This VirusTotal MCP server, developed by BurtTheCoder, enables AI assistants like Claude to leverage VirusTotal's threat intelligence capabilities. Built in JavaScript/TypeScript, it provides functionality for scanning URLs, analyzing file hashes, and retrieving IP address reports. The implementation stands out by offering relationship analysis tools and pagination support for large result sets. By connecting AI capabilities with VirusTotal's extensive threat data, this server allows AI systems to perform security analysis and threat detection programmatically. It is particularly useful for building AI-powered tools for malware research, phishing detection, and network security monitoring that require access to up-to-date threat intelligence.
Aucun avis encore. Soyez le premier à donner votre avis !
Connectez-vous pour rejoindre la conversation
Highlight AIGet a comprehensive URL analysis report including security scan results and key relationships (communicating files, contacted domains/IPs, downloaded files, redirects, threat actors). Returns the cached VirusTotal report when available; only submits the URL for scanning and polls for completion on a cache miss. Parameters: url (required): The URL to analyze.
Get a comprehensive file analysis report using its hash (MD5/SHA-1/SHA-256). Includes detection results, file properties, and key relationships (behaviors, dropped files, network connections, embedded content, threat actors). Parameters: hash (required): MD5, SHA-1 or SHA-256 hash of the file.
Get a comprehensive IP address analysis report including geolocation, reputation data, and key relationships (communicating files, historical certificates/WHOIS, resolutions). Parameters: ip (required): IP address to analyze.
Get a comprehensive domain analysis report including DNS records, WHOIS data, and key relationships (SSL certificates, subdomains, historical data). Parameters: domain (required): Domain name to analyze; relationships (optional): Array of specific relationships to include in the report.
Query a specific relationship type for a URL with pagination support. Choose from 22 relationship types including analyses, communicating files, contacted domains/IPs, downloaded files, graphs, referrers, redirects, threat actors, collections, and votes. Parameters: url (required): The URL to get relationships for; relationship (required): Type of relationship to query; limit (optional, default: 10): Maximum number of related objects to retrieve (1-40); cursor (optional): Continuation cursor for pagination.
Query a specific relationship type for a file with pagination support. Choose from 40 relationship types including behaviors, network connections, dropped files, embedded content, execution chains, and threat actors. Parameters: hash (required): MD5, SHA-1 or SHA-256 hash of the file; relationship (required): Type of relationship to query; limit (optional, default: 10): Maximum number of related objects to retrieve (1-40); cursor (optional): Continuation cursor for pagination.
Query a specific relationship type for an IP address with pagination support. Choose from 15 relationship types including communicating files, historical SSL certificates, WHOIS records, resolutions, threat actors, and votes. Parameters: ip (required): IP address to analyze; relationship (required): Type of relationship to query; limit (optional, default: 10): Maximum number of related objects to retrieve (1-40); cursor (optional): Continuation cursor for pagination.
Query a specific relationship type for a domain with pagination support. Choose from 24 relationship types including SSL certificates, subdomains, historical data, DNS records, and collections. Parameters: domain (required): Domain name to analyze; relationship (required): Type of relationship to query; limit (optional, default: 10): Maximum number of related objects to retrieve (1-40); cursor (optional): Continuation cursor for pagination.
Search the VirusTotal corpus for files, URLs, domains, IPs, or comments matching a query. Accepts plain IOCs (hash, URL, domain, IP), free text against comments, or VTI-style search modifiers. Parameters: query (required): Search query; limit (optional, default: 20): Maximum number of results (1-300); cursor (optional): Continuation cursor for pagination.
Get a consolidated sandbox behaviour summary for a file, merged across every sandbox that analyzed it. Returns processes, files, registry, network activity, DNS lookups, MITRE ATT&CK techniques, IDS alerts, and signature matches in a single view. Parameters: hash (required): MD5, SHA-1 or SHA-256 hash of the file.
Retrieve a VirusTotal collection by ID. Collections represent threat actors, malware families, campaigns, intel reports, and curated IOC sets. Optionally include relationships to fetch member IOCs in the same call. Parameters: id (required): Collection ID; relationships (optional): Array of relationship names to include.
