VirusTotal MCP Server

@BurtTheCoder

Basic information

About VirusTotal MCP Server

MCP server for VirusTotal API — analyze URLs, files, IPs, and domains with comprehensive security reports, relationship analysis, and pagination support.

VirusTotal MCP Server config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "mcp-virustotal": {
      "command": "npx",
      "args": [
        "-y",
        "@smithery/cli",
        "install",
        "@burtthecoder/mcp-virustotal",
        "--client",
        "claude"
      ]
    }
  }
}

VirusTotal MCP Server tools

Tool list not available yet

This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.

Fetch the live tool list by running this server in a temporary sandbox using the button above.

Overview

What is VirusTotal MCP Server?

An MCP server for querying the VirusTotal API. It provides comprehensive security analysis tools with automatic relationship data fetching and integrates with MCP-compatible applications like Claude Desktop.

How to use VirusTotal MCP Server?

Install via npm or run via npx, then configure the server in your MCP client’s JSON configuration, setting the required VIRUSTOTAL_API_KEY environment variable. Use commands like claude mcp add, codex mcp add, or gemini mcp add for quick setup. Optionally switch to HTTP streaming mode by setting MCP_TRANSPORT=httpStream.

Key features of VirusTotal MCP Server

Comprehensive analysis reports with automatic relationship data fetching.
URL analysis with cached-report-first lookups and fallback scanning.
File analysis by MD5, SHA-1, or SHA-256 hash.
IP and domain analysis with historical data and related threats.
Dedicated relationship query tools with pagination support.
Corpus search across files, URLs, domains, IPs, and comments.
Cross-sandbox behaviour summary with MITRE ATT&CK and IDS alerts.
Threat collection lookup for APT, malware-family, campaign objects.

Use cases of VirusTotal MCP Server

Threat hunting by searching for IOCs and pivoting through relationships.
Incident response via comprehensive URL, file, IP, and domain reports.
Malware analysis using sandbox behaviour summaries and threat collections.
Security automation integrated into MCP-compatible assistants.
Automated URL scanning with cache-first retrieval to minimize API calls.

Frequently asked questions

What is required to use this server?

A VirusTotal API key. Set it as the `VIRUSTOTAL_API_KEY` environment variable.

How do I install it for Claude Desktop?

Install globally via `npm install -g @burtthecoder/mcp-virustotal` and add the server configuration to your Claude Desktop config file.

Does it support HTTP streaming?

Yes. Set `MCP_TRANSPORT=httpStream` and optionally `MCP_PORT` (default 3000) and `MCP_ENDPOINT` (default /mcp).

How does URL analysis handle cached reports?

It retrieves the cached VirusTotal report first; only submits the URL for scanning and polls on cache miss.

What tools are available?

Report tools (URL, file, IP, domain), relationship tools with pagination, corpus search, file behaviour summary, and collection lookup.

Comments

More Developer Tools MCP servers

OrangePro

Aamir Siddiqui

OrangePro local-first CLI + MCP server for behavior mapping, grounded test generation, and dynamic proof.

ArtiBot Cloud MCP - Zhijiangyun 智匠云

bofob

ArtiBot Cloud MCP (Zhijiangyun 智匠云) — cloud MCP server for robot manipulation data & GPU workloads. 15 tools: robot fleet management, data collection & video recording, post-processing pipelines, and benchmark evaluation

LastPing

Know when your AI agents, cron jobs and CI pipelines fail, stall or go quiet. Your agent sets up monitors from a plain description, tells you what is broken and why, reads run history and traces, and writes notes on inci

Mcp-Warden

ermoluk

Local-first credential broker for MCP. AI coding agents (Claude Code, Cursor, Codex…) call APIs, SSH and databases through scoped presets; secrets stay in your OS keychain and never enter the agent's context.

Foremerge

naw103

Catch intent conflicts before code conflicts. The open-source coordination protocol for coding agents, built above Git.