# Virustotal — how to use (mcp.ai)

Connect your Virustotal account and use 16 tools for security and identity straight from your AI agent. Connect with your own API key. VirusTotal is a free online service that analyzes files and URLs for viruses, worms, trojans, and other kinds of malicious content using multiple antivirus engines and website scanners.

## Option A — via MCP (recommended)
Remote MCP endpoint (HTTP, streamable): `https://api.mcp.ai/p_virustotal?ms=1787296080000`
Add it as a custom/remote MCP connector in your client (Claude, Cursor, VS Code…), then authenticate when prompted. Once connected, ask the agent to use the server's tools (e.g. `virustotal_add_comment`).

## Option B — via direct REST API
Base URL: `https://api.mcp.ai/api/virustotal`
Auth: `Authorization: Bearer sk_live_…` — create a workspace API key at https://mcp.ai/settings/api-keys
Discover endpoints: `GET https://api.mcp.ai/api/virustotal/_endpoints`

### Endpoints
- `POST https://api.mcp.ai/api/virustotal/add/comment` — Tool to add a comment to a VirusTotal resource (file, URL, domain, or IP address). Use after analyzing a resource to leave contextual feedback. Provide exactly one identifier per call.
  - body: { url?: string, file?: string, text: string, domain?: string, ip_address?: string }
- `POST https://api.mcp.ai/api/virustotal/add/vote` — Tool to add a vote (harmless/malicious) to a VirusTotal resource. Use after reviewing analysis results to submit your verdict.
  - body: { data: object }
- `POST https://api.mcp.ai/api/virustotal/get/analysis` — Tool to retrieve the analysis report of a file or URL submission. Use after obtaining an analysis ID to fetch its detailed report. Analysis results may be incomplete immediately after submission; poll
  - body: { id: string }
- `POST https://api.mcp.ai/api/virustotal/get/comments` — Tool to retrieve the latest comments on a VirusTotal resource. Use when you need to review user-generated comments for a file, URL, domain, or IP after obtaining its identifier.
  - body: { sort?: string, limit?: integer, cursor?: string, filter_resource: string }
- `POST https://api.mcp.ai/api/virustotal/get/domain/relationships` — Tool to retrieve relationship objects for a given domain. Use when you have a domain and need to explore its related entities.
  - body: { limit?: integer, cursor?: string, domain: string, relationship: string }
- `POST https://api.mcp.ai/api/virustotal/get/domain/report` — Tool to retrieve the analysis report of a domain. Use when you need detailed insight on a domain's reputation and analysis stats. No malicious signals on obscure or low-traffic domains may indicate li
  - body: { domain: string }
- `POST https://api.mcp.ai/api/virustotal/get/file/report` — Tool to retrieve the analysis report of a file. Use when you have a file's hash and need detailed scan metadata. Recently submitted files may return partial results; retry after a short delay before t
  - body: { id: string }
- `POST https://api.mcp.ai/api/virustotal/get/ip/address/relationships` — Tool to retrieve objects related to a specific IP address by relationship type. Use when you have an IP and need to explore connected files, URLs, or other entities.
  - body: { ip: string, limit?: integer, cursor?: string, relationship: string }
- `POST https://api.mcp.ai/api/virustotal/get/ip/address/report` — Tool to retrieve the analysis report of an IP address. Use when you need detailed insight on an IP's reputation, ASN, country, and analysis stats. Low or zero detections indicate unknown risk, not saf
  - body: { ip: string }
- `POST https://api.mcp.ai/api/virustotal/get/metadata` — Tool to retrieve VirusTotal metadata. Use when you need information about available privileges, relationships between resources (like files, domains, IPs, URLs), and supported antivirus engines.
- `POST https://api.mcp.ai/api/virustotal/get/url/report` — Tool to retrieve the analysis report of a URL. Use when you have a URL identifier (base64-url without padding) and need detailed scan results, reputation, and metadata. Results may be incomplete immed
  - body: { id: string }
- `POST https://api.mcp.ai/api/virustotal/get/votes` — Tool to retrieve votes on files, URLs, domains, or IP addresses. Use when you need to view community votes for a given object.
  - body: { limit?: integer, cursor?: string, object_id: string, object_type: string }
- `POST https://api.mcp.ai/api/virustotal/rescan/file` — Tool to re-analyze a previously submitted file. Use when you need updated analysis results after an initial scan.
  - body: { id: string }
- `POST https://api.mcp.ai/api/virustotal/scan/url` — Tool to submit a URL for scanning. Use when you have a URL and need to submit it to VirusTotal to obtain an analysis ID for later retrieval. The returned analysis ID is preliminary — scanning engines 
  - body: { url: string }
- `POST https://api.mcp.ai/api/virustotal/search` — Tool to search for objects in the VirusTotal database. Use when locating files, URLs, domains, IPs, or comments matching a query. Supports pagination with limit and cursor.
  - body: { limit?: integer, query: string, cursor?: string }
- `POST https://api.mcp.ai/api/virustotal/upload/file` — Tool to upload a file for scanning. Use when you have binary file content ready to submit for VirusTotal analysis.
  - body: { file: string, filename?: string }

## Example prompts
- "What can I do in Virustotal?"
- "Show me a summary of my Virustotal account"

## More
- Page: https://mcp.ai/virustotal
- Agent spec (llms.txt): https://mcp.ai/virustotal/llms.txt
- Postman collection: https://mcp.ai/virustotal/postman.json