# BurtTheCoder/mcp-virustotal [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/BurtTheCoder/mcp-virustotal  
**GitHub Stars:** 152  
**npm Downloads (last month):** 3236  
**Views:** 4  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/burtthecoder-mcp-virustotal

## Description
MCP server for querying the VirusTotal API. This server provides tools for scanning URLs, analyzing file hashes, and retrieving IP address reports.

## Tools
Capabilities this server exposes over MCP:

- **get_url_report**
- **url**
- **get_file_report**
- **hash**
- **get_ip_report**
- **ip**
- **get_domain_report**
- **domain**
- **relationships**
- **get_url_relationship**
- **relationship**
- **limit**
- **cursor**
- **get_file_relationship**
- **get_ip_relationship**
- **get_domain_relationship**
- **search_vt**
- **query**
- **evil.com**
- **get_file_behaviour_summary**
- **get_collection**
- **related_threat_actors**
- **collections**
- **id**

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "mcp-virustotal": {
    "command": "npx",
    "args": ["-y","@burtthecoder/mcp-virustotal"],
    "env": {
      "VIRUSTOTAL_API_KEY": "",
      "MCP_TRANSPORT": "",
      "MCP_PORT": "",
      "MCP_ENDPOINT": ""
    }
  }
}
```

**Requires environment variables:** `VIRUSTOTAL_API_KEY`, `MCP_TRANSPORT`, `MCP_PORT`, `MCP_ENDPOINT` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What BurtTheCoder/mcp-virustotal MCP server does

The BurtTheCoder/mcp-virustotal MCP server gives MCP-compatible clients access to VirusTotal security data. It can retrieve reports for URLs, files identified by MD5, SHA-1, or SHA-256, IP addresses, and domains. Report tools return core analysis data together with selected related objects, such as contacted infrastructure, downloaded or dropped files, behaviors, certificates, subdomains, and threat actors, depending on the object type.

The server also supports more targeted investigation. Relationship tools query a chosen relationship type with pagination, while corpus search accepts free-form VirusTotal queries, including modifier syntax such as type and detection-count filters. Additional capabilities cover merged sandbox behavior summaries, threat collections, and related threat actors.

This belongs in the 🔒 Security category and is suited to workflows that need reputation checks, infrastructure pivots, malware-context lookups, or relationship data from VirusTotal.

## How it works

The BurtTheCoder/mcp-virustotal MCP server calls the VirusTotal API using the `VIRUSTOTAL_API_KEY` environment variable. URL lookups prefer an existing VirusTotal report; when no cached report is available, the server can submit the URL for scanning and poll for completion. Other report tools use the supplied file hash, IP address, or domain name.

Relationship results support limits and continuation cursors. The documented limits range from 1 to 40 for URL relationship queries, with a default of 10. Report requests batch relevant relationship retrieval to reduce API calls. The available relationship types vary by object and include network connections, contacted domains or IPs, dropped files, behaviors, redirects, certificates, collections, and threat actors.

By default, the server uses stdio transport. It can also run as an HTTP streaming service by setting `MCP_TRANSPORT=httpStream`; `MCP_PORT` controls the port and `MCP_ENDPOINT` controls the MCP path. HTTP mode also exposes a `/health` endpoint.

## Setup and configuration

Install the published npm package globally, or run it directly with `npx`:

- Set `VIRUSTOTAL_API_KEY` to a VirusTotal API key.
- Configure the command for an MCP client such as Claude Desktop.
- Restart or reload the client after adding the server.

The documented Claude Desktop configuration uses `mcp-virustotal` as the command and passes the API key through the `env` object. The package can also be added through Smithery. For source-based use, clone the repository, run `npm install`, build with `npm run build`, and start `build/index.js` with Node.

For HTTP streaming, set `MCP_TRANSPORT=httpStream`, provide the API key, and optionally set `MCP_PORT` and `MCP_ENDPOINT`.

## Tools and capabilities

The BurtTheCoder/mcp-virustotal MCP server exposes capabilities for:

- URL, file, IP, and domain reports.
- Object-specific relationship queries with pagination.
- VirusTotal corpus searches across files, URLs, domains, IPs, and comments.
- Cross-sandbox behavior summaries covering processes, files, registry activity, network activity, MITRE ATT&CK data, IDS alerts, and signatures.
- Threat collection retrieval for APT, malware-family, campaign, and intelligence-report objects.

The report tools include `get_url_report`, `get_file_report`, `get_ip_report`, and `get_domain_report`. The relationship tools include URL, file, IP, and domain variants.

## Limitations and notes

A VirusTotal API key is required. URL scanning may submit a URL and wait for analysis when a cached result is unavailable, so that path is not limited to passive report retrieval. Relationship availability depends on the VirusTotal object and the relationship type selected.

It does not establish compatibility with every MCP client. HTTP streaming is an alternative transport, not the default; stdio is used unless the transport environment variable is changed.

_Full upstream README: https://allmcps.com/mcp/burtthecoder-mcp-virustotal/readme_