==================
/// MCP ///
/// MCP ///
==================
[server:online]
[protocol:ready]mcp-virustotal
by BurtTheCoder
Model Context Protocol (MCP) server that exposes VirusTotal querying tools (URL, file, IP, domain reports & relationship APIs) for easy integration with MCP-compatible clients such as Claude Desktop.
get_url_report
Get a comprehensive URL analysis report including security scan results and key relationships (communicating files, contacted domains/IPs, downloaded files, redirects, threat actors).
get_file_report
Get a comprehensive file analysis report using its hash (MD5/SHA-1/SHA-256), including detection results, file properties, and key relationships (behaviors, dropped files, network connections, embedded content, threat actors).
get_ip_report
Get a comprehensive IP address analysis report including geolocation, reputation data, and key relationships (communicating files, historical certificates/WHOIS, resolutions).
get_domain_report
Get a comprehensive domain analysis report including DNS records, WHOIS data, and key relationships (SSL certificates, subdomains, historical data).
get_url_relationship
Query a specific relationship type for a URL with pagination support across 17 relationship types such as analyses, communicating files, contacted domains/IPs, downloaded files, graphs, referrers, redirects, and threat actors.
get_file_relationship
Query a specific relationship type for a file with pagination support across 41 relationship types including behaviors, network connections, dropped files, embedded content, execution chains, and threat actors.
get_ip_relationship
Query a specific relationship type for an IP address with pagination support across 12 relationship types including communicating files, historical SSL certificates, WHOIS records, resolutions, and threat actors.
get_domain_relationship
Query a specific relationship type for a domain with pagination support across 21 relationship types including SSL certificates, subdomains, historical data, and DNS records.
Installation
git clone https://github.com/BurtTheCoder/mcp-virustotal.git
cd mcp-virustotalnpm install # or: pnpm install / yarn installcp .env.example .env
VIRUSTOTAL_API_KEY="<your_api_key>"npm run build # usually invokes tscnpm start # or: node dist/index.jsThe server should log the listening port (default 3000). Use curl or any MCP-compatible client to send requests.