MCP Virustotal

What BurtTheCoder/mcp-virustotal MCP server does

The BurtTheCoder/mcp-virustotal MCP server gives MCP-compatible clients access to VirusTotal security data. It can retrieve reports for URLs, files identified by MD5, SHA-1, or SHA-256, IP addresses, and domains. Report tools return core analysis data together with selected related objects, such as contacted infrastructure, downloaded or dropped files, behaviors, certificates, subdomains, and threat actors, depending on the object type.

The server also supports more targeted investigation. Relationship tools query a chosen relationship type with pagination, while corpus search accepts free-form VirusTotal queries, including modifier syntax such as type and detection-count filters. Additional capabilities cover merged sandbox behavior summaries, threat collections, and related threat actors.

This belongs in the 🔒 Security category and is suited to workflows that need reputation checks, infrastructure pivots, malware-context lookups, or relationship data from VirusTotal.

How it works

The BurtTheCoder/mcp-virustotal MCP server calls the VirusTotal API using the VIRUSTOTAL_API_KEY environment variable. URL lookups prefer an existing VirusTotal report; when no cached report is available, the server can submit the URL for scanning and poll for completion. Other report tools use the supplied file hash, IP address, or domain name.

Relationship results support limits and continuation cursors. The documented limits range from 1 to 40 for URL relationship queries, with a default of 10. Report requests batch relevant relationship retrieval to reduce API calls. The available relationship types vary by object and include network connections, contacted domains or IPs, dropped files, behaviors, redirects, certificates, collections, and threat actors.

By default, the server uses stdio transport. It can also run as an HTTP streaming service by setting MCP_TRANSPORT=httpStream; MCP_PORT controls the port and MCP_ENDPOINT controls the MCP path. HTTP mode also exposes a /health endpoint.

Setup and configuration

Install the published npm package globally, or run it directly with npx:

• Set VIRUSTOTAL_API_KEY to a VirusTotal API key.
• Configure the command for an MCP client such as Claude Desktop.
• Restart or reload the client after adding the server.

The documented Claude Desktop configuration uses mcp-virustotal as the command and passes the API key through the env object. The package can also be added through Smithery. For source-based use, clone the repository, run npm install, build with npm run build, and start build/index.js with Node.

For HTTP streaming, set MCP_TRANSPORT=httpStream, provide the API key, and optionally set MCP_PORT and MCP_ENDPOINT.

Tools and capabilities

The BurtTheCoder/mcp-virustotal MCP server exposes capabilities for:

• URL, file, IP, and domain reports.
• Object-specific relationship queries with pagination.
• VirusTotal corpus searches across files, URLs, domains, IPs, and comments.
• Cross-sandbox behavior summaries covering processes, files, registry activity, network activity, MITRE ATT&CK data, IDS alerts, and signatures.
• Threat collection retrieval for APT, malware-family, campaign, and intelligence-report objects.

The report tools include get_url_report, get_file_report, get_ip_report, and get_domain_report. The relationship tools include URL, file, IP, and domain variants.

Limitations and notes

A VirusTotal API key is required. URL scanning may submit a URL and wait for analysis when a cached result is unavailable, so that path is not limited to passive report retrieval. Relationship availability depends on the VirusTotal object and the relationship type selected.

It does not establish compatibility with every MCP client. HTTP streaming is an alternative transport, not the default; stdio is used unless the transport environment variable is changed.