VirusTotal MCP Server

SecurityTypeScript

Access VirusTotal's security analysis tools for URLs, files, IPs, and domains

Available Tools

get_url_report

Get a comprehensive URL analysis report including security scan results and key relationships (communicating files, contacted domains/IPs, downloaded files, redirects, threat actors)

url

get_file_report

Get a comprehensive file analysis report using its hash (MD5/SHA-1/SHA-256). Includes detection results, file properties, and key relationships (behaviors, dropped files, network connections, embedded content, threat actors)

hash

get_ip_report

Get a comprehensive IP address analysis report including geolocation, reputation data, and key relationships (communicating files, historical certificates/WHOIS, resolutions)

ip

get_domain_report

Get a comprehensive domain analysis report including DNS records, WHOIS data, and key relationships (SSL certificates, subdomains, historical data)

domainrelationships

get_url_relationship

Query a specific relationship type for a URL with pagination support. Choose from 17 relationship types including analyses, communicating files, contacted domains/IPs, downloaded files, graphs, referrers, redirects, and threat actors

urlrelationshiplimitcursor

get_file_relationship

Query a specific relationship type for a file with pagination support. Choose from 41 relationship types including behaviors, network connections, dropped files, embedded content, execution chains, and threat actors

hashrelationshiplimitcursor

VirusTotal MCP provides comprehensive security analysis capabilities through the VirusTotal API. It enables AI assistants to analyze URLs, files (via hash), IP addresses, and domains for security threats, malware, and other risks. The server automatically fetches relevant relationship data along with basic reports, providing complete security overviews in a single request.

Overview

VirusTotal MCP provides AI assistants with access to VirusTotal's powerful security analysis capabilities. This server allows for comprehensive security analysis of URLs, files (via hash), IP addresses, and domains, with automatic relationship data fetching to provide complete security overviews.

Prerequisites

A VirusTotal API key (obtain one by signing up at VirusTotal)
Node.js installed on your system

Installation Options

Option 1: Install via Smithery (Recommended)

The easiest way to install the VirusTotal MCP server is using Smithery:

npx -y @smithery/cli install @burtthecoder/mcp-virustotal --client claude

This automatically configures the server for Claude Desktop.

Option 2: Install via NPM

Install the server globally:

npm install -g @burtthecoder/mcp-virustotal

Add the server configuration to your AI assistant's configuration file:

For Claude Desktop, edit the configuration file located at:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json

Add the following configuration:

{
  "mcpServers": {
    "virustotal": {
      "command": "mcp-virustotal",
      "env": {
        "VIRUSTOTAL_API_KEY": "your-virustotal-api-key"
      }
    }
  }
}

Restart your AI assistant application

Option 3: Run from Source

If you need to modify the code or prefer running from source:

Clone the repository and build:

git clone https://github.com/BurtTheCoder/mcp-virustotal.git
cd mcp-virustotal
npm install
npm run build

Configure your AI assistant to use the local build:

{
  "mcpServers": {
    "virustotal": {
      "command": "node",
      "args": ["--experimental-modules", "/absolute/path/to/mcp-virustotal/build/index.js"],
      "env": {
        "VIRUSTOTAL_API_KEY": "your-virustotal-api-key"
      }
    }
  }
}

Usage

Once installed, you can ask your AI assistant to analyze security aspects of URLs, files (via hash), IP addresses, and domains. The server provides comprehensive reports with automatically fetched relationship data.

Example prompts:

"Can you analyze this URL for security threats: example.com/suspicious-file"
"Check this file hash for malware: 44d88612fea8a8f36de82e1278abb02f"
"Is this IP address associated with any malicious activity: 8.8.8.8"
"Analyze this domain for security issues: example.com"

Configuration Options

The server accepts the following environment variables:

VIRUSTOTAL_API_KEY (required): Your VirusTotal API key
LOG_LEVEL (optional): Set logging level (default: "info")
PORT (optional): Port to run the server on (default: auto-assigned)

Docker Support

The server can also be run as a Docker container:

docker build -t mcp-virustotal .
docker run -e VIRUSTOTAL_API_KEY=your-api-key mcp-virustotal