This VirusTotal MCP server, developed by BurtTheCoder, enables AI assistants like Claude to leverage VirusTotal's threat intelligence capabilities. Built in JavaScript/TypeScript, it provides functionality for scanning URLs, analyzing file hashes, and retrieving IP address reports. The implementation stands out by offering relationship analysis tools and pagination support for large result sets. By connecting AI capabilities with VirusTotal's extensive threat data, this server allows AI systems to perform security analysis and threat detection programmatically. It is particularly useful for building AI-powered tools for malware research, phishing detection, and network security monitoring that require access to up-to-date threat intelligence.
No reviews yet. Be the first to review!
Sign in to join the conversation
Highlight AIGet a comprehensive URL analysis report including security scan results and key relationships. Parameters: url (required): The URL to analyze
Get a comprehensive file analysis report using its hash. Parameters: hash (required): MD5, SHA-1 or SHA-256 hash of the file
Get a comprehensive IP address analysis report including geolocation and reputation data. Parameters: ip (required): IP address to analyze
Get a comprehensive domain analysis report including DNS records and WHOIS data. Parameters: domain (required): Domain name to analyze, relationships (optional): Array of specific relationships to include in the report
Query a specific relationship type for a URL with pagination support. Parameters: url (required): The URL to get relationships for, relationship (required): Type of relationship to query, limit (optional, default: 10): Maximum number of related objects to retrieve, cursor (optional): Continuation cursor for pagination
Query a specific relationship type for a file with pagination support. Parameters: hash (required): MD5, SHA-1 or SHA-256 hash of the file, relationship (required): Type of relationship to query, limit (optional, default: 10): Maximum number of related objects to retrieve, cursor (optional): Continuation cursor for pagination
Query a specific relationship type for an IP address with pagination support. Parameters: ip (required): IP address to analyze, relationship (required): Type of relationship to query, limit (optional, default: 10): Maximum number of related objects to retrieve, cursor (optional): Continuation cursor for pagination
Query a specific relationship type for a domain with pagination support. Parameters: domain (required): Domain name to analyze, relationship (required): Type of relationship to query, limit (optional, default: 10): Maximum number of related objects to retrieve, cursor (optional): Continuation cursor for pagination
Search the VirusTotal corpus for files, URLs, domains, IPs, or comments matching a query. Parameters: query (required): Search query, limit (optional, default: 20): Maximum number of results, cursor (optional): Continuation cursor for pagination
Get a consolidated sandbox behaviour summary for a file, merged across every sandbox that analyzed it. Parameters: hash (required): MD5, SHA-1 or SHA-256 hash of the file
Retrieve a VirusTotal collection by ID. Parameters: id (required): Collection ID, relationships (optional): Array of relationship names to include
