Virustotal Mcp
About
MCP server that enables LLMs to interact with the VirusTotal API for malware analysis, URL scanning, and threat intelligence.
Details
- Author
- yassinech-99
- Downloads
- 271
- Categories
- Other, Security
Jump to
- File analysis via upload or hash reports.
- URL and domain intelligence scanning.
- IP reputation lookups.
- Threat hunting with advanced search.
- Community interaction via comments.
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Virustotal McpCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
After cloning the repository, create a .env file with your VIRUSTOTAL_API_KEY and optionally API_BASE_URL and REQUEST_TIMEOUT. Install dependencies with uv pip install -e ., then configure the server in your MCP client (e.g., Claude Desktop) by adding the server entry pointing to virustotal_mcp.py. Use the provided tools like virustotal_scan_file, virustotal_scan_url, virustotal_get_domain_report, etc.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"virustotal mcp": {
"virustotal": {
"command": "uv",
"args": [
"--directory",
"D:\\coolAI\\mcp-client",
"run",
"virustotal_mcp.py"
],
"env": {
"VIRUSTOTAL_API_KEY": "<api_key_here>",
"API_BASE_URL": "https://www.virustotal.com/api/v3",
"REQUEST_TIMEOUT": "30.0"
}
}
}
}
}McpServers
{
"virustotal": {
"command": "uv",
"args": [
"--directory",
"D:\\coolAI\\mcp-client",
"run",
"virustotal_mcp.py"
],
"env": {
"VIRUSTOTAL_API_KEY": "<api_key_here>",
"API_BASE_URL": "https://www.virustotal.com/api/v3",
"REQUEST_TIMEOUT": "30.0"
}
}
}VirusTotal MCP Server (https://mcp.so/server/virustotal-mcp/yassinech-99)
A Model Context Protocol (MCP) server that enables LLMs to interact with the VirusTotal API for malware analysis, URL scanning, and threat intelligence.🚀 Features
File Analysis: Upload files or retrieve reports via MD5, SHA-1, or SHA-256 hashes. URL & Domain Intelligence: Scan URLs and get reputation reports for domains. IP Reputation: Look up threat data associated with specific IP addresses. Threat Hunting: Perform advanced searches using VirusTotal query syntax.- Community Interaction: Post comments on files, URLs, domains, or IPs.
📋 Prerequisites
1. VirusTotal API Key: Obtain one from VirusTotal. 2. Python 3.13+: Required as perpyproject.toml.
3. uv: Recommended for fast dependency management.
🛠 Installation
1. Clone & Setup
``bash
git clone https://github.com/your-username/virustotal-mcp.git
cd virustotal-mcp
`
2. Configure Environment
Create a .env file in the root directory:
`bash
VIRUSTOTAL_API_KEY=your_api_key_here
API_BASE_URL=https://www.virustotal.com/api/v3
REQUEST_TIMEOUT=30.0
`
3. Install Dependencies
`bash
uv pip install -e .
`
🔌 Claude Desktop Configuration
Add this to your claude_desktop_config.json:
`json
{
"mcpServers": {
"virustotal": {
"command": "uv",
"args": [
"--directory",
"D:\\coolAI\\mcp-client",
"run",
"virustotal_mcp.py"
],
"env": {
"VIRUSTOTAL_API_KEY": "<api_key_here>",
"API_BASE_URL": "https://www.virustotal.com/api/v3",
"REQUEST_TIMEOUT": "30.0"
}
}
}
}
`
🛠 Available Tools
| Tool | Description |
|------|-------------|
| virustotal_scan_file | Upload a local file for analysis. |
| virustotal_get_file_report | Get reports via hash. |
| virustotal_scan_url / virustotal_get_url_report | Scan and analyze URLs. |
| virustotal_get_domain_report | Domain-specific threat intel. |
| virustotal_get_ip_report | IP address reputation. |
| virustotal_search | Search VT intelligence. |
| virustotal_post_comment` | Add community notes to resources. |Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
