カテゴリ

開発者ツール

ライセンス

MIT

トランスポート

stdio

作者

BurtTheCoder

VirusTotal MCP Server について

MCP server for VirusTotal API — analyze URLs, files, IPs, and domains with comprehensive security reports, relationship analysis, and pagination support.

VirusTotal MCP Server の設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "mcp-virustotal": {
      "command": "npx",
      "args": [
        "-y",
        "@smithery/cli",
        "install",
        "@burtthecoder/mcp-virustotal",
        "--client",
        "claude"
      ]
    }
  }
}

VirusTotal MCP Server のツール

ツール一覧はまだありません

この掲載には表示できるツール一覧がまだありません。サーバーにツールがないという意味ではありません。対応機能はプロジェクトのドキュメントをご確認ください。

上のボタンで一時的なサンドボックスでこのサーバーを実行し、ツール一覧を取得できます。

概要

What is VirusTotal MCP Server?

An MCP server for querying the VirusTotal API. It provides comprehensive security analysis tools with automatic relationship data fetching and integrates with MCP-compatible applications like Claude Desktop.

How to use VirusTotal MCP Server?

Install via npm or run via npx, then configure the server in your MCP client’s JSON configuration, setting the required VIRUSTOTAL_API_KEY environment variable. Use commands like claude mcp add, codex mcp add, or gemini mcp add for quick setup. Optionally switch to HTTP streaming mode by setting MCP_TRANSPORT=httpStream.

Key features of VirusTotal MCP Server

Comprehensive analysis reports with automatic relationship data fetching.
URL analysis with cached-report-first lookups and fallback scanning.
File analysis by MD5, SHA-1, or SHA-256 hash.
IP and domain analysis with historical data and related threats.
Dedicated relationship query tools with pagination support.
Corpus search across files, URLs, domains, IPs, and comments.
Cross-sandbox behaviour summary with MITRE ATT&CK and IDS alerts.
Threat collection lookup for APT, malware-family, campaign objects.

Use cases of VirusTotal MCP Server

Threat hunting by searching for IOCs and pivoting through relationships.
Incident response via comprehensive URL, file, IP, and domain reports.
Malware analysis using sandbox behaviour summaries and threat collections.
Security automation integrated into MCP-compatible assistants.
Automated URL scanning with cache-first retrieval to minimize API calls.

よくある質問

What is required to use this server?

A VirusTotal API key. Set it as the `VIRUSTOTAL_API_KEY` environment variable.

How do I install it for Claude Desktop?

Install globally via `npm install -g @burtthecoder/mcp-virustotal` and add the server configuration to your Claude Desktop config file.

Does it support HTTP streaming?

Yes. Set `MCP_TRANSPORT=httpStream` and optionally `MCP_PORT` (default 3000) and `MCP_ENDPOINT` (default /mcp).

How does URL analysis handle cached reports?

It retrieves the cached VirusTotal report first; only submits the URL for scanning and polls on cache miss.

What tools are available?

Report tools (URL, file, IP, domain), relationship tools with pagination, corpus search, file behaviour summary, and collection lookup.

「開発者ツール」の他のコンテンツ

Routebase

Routebase keeps your API's design, docs, contract tests, mocks and monitoring in one living OpenAPI spec so they can't drift apart. Agents work on that same source of truth, under your team's permissions.

FARPY

mangomunchr

Verified distributed compute for humans, applications, and agents. Submit Blender, Octane, and video workloads, route them across qualified GPUs, track asynchronous execution, download finished artifacts, and verify FARP

screenshotrun-mcp

screenshotrun

Give your AI agent the ability to see any webpage. Capture screenshots from Claude, Cursor, or any MCP client. Supports full-page, dark mode, mobile emulation, OG image generation, base64 output, custom viewport, ad bloc

Modelglass

Modelglass turns "which model should I use?" into a lookup instead of a guess. Seven tools give your agent live pricing across image, language, video, and audio models. Sourced and versioned, not scraped once and forgott

offprompt

MCP server that lets Claude Code, Cursor or Codex ask you for API keys on a local page and write them to .env. The agent only ever sees key names.