Virustotal vs VPNDetection
A side-by-side look at the Virustotal and VPNDetection MCP servers: transport, auth, tools, quality signals, and the config to install either one in Claude, Cursor, Windsurf or VS Code.
Verdict: choose Virustotal for security work as a local process; choose VPNDetection for security as a local process. You can also run both side by side in one mcpServers block.
Which MCP server should you choose?
Choose Virustotal when
- You need dedicated capabilities in the Security domain.
- You prefer a local stdio subprocess transport.
- You want tools like
lookup_file, lookup_url, lookup_domain.
Choose VPNDetection when
- You need dedicated capabilities in the Security domain.
- You prefer a local stdio subprocess transport.
- You have the keys it needs:
VPNDETECTION_API_KEY, VPNDETECTION_BASE_URL. - You want tools like
lookup_ip, lookup_ips, my_entitlement.
Feature & specification comparison
Rows where the two servers differ are marked.
| Spec | ||
|---|---|---|
| Category | Security | Security |
| Quality signal | 57/100 · Good | 57/100 · Good |
| Install command | Confirmed | Confirmed |
| Transport | Local subprocess (stdio) | Local subprocess (stdio) |
| Auth | Not declared | Not declared |
| Pricing | Not declared | Freemium |
| Required env vars | None listed | VPNDETECTION_API_KEYVPNDETECTION_BASE_URL |
| Verified owner | Community listing | Community listing |
| GitHub stars | 0 | 1 |
| Directory activity | 2 views 0 installs 0 upvotes | 1 views 0 installs 0 upvotes |
| Tools | 4 | 7 |
| Full listing | View Virustotal | View VPNDetection |
Tools & capabilities
Virustotal tools 4
lookup_fileLook up a file by hash (sha256, sha1, or md5). Returns last-analysis stats (malicious / suspicious / harmless / undetected detector counts), type description, size, names seen, and tags. Useful for triaging hashes seen in alerts or logs.lookup_urlLook up a URL's reputation. Returns last-analysis stats across all engines, categories (per vendor), and whether the URL has been redirected. The URL is canonicalized before lookup; no submission step is required to read existing reports.lookup_domainLook up a domain's reputation via VirusTotal (no scheme, e.g. "example.com"). Returns engine analysis stats (malicious/suspicious/harmless/undetected counts and percent), reputation score, community votes, tags, last-analyzed date, and a link to the VirusTotal GUI report.lookup_ipLook up an IPv4 address. Returns last-analysis stats, ASN/owner, country, network range, and reputation score.
VPNDetection tools 7
lookup_ipClassify one address.lookup_ipsClassify a whole list of addresses in one call, keyed by address. A long list is batched for you.my_entitlementWhat this key is entitled to and what it has spent: plan, field tier, requests so far, allowance, and when it resets.list_databasesEvery database we publish, with its `standing` for your organization: `licensed`, `expired` or `unlicensed`.database_metadataA database's columns, sample rows, row count, build date and file sizes.database_checksumThe published digests for one database file.list_downloadsYour organization's recent download attempts, refusals included.
Ready-to-paste client configs
Paste either block (or both) into your client config, e.g. claude_desktop_config.json or ~/.cursor/mcp.json. We only show a config when the install command is confirmed.
Virustotal
{
"mcpServers": {
"virustotal": {
"command": "npx",
"args": [
"-y",
"@pipeworx/mcp-virustotal"
]
}
}
}
VPNDetection
{
"mcpServers": {
"vpndetection": {
"command": "npx",
"args": [
"-y",
"vpndetection-mcp"
],
"env": {
"VPNDETECTION_API_KEY": "YOUR_VPNDETECTION_API_KEY_HERE",
"VPNDETECTION_BASE_URL": "YOUR_VPNDETECTION_BASE_URL_HERE"
}
}
}
}
Frequently asked questions
Virustotal is categorized under Security and uses a local stdio subprocess. VPNDetection belongs to Security and uses a local stdio subprocess. Pick Virustotal for security work and VPNDetection for security.
Copy the mcpServers block from the config section on this page into your client's config (for example claude_desktop_config.json or ~/.cursor/mcp.json), then fully restart the client.
Virustotal has no declared pricing — check the project's own site. VPNDetection is listed as freemium — a free tier with paid plans. If a server needs environment variables such as API keys, define them under the env key in your client's MCP config.
Yes. MCP clients support multiple servers: add virustotal and vpndetection as separate keys in the same mcpServers object, and your assistant will call tools from either one.
On AllMCPs, Virustotal has a quality signal of 57/100 (Good) with 2 views, 0 installs and 0 GitHub stars. VPNDetection has 57/100 (Good) with 1 views, 0 installs and 1 GitHub stars.