What is Virustotal MCP?

It's an MCP (Model Context Protocol) server that connects Virustotal to your AI, giving the agent tools to act on your data — through a single remote link.

Which AI clients does it work with?

Any MCP-compatible client: Claude (web, desktop and mobile), Cursor, ChatGPT with connectors, OpenClaw and other agents.

No. Paste the remote URL into your client, authenticate once, and you're done — no packages to install, no code to write.

Is it secure? Can the AI change my data?

Access is authorized by you and can be revoked anytime. Permissions follow what Virustotal exposes; you approve them when connecting.

How much does it cost?

You start free and upgrade when you need more usage. Billing and limits are managed in your mcp.ai account.

Can I cancel anytime?

Yes. Plans are monthly and can be cancelled at any time, with no lock-in.

Virustotal MCP Server and REST API

Virustotal

Connect your Virustotal account and use 16 tools for security and identity straight from your AI agent. Connect with your own API key. VirusTotal is a free online service that analyzes files and URLs for viruses, worms, trojans, and other kinds of malicious content using multiple antivirus engines and website scanners.

Install in your client

MCP server URL

https://api.mcp.ai/p_virustotal

Secure connection via OAuth 2.0

Tools (16)

For developers

API & agent docs

Machine-readable docs to plug this server into an agent or call it over REST.

Skill (how to use)

Markdown: use via MCP or via the direct REST API.

Open

llms.txt

Agent-readable spec of this server.

Open

For agents

Install prompt — paste into Claude, ChatGPT, Cursor or any MCP agent and it sets itself up.

Open

Postman collection

Import the REST API into Postman.

Download

FAQ

Virustotal

Tools (16)

API & agent docs

Frequently asked questions

Example prompts

Related tags

Virustotal

Tools (16)

virustotal_add_commentTool to add a comment to a VirusTotal resource (file, URL, domain, or IP address). Use after analyzing a resource to leave contextual feedback. Provide exactly one identifier per call.

virustotal_add_voteTool to add a vote (harmless/malicious) to a VirusTotal resource. Use after reviewing analysis results to submit your verdict.

virustotal_get_analysisTool to retrieve the analysis report of a file or URL submission. Use after obtaining an analysis ID to fetch its detailed report. Analysis results may be incomplete immediately after submission; poll

virustotal_get_commentsTool to retrieve the latest comments on a VirusTotal resource. Use when you need to review user-generated comments for a file, URL, domain, or IP after obtaining its identifier.

virustotal_get_domain_relationshipsTool to retrieve relationship objects for a given domain. Use when you have a domain and need to explore its related entities.

virustotal_get_domain_reportTool to retrieve the analysis report of a domain. Use when you need detailed insight on a domain's reputation and analysis stats. No malicious signals on obscure or low-traffic domains may indicate li

virustotal_get_file_reportTool to retrieve the analysis report of a file. Use when you have a file's hash and need detailed scan metadata. Recently submitted files may return partial results; retry after a short delay before t

virustotal_get_ip_address_relationshipsTool to retrieve objects related to a specific IP address by relationship type. Use when you have an IP and need to explore connected files, URLs, or other entities.

virustotal_get_ip_address_reportTool to retrieve the analysis report of an IP address. Use when you need detailed insight on an IP's reputation, ASN, country, and analysis stats. Low or zero detections indicate unknown risk, not saf

virustotal_get_metadataTool to retrieve VirusTotal metadata. Use when you need information about available privileges, relationships between resources (like files, domains, IPs, URLs), and supported antivirus engines.

virustotal_get_url_reportTool to retrieve the analysis report of a URL. Use when you have a URL identifier (base64-url without padding) and need detailed scan results, reputation, and metadata. Results may be incomplete immed

virustotal_get_votesTool to retrieve votes on files, URLs, domains, or IP addresses. Use when you need to view community votes for a given object.

virustotal_rescan_fileTool to re-analyze a previously submitted file. Use when you need updated analysis results after an initial scan.

virustotal_scan_urlTool to submit a URL for scanning. Use when you have a URL and need to submit it to VirusTotal to obtain an analysis ID for later retrieval. The returned analysis ID is preliminary — scanning engines

virustotal_searchTool to search for objects in the VirusTotal database. Use when locating files, URLs, domains, IPs, or comments matching a query. Supports pagination with limit and cursor.

virustotal_upload_fileTool to upload a file for scanning. Use when you have binary file content ready to submit for VirusTotal analysis.

API & agent docs

Frequently asked questions

What is Virustotal MCP?

Which AI clients does it work with?

Do I need to code?

Is it secure? Can the AI change my data?

How much does it cost?

Can I cancel anytime?

Example prompts

Related tags