Virustotal MCP Server

@yassinech-99

Basic information

About Virustotal MCP Server

MCP server that enables LLMs to interact with the VirusTotal API for malware analysis, URL scanning, and threat intelligence.

#security #threat-intelligence

Virustotal MCP Server config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "virustotal": {
      "command": "uv",
      "args": [
        "--directory",
        "D:\\coolAI\\mcp-client",
        "run",
        "virustotal_mcp.py"
      ],
      "env": {
        "VIRUSTOTAL_API_KEY": "<api_key_here>",
        "API_BASE_URL": "https://www.virustotal.com/api/v3",
        "REQUEST_TIMEOUT": "30.0"
      }
    }
  }
}

Virustotal MCP Server tools

Tool list not available yet

This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is Virustotal Mcp?

Virustotal Mcp is a Model Context Protocol (MCP) server that enables LLMs to interact with the VirusTotal API for malware analysis, URL scanning, and threat intelligence.

How to use Virustotal Mcp?

After cloning the repository, create a .env file with your VIRUSTOTAL_API_KEY and optionally API_BASE_URL and REQUEST_TIMEOUT. Install dependencies with uv pip install -e ., then configure the server in your MCP client (e.g., Claude Desktop) by adding the server entry pointing to virustotal_mcp.py. Use the provided tools like virustotal_scan_file, virustotal_scan_url, virustotal_get_domain_report, etc.

Key features of Virustotal Mcp

File analysis via upload or hash reports.
URL and domain intelligence scanning.
IP reputation lookups.
Threat hunting with advanced search.
Community interaction via comments.

Use cases of Virustotal Mcp

Analyze suspicious files using MD5, SHA-1, or SHA-256 hashes.
Scan URLs and get reputation reports for domains.
Look up threat data associated with IP addresses.
Perform advanced threat hunting queries using VirusTotal syntax.
Post comments on files, URLs, domains, or IPs for collaboration.

Frequently asked questions

What API key do I need?

A VirusTotal API key from [virustotal.com](https://www.virustotal.com/).

What are the runtime requirements?

Python 3.13+ and `uv` for dependency management (recommended).

How do I configure environment variables?

Create a `.env` file with `VIRUSTOTAL_API_KEY`, `API_BASE_URL`, and `REQUEST_TIMEOUT`. Alternatively, set them in the MCP client configuration.

What tools does the server expose?

Tools include `virustotal_scan_file`, `virustotal_get_file_report`, `virustotal_scan_url`, `virustotal_get_url_report`, `virustotal_get_domain_report`, `virustotal_get_ip_report`, `virustotal_search`, and `virustotal_post_comment`.

Can I upload files for analysis?

Yes, use the `virustotal_scan_file` tool to upload a local file.

Comments

More Other MCP servers

Reactive Resume

amruthpillai

A one-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source and free forever. Try it out today!

39.5K

The Living Bread

A free remote MCP server for The Living Bread. Bible passages read word for word from a stored public domain text with an evidence label, keyword search and cross references, real churches, gatherings and prayer groups w