VirusTotal

Name: VirusTotal
Author: barvhaim

@barvhaim

Repository

About VirusTotal

Unofficial VirusTotal MCP Server

#virustotal #security-analysis #malware-detection

Basic information

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "virustotal": {
      "command": "uv",
      "args": [
        "--directory",
        "/absolute/path/to/virustotal-mcp-server",
        "run",
        "main.py"
      ],
      "env": {
        "VIRUSTOTAL_API_KEY": "your_api_key_here"
      }
    }
  }
}

Tools

No tools detected

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is VirusTotal?

VirusTotal is a Model Context Protocol (MCP) server that integrates VirusTotal’s security database, enabling AI assistants like Claude to perform malware detection and threat intelligence on URLs, files, IP addresses, and domains. It automatically fetches relationship data to provide complete security context in a single request.

How to use VirusTotal?

The README does not provide installation, configuration, or invocation instructions. Refer to the server’s source code or documentation for setup details.

Key features of VirusTotal

Comprehensive threat analysis with automatic relationship fetching
URL analysis including contacted domains and threat actors
File hash analysis covering behaviors, dropped files, and network connections
IP analysis with geolocation, reputation, and historical data
Domain analysis including DNS, WHOIS, SSL certificates, and subdomains
Paginated access to specific relationship types for deep investigation
Respects VirusTotal API rate limits
Supports SSE and STDIO transports

Use cases of VirusTotal

Automatically scan URLs and files for malware during incident response
Investigate suspicious IP addresses with full reputation and geolocation context
Enrich domain intelligence with DNS records, WHOIS, and SSL certificate data
Perform deep file hash analysis to uncover behavioral and network indicators
Query specific relationships (e.g., contacted domains for a URL) in paginated form

FAQ from VirusTotal

What data can VirusTotal analyze?

VirusTotal analyzes URLs, files (via hash), IP addresses, and domains, automatically retrieving related data such as contacted domains, dropped files, threat actors, geolocation, DNS records, WHOIS, SSL certificates, and subdomains.