Virustotal

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/w0h1v-virustotal

About

Use cases: security-scanning

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools

11 read · 0 write · 0 deleteRead-only

Secrets

1 (API keys, tokens or passwords)

Install scripts

None found

Runs as

Node.js package

Tools (11)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• get_collection

  Retrieve a VirusTotal collection by ID. Collections represent threat actors, malware families, campaigns, intel reports, and curated IOC sets — often referenced from the related_threat_actors and collections relationships on other tools. Optionally include relationships (files, urls, domains, ip_addresses, references, threat_actors, related_collections, related_references, comments, owner, autogenerated_graphs) to fetch member IOCs in the same call.

• get_domain_relationship

  Description is built at runtime.

• get_domain_report

  Get a comprehensive domain analysis report including DNS records, WHOIS data, and key relationships (SSL certificates, subdomains, historical data). Optionally specify which relationships to include in the report. Returns both the basic analysis and relationship data.

• get_file_behaviour_summary

  Get a consolidated sandbox behaviour summary for a file (MD5/SHA-1/SHA-256), merged across every sandbox that analyzed it. Returns processes, files, registry, network activity, MITRE ATT&CK techniques, IDS alerts, and signature matches in a single view — far more useful than iterating individual behaviour reports.

• get_file_relationship

  Description is built at runtime.

• get_file_report

  Get a comprehensive file analysis report using its hash (MD5/SHA-1/SHA-256). Includes detection results, file properties, and key relationships (behaviors, dropped files, network connections, embedded content, threat actors). Returns both the basic analysis and automatically fetched relationship data.

• get_ip_relationship

  Description is built at runtime.

• get_ip_report

  Get a comprehensive IP address analysis report including geolocation, reputation data, and key relationships (communicating files, historical certificates/WHOIS, resolutions). Returns both the basic analysis and automatically fetched relationship data.

• get_url_relationship

  Description is built at runtime.

• get_url_report

  Get a comprehensive URL analysis report including security scan results and key relationships (communicating files, contacted domains/IPs, downloaded files, redirects, threat actors). Returns the cached VirusTotal report when available, or submits the URL for scanning and waits for results.

• search_vt

  Search the VirusTotal corpus for files, URLs, domains, IPs, or comments matching a query. Accepts plain IOCs (hash, URL, domain, IP), free text against comments, or VTI-style search modifiers like "type:peexe size:90kb+ tag:signed positives:5+". Paginated via cursor.

Compare and alternatives

Featured in

• Best MCP servers for security audits
• Best MCP servers for threat intelligence

Signals

Stars

151

Forks

23

Open issues

1

Contributors

10

Weekly downloads

333

Last commit

Oct 20, 2026 (11 days ago)

Last release

Oct 13, 2026 (17 days ago)

Last package publish

Oct 13, 2026 (17 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name

io.github.w0h1v/virustotal

Version

1.0.35

Auth

API key

Packages

npm @burtthecoder/mcp-virustotal

License

MIT

Repository

github.com/w0h1v/mcp-virustotal

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registrygithub-graphql