A MCP server for querying the VirusTotal API. This server provides tools for scanning URLs, analyzing file hashes, and retrieving IP address reports.
まだレビューはありません. 最初のレビューを投稿しましょう！
会話に参加するにはサインインしてください
Get a comprehensive URL analysis report including security scan results and key relationships (communicating files, contacted domains/IPs, downloaded files, redirects, threat actors). Returns the cached VirusTotal report when available; only submits the URL for scanning and polls for completion on a cache miss. Parameters: url (required): The URL to analyze.
Get a comprehensive file analysis report using its hash (MD5/SHA-1/SHA-256). Includes detection results, file properties, and key relationships (behaviors, dropped files, network connections, embedded content, threat actors). Parameters: hash (required): MD5, SHA-1 or SHA-256 hash of the file.
Get a comprehensive IP address analysis report including geolocation, reputation data, and key relationships (communicating files, historical certificates/WHOIS, resolutions). Parameters: ip (required): IP address to analyze.
Get a comprehensive domain analysis report including DNS records, WHOIS data, and key relationships (SSL certificates, subdomains, historical data). Parameters: domain (required): Domain name to analyze; relationships (optional): Array of specific relationships to include in the report.
Query a specific relationship type for a URL with pagination support. Choose from 22 relationship types including analyses, communicating files, contacted domains/IPs, downloaded files, graphs, referrers, redirects, threat actors, collections, and votes. Parameters: url (required): The URL to get relationships for; relationship (required): Type of relationship to query; limit (optional, default: 10): Maximum number of related objects to retrieve (1-40); cursor (optional): Continuation cursor for pagination.
Query a specific relationship type for a file with pagination support. Choose from 40 relationship types including behaviors, network connections, dropped files, embedded content, execution chains, and threat actors. Parameters: hash (required): MD5, SHA-1 or SHA-256 hash of the file; relationship (required): Type of relationship to query; limit (optional, default: 10): Maximum number of related objects to retrieve (1-40); cursor (optional): Continuation cursor for pagination.
Query a specific relationship type for an IP address with pagination support. Choose from 15 relationship types including communicating files, historical SSL certificates, WHOIS records, resolutions, threat actors, and votes. Parameters: ip (required): IP address to analyze; relationship (required): Type of relationship to query; limit (optional, default: 10): Maximum number of related objects to retrieve (1-40); cursor (optional): Continuation cursor for pagination.
Query a specific relationship type for a domain with pagination support. Choose from 24 relationship types including SSL certificates, subdomains, historical data, DNS records, and collections. Parameters: domain (required): Domain name to analyze; relationship (required): Type of relationship to query; limit (optional, default: 10): Maximum number of related objects to retrieve (1-40); cursor (optional): Continuation cursor for pagination.
Search the VirusTotal corpus for files, URLs, domains, IPs, or comments matching a query. Accepts plain IOCs (hash, URL, domain, IP), free text against comments, or VTI-style search modifiers. Parameters: query (required): Search query. Examples: a SHA-256 hash, `evil.com`, `8.8.8.8`, `type:peexe size:90kb+ tag:signed positives:5+`; limit (optional, default: 20): Maximum number of results (1-300); cursor (optional): Continuation cursor for pagination.
Get a consolidated sandbox behaviour summary for a file, merged across every sandbox that analyzed it. Returns processes, files, registry, network activity, DNS lookups, MITRE ATT&CK techniques, IDS alerts, and signature matches in a single view. Parameters: hash (required): MD5, SHA-1 or SHA-256 hash of the file.
Retrieve a VirusTotal collection by ID. Collections represent threat actors, malware families, campaigns, intel reports, and curated IOC sets. Optionally include relationships to fetch member IOCs in the same call. Parameters: id (required): Collection ID (e.g. `threat-actor--<uuid>`, `malware-family--<id>`); relationships (optional): Array of relationship names to include.
