VirusTotal MCP Server

What is VirusTotal MCP Server?

An MCP server for querying the VirusTotal API. It provides comprehensive security analysis tools with automatic relationship data fetching and integrates with MCP-compatible applications like Claude Desktop.

How to use VirusTotal MCP Server?

Install via npm or run via npx, then configure the server in your MCP client’s JSON configuration, setting the required VIRUSTOTAL_API_KEY environment variable. Use commands like claude mcp add, codex mcp add, or gemini mcp add for quick setup. Optionally switch to HTTP streaming mode by setting MCP_TRANSPORT=httpStream.

Key features of VirusTotal MCP Server

• Comprehensive analysis reports with automatic relationship data fetching.
• URL analysis with cached-report-first lookups and fallback scanning.
• File analysis by MD5, SHA-1, or SHA-256 hash.
• IP and domain analysis with historical data and related threats.
• Dedicated relationship query tools with pagination support.
• Corpus search across files, URLs, domains, IPs, and comments.
• Cross-sandbox behaviour summary with MITRE ATT&CK and IDS alerts.
• Threat collection lookup for APT, malware-family, campaign objects.

Use cases of VirusTotal MCP Server

• Threat hunting by searching for IOCs and pivoting through relationships.
• Incident response via comprehensive URL, file, IP, and domain reports.
• Malware analysis using sandbox behaviour summaries and threat collections.
• Security automation integrated into MCP-compatible assistants.
• Automated URL scanning with cache-first retrieval to minimize API calls.

FAQ from VirusTotal MCP Server

What is required to use this server?

A VirusTotal API key. Set it as the VIRUSTOTAL_API_KEY environment variable.

How do I install it for Claude Desktop?

Install globally via npm install -g @burtthecoder/mcp-virustotal and add the server configuration to your Claude Desktop config file.

Does it support HTTP streaming?

Yes. Set MCP_TRANSPORT=httpStream and optionally MCP_PORT (default 3000) and MCP_ENDPOINT (default /mcp).

How does URL analysis handle cached reports?

It retrieves the cached VirusTotal report first; only submits the URL for scanning and polls on cache miss.

What tools are available?

Report tools (URL, file, IP, domain), relationship tools with pagination, corpus search, file behaviour summary, and collection lookup.