VirusTotal MCP server for AI agents

The VirusTotal MCP Server provides a secure way to analyze URLs, files, IP addresses, and domains by interfacing with the VirusTotal API. It automatically fetches comprehensive security data including relationship information and integrates with MCP-compatible applications like Claude Desktop.

Installation

Installing via Smithery

The easiest way to install the VirusTotal MCP server for Claude Desktop is through Smithery:

npx -y @smithery/cli install @emeryray2002/virustotal-mcp --client claude

Requirements

Before installation, ensure you have:

Python 3.11 or newer
A valid VirusTotal API Key
The following Python packages:
- aiohttp (version 3.9.0+)
- mcp[cli] (version 1.4.1+)
- python-dotenv (version 1.0.0+)
- typing-extensions (version 4.8.0+)

Available Tools

Report Tools

These tools provide comprehensive security reports with automatically fetched relationship data.

URL Report Tool

await get_url_report(url="http://example.com/suspicious")

Returns a complete URL analysis including security scan results and key relationships such as:

Communicating files
Contacted domains/IPs
Downloaded files
Redirects
Associated threat actors

File Report Tool

await get_file_report(hash="44d88612fea8a8f36de82e1278abb02f")

Analyzes a file using its hash (MD5, SHA-1, or SHA-256) and returns:

Detection results
File properties
Behaviors
Dropped files
Network connections
Embedded content
Threat actor information

IP Report Tool

await get_ip_report(ip="8.8.8.8")

Provides comprehensive IP address analysis including:

Geolocation data
Reputation information
Communicating files
Historical certificates and WHOIS
DNS resolutions

Domain Report Tool

await get_domain_report(domain="example.com")

Delivers a complete domain analysis with:

DNS records
WHOIS data
SSL certificates
Subdomains
Historical information

Relationship Analysis Tools

These tools allow for detailed investigation of specific relationships with pagination support.

URL Relationship Tool

await get_url_relationship(
    url="http://example.com/suspicious",
    relationship="communicating_files",
    limit=20
)

Query specific relationship types for a URL. Available relationships include:

analyses, comments, communicating_files, contacted_domains
contacted_ips, downloaded_files, graphs, last_serving_ip_address
network_location, referrer_files, referrer_urls, redirecting_urls
redirects_to, related_comments, related_references, related_threat_actors, submissions

File Relationship Tool

await get_file_relationship(
    hash="44d88612fea8a8f36de82e1278abb02f",
    relationship="behaviours",
    limit=20
)

Query specific relationship types for a file. Available relationships include:

analyses, behaviours, bundled_files, carbonblack_children
carbonblack_parents, ciphered_bundled_files, and many more

IP Relationship Tool

await get_ip_relationship(
    ip="8.8.8.8",
    relationship="communicating_files",
    limit=20
)

Query specific relationship types for an IP address. Available relationships include:

comments, communicating_files, downloaded_files, graphs
historical_ssl_certificates, historical_whois, related_comments
related_references, related_threat_actors, referrer_files, resolutions, urls

Domain Relationship Tool

await get_domain_relationship(
    domain="example.com",
    relationship="historical_ssl_certificates",
    limit=20
)

Query specific relationship types for a domain. Available relationships include:

caa_records, cname_records, comments, communicating_files
downloaded_files, historical_ssl_certificates, historical_whois
immediate_parent, mx_records, ns_records, and many more

Advanced Search Tool

await advanced_corpus_search(
    query="type:peexe size:100kb+ positives:5+",
    limit=20,
    cursor=None
)

Perform complex searches across the VirusTotal dataset using VT Intelligence query syntax.

Error Handling

The server handles various error conditions:

Invalid API keys
Rate limiting issues
Network errors
Invalid parameters or formats
Pagination errors

How to install this MCP server

For Claude Code

To add this MCP server to Claude Code, run this command in your terminal:

claude mcp add-json "virustotal-mcp" '{"command":"npx","args":["-y","@emeryray2002/virustotal-mcp"]}'

See the official Claude Code MCP documentation for more details.

For Cursor

There are two ways to add an MCP server to Cursor. The most common way is to add the server globally in the ~/.cursor/mcp.json file so that it is available in all of your projects.

If you only need the server in a single project, you can add it to the project instead by creating or adding it to the .cursor/mcp.json file.

Adding an MCP server to Cursor globally

To add a global MCP server go to Cursor Settings > Tools & Integrations and click "New MCP Server".

When you click that button the ~/.cursor/mcp.json file will be opened and you can add your server like this:

{
    "mcpServers": {
        "virustotal-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "@emeryray2002/virustotal-mcp"
            ]
        }
    }
}

Adding an MCP server to a project

To add an MCP server to a project you can create a new .cursor/mcp.json file or add it to the existing one. This will look exactly the same as the global MCP server example above.

How to use the MCP server

Once the server is installed, you might need to head back to Settings > MCP and click the refresh button.

The Cursor agent will then be able to see the available tools the added MCP server has available and will call them when it needs to.

You can also explicitly ask the agent to use the tool by mentioning the tool name and describing what the function does.

For Claude Desktop

To add this MCP server to Claude Desktop:

1. Find your configuration file:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Linux: ~/.config/Claude/claude_desktop_config.json

2. Add this to your configuration file:

{
    "mcpServers": {
        "virustotal-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "@emeryray2002/virustotal-mcp"
            ]
        }
    }
}

3. Restart Claude Desktop for the changes to take effect