Virustotal Mcp

by yassinech-99

271 downloads Not rated yet MIT

GitHub

About

MCP server that enables LLMs to interact with the VirusTotal API for malware analysis, URL scanning, and threat intelligence.

Details

License: MIT

Explore

File Analysis: Upload files or retrieve reports via MD5, SHA-1, or SHA-256 hashes.
URL & Domain Intelligence: Scan URLs and get reputation reports for domains.
IP Reputation: Look up threat data associated with specific IP addresses.
Threat Hunting: Perform advanced searches using VirusTotal query syntax.

Community Interaction: Post comments on files, URLs, domains, or IPs.

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name Virustotal Mcp

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "virustotal mcp": {
            "virustotal": {
                "command": "uv",
                "args": [
                    "--directory",
                    "D:\\coolAI\\mcp-client",
                    "run",
                    "virustotal_mcp.py"
                ],
                "env": {
                    "VIRUSTOTAL_API_KEY": "<api_key_here>",
                    "API_BASE_URL": "https://www.virustotal.com/api/v3",
                    "REQUEST_TIMEOUT": "30.0"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "virustotal mcp": {
            "virustotal": {
                "command": "uv",
                "args": [
                    "--directory",
                    "D:\\coolAI\\mcp-client",
                    "run",
                    "virustotal_mcp.py"
                ],
                "env": {
                    "VIRUSTOTAL_API_KEY": "<api_key_here>",
                    "API_BASE_URL": "https://www.virustotal.com/api/v3",
                    "REQUEST_TIMEOUT": "30.0"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "virustotal mcp": {
            "virustotal": {
                "command": "uv",
                "args": [
                    "--directory",
                    "D:\\coolAI\\mcp-client",
                    "run",
                    "virustotal_mcp.py"
                ],
                "env": {
                    "VIRUSTOTAL_API_KEY": "<api_key_here>",
                    "API_BASE_URL": "https://www.virustotal.com/api/v3",
                    "REQUEST_TIMEOUT": "30.0"
                }
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "virustotal mcp": {
            "virustotal": {
                "command": "uv",
                "args": [
                    "--directory",
                    "D:\\coolAI\\mcp-client",
                    "run",
                    "virustotal_mcp.py"
                ],
                "env": {
                    "VIRUSTOTAL_API_KEY": "<api_key_here>",
                    "API_BASE_URL": "https://www.virustotal.com/api/v3",
                    "REQUEST_TIMEOUT": "30.0"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "virustotal mcp": {
            "virustotal": {
                "command": "uv",
                "args": [
                    "--directory",
                    "D:\\coolAI\\mcp-client",
                    "run",
                    "virustotal_mcp.py"
                ],
                "env": {
                    "VIRUSTOTAL_API_KEY": "<api_key_here>",
                    "API_BASE_URL": "https://www.virustotal.com/api/v3",
                    "REQUEST_TIMEOUT": "30.0"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "virustotal mcp": {
            "virustotal": {
                "command": "uv",
                "args": [
                    "--directory",
                    "D:\\coolAI\\mcp-client",
                    "run",
                    "virustotal_mcp.py"
                ],
                "env": {
                    "VIRUSTOTAL_API_KEY": "<api_key_here>",
                    "API_BASE_URL": "https://www.virustotal.com/api/v3",
                    "REQUEST_TIMEOUT": "30.0"
                }
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "virustotal mcp": {
            "virustotal": {
                "command": "uv",
                "args": [
                    "--directory",
                    "D:\\coolAI\\mcp-client",
                    "run",
                    "virustotal_mcp.py"
                ],
                "env": {
                    "VIRUSTOTAL_API_KEY": "<api_key_here>",
                    "API_BASE_URL": "https://www.virustotal.com/api/v3",
                    "REQUEST_TIMEOUT": "30.0"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "virustotal mcp": {
            "virustotal": {
                "command": "uv",
                "args": [
                    "--directory",
                    "D:\\coolAI\\mcp-client",
                    "run",
                    "virustotal_mcp.py"
                ],
                "env": {
                    "VIRUSTOTAL_API_KEY": "<api_key_here>",
                    "API_BASE_URL": "https://www.virustotal.com/api/v3",
                    "REQUEST_TIMEOUT": "30.0"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "virustotal mcp": {
            "virustotal": {
                "command": "uv",
                "args": [
                    "--directory",
                    "D:\\coolAI\\mcp-client",
                    "run",
                    "virustotal_mcp.py"
                ],
                "env": {
                    "VIRUSTOTAL_API_KEY": "<api_key_here>",
                    "API_BASE_URL": "https://www.virustotal.com/api/v3",
                    "REQUEST_TIMEOUT": "30.0"
                }
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "virustotal mcp": {
            "virustotal": {
                "command": "uv",
                "args": [
                    "--directory",
                    "D:\\coolAI\\mcp-client",
                    "run",
                    "virustotal_mcp.py"
                ],
                "env": {
                    "VIRUSTOTAL_API_KEY": "<api_key_here>",
                    "API_BASE_URL": "https://www.virustotal.com/api/v3",
                    "REQUEST_TIMEOUT": "30.0"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "virustotal mcp": {
            "virustotal": {
                "command": "uv",
                "args": [
                    "--directory",
                    "D:\\coolAI\\mcp-client",
                    "run",
                    "virustotal_mcp.py"
                ],
                "env": {
                    "VIRUSTOTAL_API_KEY": "<api_key_here>",
                    "API_BASE_URL": "https://www.virustotal.com/api/v3",
                    "REQUEST_TIMEOUT": "30.0"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "virustotal mcp": {
            "virustotal": {
                "command": "uv",
                "args": [
                    "--directory",
                    "D:\\coolAI\\mcp-client",
                    "run",
                    "virustotal_mcp.py"
                ],
                "env": {
                    "VIRUSTOTAL_API_KEY": "<api_key_here>",
                    "API_BASE_URL": "https://www.virustotal.com/api/v3",
                    "REQUEST_TIMEOUT": "30.0"
                }
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "virustotal mcp": {
            "virustotal": {
                "command": "uv",
                "args": [
                    "--directory",
                    "D:\\coolAI\\mcp-client",
                    "run",
                    "virustotal_mcp.py"
                ],
                "env": {
                    "VIRUSTOTAL_API_KEY": "<api_key_here>",
                    "API_BASE_URL": "https://www.virustotal.com/api/v3",
                    "REQUEST_TIMEOUT": "30.0"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "virustotal mcp": {
            "virustotal": {
                "command": "uv",
                "args": [
                    "--directory",
                    "D:\\coolAI\\mcp-client",
                    "run",
                    "virustotal_mcp.py"
                ],
                "env": {
                    "VIRUSTOTAL_API_KEY": "<api_key_here>",
                    "API_BASE_URL": "https://www.virustotal.com/api/v3",
                    "REQUEST_TIMEOUT": "30.0"
                }
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "virustotal mcp": {
            "virustotal": {
                "command": "uv",
                "args": [
                    "--directory",
                    "D:\\coolAI\\mcp-client",
                    "run",
                    "virustotal_mcp.py"
                ],
                "env": {
                    "VIRUSTOTAL_API_KEY": "<api_key_here>",
                    "API_BASE_URL": "https://www.virustotal.com/api/v3",
                    "REQUEST_TIMEOUT": "30.0"
                }
            }
        }
    }
}

