What is the best alternative to MCP Virustotal?

The top-rated alternatives to MCP Virustotal in the Security category include MCP Shodan, Osv MCP, Urldna MCP. These servers offer complementary or alternative capabilities depending on your deployment stack and authentication requirements.

How do MCP Virustotal alternatives differ in installation and runtime?

MCP Virustotal and its alternatives vary by runtime requirement (Node.js/npx, Python/uvx, Docker, or remote HTTP/SSE endpoints). Check the specification comparison table above to verify command requirements before installing.

Are alternatives to MCP Virustotal free and open source?

Most MCP servers listed on AllMCPs are open source tools under MIT or Apache licenses that you can self-host or run locally with Claude Desktop, Cursor, VS Code, or Windsurf.

How do I side-by-side compare MCP Virustotal with a specific alternative?

Click the "Compare side-by-side →" button on any alternative card to see an in-depth comparison matrix covering feature lists, stars, npm downloads, install configurations, and schema specifications.

Security• MCP Alternatives Guide

Best Alternatives to MCP Virustotal

Looking for an alternative to MCP Virustotal? Whether you need a different runtime environment, custom authentication support, or alternative API integrations in the Security ecosystem, we have cataloged and compared the top alternative MCP servers below.

Browse all Security servers →View MCP Virustotal Specs →

Target Reference Server

MCP Virustotal Overview

The BurtTheCoder/mcp-virustotal MCP server queries the VirusTotal API for URL, file, IP address, and domain intelligence. It exposes report, relationship, corpus-search, sandbox-behavior, and threat-collection tools over MCP, using an API key and either stdio or HTTP streaming transport. Reach for it when an agent needs VirusTotal lookups or related threat context during security analysis.

Server Name	Runtime	Auth	Pricing	GitHub Stars	Downloads	Action
MCP Virustotal (Target)	npx	API key	Bring your own API key (usage-based cost)	149	—	Current
MCP Shodan	npx	API key	Bring your own API key (usage-based cost)	171	—	Compare →
Osv MCP	—	No auth required	Free	42	—	Compare →
Urldna MCP	—	API key	Bring your own API key (usage-based cost)	7	—	Compare →
1Claw Vault	npx	API key	Free	2	—	Compare →
Ida Pro MCP	—	No auth required	Bring your own API key (usage-based cost)	12,105	—	Compare →
MCP Inspector	npx	API key	Freemium	1	—	Compare →
Agntor MCP	npx	API key	Bring your own API key (usage-based cost)	1	—	Compare →
Scamverify MCP	npx	API key	Freemium	1	—	Compare →
MCP Security	—	No auth required	Free	51	—	Compare →
MCP Maigret	—	No auth required	Free	263	—	Compare →
Misp MCP Server	npx	API key	Free	2	—	Compare →
Honeylabs MCP	Remote (SSE)	API key	Freemium	2	—	Compare →

Detailed Evaluation of MCP Virustotal Alternatives

MCP Shodan

Runtime: npx

Queries Shodan for IP, DNS, device, CPE, and vulnerability intelligence through MCP tools.

Key Features:

IP reconnaissance with service and location details

Shodan device search

Forward and reverse DNS lookups

3 0 171

Compare side-by-side

Osv MCP

Runtime not confirmed

Query OSV for package, commit, batch, and vulnerability-ID security data through MCP tools.

Key Features:

Query package versions or commits

Accept package URLs for lookups

Batch query multiple packages or commits

3 0 42

Compare side-by-side

Urldna MCP

Runtime not confirmed

urldna/mcp MCP server lets security agents scan URLs, investigate phishing infrastructure, and search urlDNA threat intelligence.

Key Features:

URL safety checks and full scans

DOM, network, and screenshot evidence

CQL search across recorded scans

4 0 7

Compare side-by-side

1Claw Vault

Runtime: npx

HSM-backed vault access, secret rotation, transaction signing, and threat scanning for MCP clients.

Key Features:

HSM-backed vault secret access

Secret versioning and server-side rotation

Environment bundle and variable resolution

4 0 2

Compare side-by-side

Ida Pro MCP

Runtime not confirmed

Connects AI assistants to IDA Pro for decompilation, disassembly, database changes, and reverse-engineering workflows.

Key Features:

IDA Pro decompilation access

Disassembly inspection

Database comments, renaming, and type updates

4 0 12,105

Compare side-by-side

MCP Inspector

Runtime: npx

Checks domain reputation and scans URLs for phishing, malware, redirects, and other website security risks.

Key Features:

Domain reputation scores from 0 to 100

Phishing and malware detection

URL redirect and forensic analysis

3 0 1

Compare side-by-side

Agntor MCP

Runtime: npx

Audits, protects, discovers, and administers AI agents through trust, certification, escrow, and safety tools.

Key Features:

Agent discovery and registration

Certification and trust scoring

Prompt, output, and tool safety controls

3 0 1

Compare side-by-side

Scamverify MCP

Runtime: npx

Checks phones, URLs, messages, emails, documents, and QR codes against threat intelligence and returns risk findings.

Key Features:

Phone and URL threat lookups

Text and email phishing analysis

Document and QR code verification

3 0 1

Compare side-by-side

MCP Security

Runtime not confirmed

Query ORKL for threat reports, threat actors, and intelligence source metadata through MCP tools.

Key Features:

Fetch recent threat report titles and IDs

Retrieve threat report details by ID

List known threat actors

3 0 51

Compare side-by-side

MCP Maigret

Runtime not confirmed

Searches public sites for usernames and analyzes URLs through Maigret, with Docker-backed reports in several output formats.

Key Features:

Username searches across social networks and websites

URL parsing with associated username searches

Site filtering by tags

4 0 263

Compare side-by-side

Misp MCP Server

Runtime: npx

Read-only MISP threat-intelligence access with eight MCP tools and response scanning for prompt-injection patterns.

Key Features:

Read-only access with no mutation tools

Eight tools for MISP events, attributes, search, tags, feeds, and galaxies

Output scanning for prompt-injection, XSS, and shell-injection patterns

2 0 2

Compare side-by-side

Honeylabs MCP

Runtime: Remote (SSE)

Queries 90 days of honeypot telemetry for IP reputation, attack patterns, CVE probes, and network fingerprints.

Key Features:

90 days of honeypot probe data

IP, domain, ASN, and CVE lookups

JA4, JA3, JA4H, and HASSH searches

4 0 2

Compare side-by-side

Best Alternatives to MCP Virustotal

MCP Virustotal Overview

Specification Matrix: MCP Virustotal vs Alternatives

Detailed Evaluation of MCP Virustotal Alternatives

MCP Shodan

Osv MCP

Urldna MCP

1Claw Vault

Ida Pro MCP

MCP Inspector

Agntor MCP

Scamverify MCP

MCP Security

MCP Maigret

Misp MCP Server

Honeylabs MCP

Frequently Asked Questions: MCP Virustotal Alternatives