Skip to content
Agentmart
Submit a tool

Virustotal

MCP server for querying VirusTotal API with comprehensive security analysis tools.

Connector by w0h1v · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)★ 151
Write a review

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/w0h1v-virustotal

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

MCP server for querying VirusTotal API with comprehensive security analysis tools.

Use cases: security-scanning

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools
11 read · 0 write · 0 deleteRead-only
Secrets
1 (API keys, tokens or passwords)
Install scripts
None found
Runs as
Node.js package

Tools by what they do 11

Read from the source code; the running server may list different tools.

Read 11 · Look things up without changing anything.

  • get_collection
  • get_domain_relationship
  • get_domain_report
  • get_file_behaviour_summary
  • get_file_relationship
  • get_file_report
  • get_ip_relationship
  • get_ip_report
  • get_url_relationship
  • get_url_report
  • search_vt

Secrets and settings it asks for

Secrets: values you paste in that let it act as you.

  • VIRUSTOTAL_API_KEY

Network hosts it talks to 4

  • github.com · found in code
  • google.com · found in code
  • virustotal.com · found in code
  • w0h1v.github.io · found in code

Files it touches

  • C:\\Windows\\Temp

Tools (11)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • get_collection

    Retrieve a VirusTotal collection by ID. Collections represent threat actors, malware families, campaigns, intel reports, and curated IOC sets — often referenced from the related_threat_actors and collections relationships on other tools. Optionally include relationships (files, urls, domains, ip_addresses, references, threat_actors, related_collections, related_references, comments, owner, autogenerated_graphs) to fetch member IOCs in the same call.

  • get_domain_relationship

    Description is built at runtime.

  • get_domain_report

    Get a comprehensive domain analysis report including DNS records, WHOIS data, and key relationships (SSL certificates, subdomains, historical data). Optionally specify which relationships to include in the report. Returns both the basic analysis and relationship data.

  • get_file_behaviour_summary

    Get a consolidated sandbox behaviour summary for a file (MD5/SHA-1/SHA-256), merged across every sandbox that analyzed it. Returns processes, files, registry, network activity, MITRE ATT&CK techniques, IDS alerts, and signature matches in a single view — far more useful than iterating individual behaviour reports.

  • get_file_relationship

    Description is built at runtime.

  • get_file_report

    Get a comprehensive file analysis report using its hash (MD5/SHA-1/SHA-256). Includes detection results, file properties, and key relationships (behaviors, dropped files, network connections, embedded content, threat actors). Returns both the basic analysis and automatically fetched relationship data.

  • get_ip_relationship

    Description is built at runtime.

  • get_ip_report

    Get a comprehensive IP address analysis report including geolocation, reputation data, and key relationships (communicating files, historical certificates/WHOIS, resolutions). Returns both the basic analysis and automatically fetched relationship data.

  • get_url_relationship

    Description is built at runtime.

  • get_url_report

    Get a comprehensive URL analysis report including security scan results and key relationships (communicating files, contacted domains/IPs, downloaded files, redirects, threat actors). Returns the cached VirusTotal report when available, or submits the URL for scanning and waits for results.

  • search_vt

    Search the VirusTotal corpus for files, URLs, domains, IPs, or comments matching a query. Accepts plain IOCs (hash, URL, domain, IP), free text against comments, or VTI-style search modifiers like "type:peexe size:90kb+ tag:signed positives:5+". Paginated via cursor.

Compare and alternatives

    Featured in

    Signals

    Stars
    151
    Forks
    23
    Open issues
    1
    Contributors
    10
    Weekly downloads
    333
    Last commit
    Oct 20, 2026 (9 days ago)
    Last release
    Oct 13, 2026 (15 days ago)
    Last package publish
    Oct 13, 2026 (15 days ago)

    From GitHub (fetched Oct 24, 2026) and the package registry.

    Details

    Registry name
    io.github.w0h1v/virustotal
    Version
    1.0.35
    Auth
    API key
    Packages
    npm @burtthecoder/mcp-virustotal
    License
    MIT
    Repository
    github.com/w0h1v/mcp-virustotal
    First seen
    Oct 24, 2026
    Last checked
    Oct 24, 2026
    Source
    Official MCP Registrygithub-graphql

    Same server elsewhere

    Copies of this server published by others; search shows only one of them.

    More from w0h1v

    Cite this page

    Virustotal MCP server. Agent Mart. https://agentmart.dev/connectors/w0h1v-virustotal (last updated 2026-10-24)