This VirusTotal MCP server, developed by BurtTheCoder, enables AI assistants like Claude to leverage VirusTotal's threat intelligence capabilities. Built in JavaScript/TypeScript, it provides functionality for scanning URLs, analyzing file hashes, and retrieving IP address reports. The implementation stands out by offering relationship analysis tools and pagination support for large result sets. By connecting AI capabilities with VirusTotal's extensive threat data, this server allows AI systems to perform security analysis and threat detection programmatically. It is particularly useful for building AI-powered tools for malware research, phishing detection, and network security monitoring that require access to up-to-date threat intelligence.
No reviews yet. Be the first to review!
Sign in to join the conversation
Highlight AIGet a comprehensive URL analysis report including security scan results and key relationships. Returns the cached VirusTotal report when available; only submits the URL for scanning and polls for completion on a cache miss. Parameters: url (required)
Get a comprehensive file analysis report using its hash (MD5/SHA-1/SHA-256). Includes detection results, file properties, and key relationships. Parameters: hash (required)
Get a comprehensive IP address analysis report including geolocation, reputation data, and key relationships. Parameters: ip (required)
Get a comprehensive domain analysis report including DNS records, WHOIS data, and key relationships. Parameters: domain (required), relationships (optional)
Query a specific relationship type for a URL with pagination support. Parameters: url (required), relationship (required), limit (optional), cursor (optional)
Query a specific relationship type for a file with pagination support. Parameters: hash (required), relationship (required), limit (optional), cursor (optional)
Query a specific relationship type for an IP address with pagination support. Parameters: ip (required), relationship (required), limit (optional), cursor (optional)
Query a specific relationship type for a domain with pagination support. Parameters: domain (required), relationship (required), limit (optional), cursor (optional)
Search the VirusTotal corpus for files, URLs, domains, IPs, or comments matching a query. Parameters: query (required), limit (optional), cursor (optional)
Get a consolidated sandbox behaviour summary for a file, merged across every sandbox that analyzed it. Parameters: hash (required)
Retrieve a VirusTotal collection by ID. Optionally include relationships to fetch member IOCs in the same call. Parameters: id (required), relationships (optional)
