MCP.Market

Virustotal MCP server

by w0h1v·io.github.w0h1v/virustotal·v1.0.35·151 stars
No reviews yet

MCP server for querying VirusTotal API with comprehensive security analysis tools.

B83/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B83/100

full report

Adoption
Established

151 stars1.6k downloads/wk

Reviews

Write one

Nobody has reviewed Virustotal yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Virustotal tools

No tool declarations could be read from the package source. They show once the server is installed.

Public scan report

scanner v0.1.10 · 2026-10-14 · same rubric, same numbers if you re-run it

no findings
  • Code scan24 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Virustotal compares

Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
83/100
higher than 68% of 918 Security servers
GitHub stars
151
more than 96% of 585 Security servers
Downloads a week
1,562
more than 95% of 240 Security servers with a package

Install Virustotal in Claude Code, Cursor or VS Code

Runs npx -y @burtthecoder/mcp-virustotal on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add virustotal -- npx -y @burtthecoder/mcp-virustotal
Add to Cursor

What the publisher says

From the Virustotal repository's README, as published. We do not edit it. Read it on GitHub

Quickstart · Tools · HTTP · Security · Troubleshooting · Docs

mcp-virustotal is an MCP server that gives AI agents access to the VirusTotal v3 API. Hand your agent a hash, URL, IP or domain and get back the detection report plus the relationships an analyst would pivot on: contacted hosts, dropped files, resolutions, threat actors.

[!NOTE]

Independent project, not affiliated with VirusTotal or Google. You need your own VirusTotal API key.

Highlights

  • Reports with relationships. File, URL, IP and domain reports fetch key relationships in one batched ?relationships= call to save quota.
  • Cache first. geturlreport returns the cached VirusTotal report and only submits a scan on a cache miss.
  • Pivot tools. Corpus search with VTI-style modifiers (type:peexe positives:5+), merged sandbox behaviour summaries, and threat-actor and malware-family collections.
  • Full relationship paging. 100+ relationship types across files, URLs, IPs and domains, with cursor pagination.
  • Two transports. stdio for desktop clients, HTTP streaming for a shared service.
  • Tested. Unit tests for the formatters and API layer run in CI on Node 20, 22 and 24.

How it works

flowchart LR
    A["AI agent<br/>(Claude, Codex, Gemini, VS Code)"] -->|"MCP over stdio or HTTP"| S["mcp-virustotal"]
    S -->|"validate input,<br/>HTTPS + API key"| V["VirusTotal v3 API"]
    V -->|"JSON"| S
    S -->|"formatted report text"| A

Quickstart

Requirements: Node.js 20 or newer and a VirusTotal API key.

# Claude Code
claude mcp add --transport stdio --env VIRUSTOTAL_API_KEY=your-key virustotal -- npx -y @burtthecoder/mcp-virustotal

# Codex CLI
codex mcp add virustotal --env VIRUSTOTAL_API_KEY=your-key -- npx -y @burtthecoder/mcp-virustotal

# Gemini CLI
gemini mcp add -e VIRUSTOTAL_API_KEY=your-key virustotal npx -y @burtthecoder/mcp-virustotal

For Claude Desktop, VS Code, Smithery and running from source, see Connect a client.

Then ask your agent: "Look up the SHA-256 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f (the EICAR test file) and show what it drops and contacts."

Tools

Eleven tools. Full parameters and relationship lists are in the tool reference.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Virustotal: common questions

Is Virustotal MCP server safe?
Mostly: it is graded B (83/100). Read the Virustotal safety report
How do I install Virustotal?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Virustotal need an API key?
Yes. The registry entry asks for VIRUSTOTAL_API_KEY.
Is Virustotal maintained?
The last commit was 19 days ago (2026-10-13). The latest release is v1.0.35.
What can I use instead of Virustotal?
Servers from other publishers that do the same job: CrowdStrike Falcon MCP Server, Wireshark MCP server and Reversecore MCP server. Compare all Virustotal alternatives.
How does Virustotal compare with other Security MCP servers?
safety score 83/100 (higher than 68% of 918 Security servers); github stars 151 (more than 96% of 585 Security servers); downloads a week 1,562 (more than 95% of 240 Security servers with a package). Full comparison.

Alternatives to Virustotal

Same job from other publishers: the closest match first, then the best rated.

All Virustotal alternatives →
  • CrowdStrike Falcon MCP Server
    Connects AI agents with CrowdStrike Falcon for security analysis and automation.
    A
  • Wireshark
    Professional network analysis with tshark. Security audits, deep-dives, and threat detection.
    A
  • Reversecore MCP
    Security-first MCP server for reverse engineering, malware analysis, forensics, and SAST.
    B
  • Raziel
    MCP server teaching AI agents to implement TideCloak: auth, E2EE, IGA, security analysis
    A
  • npm Registry MCP Server
    npm registry MCP server — package intelligence, security audits, dependency analysis
    B
Virustotal vs CrowdStrike Falcon MCP ServerVirustotal vs WiresharkVirustotal vs Reversecore MCP