From the repository

1. VirusTotal API Key: Obtain one from VirusTotal.
2. Python 3.13+: Required as per pyproject.toml.
3. uv: Recommended for fast dependency management.

``bash git clone https://github.com/your-username/virustotal-mcp.git cd virustotal-mcp`2. Configure Environment Create a .env file in the root directory:`bash VIRUSTOTAL_API_KEY=your_api_key_here API_BASE_URL=https://www.virustotal.com/api/v3 REQUEST_TIMEOUT=30.0`3. Install Dependencies`bash uv pip install -e .`🔌 Claude Desktop Configuration Add this to your claude_desktop_config.json:`json { "mcpServers": { "virustotal": { "command": "uv", "args": [ "--directory", "D:\\coolAI\\mcp-client", "run", "virustotal_mcp.py" ], "env": { "VIRUSTOTAL_API_KEY": "<api_key_here>", "API_BASE_URL": "https://www.virustotal.com/api/v3", "REQUEST_TIMEOUT": "30.0" } } } }``

`virustotal_scan_file`

Upload a local file for analysis.

`virustotal_get_file_report`

Get reports via hash.

`virustotal_get_domain_report`

Domain-specific threat intel.

`virustotal_get_ip_report`

IP address reputation.

`virustotal_search`

Search VT intelligence.

`virustotal_post_comment`

Add community notes to resources.

| Tool | Description |
|------|-------------|
| virustotal_scan_file | Upload a local file for analysis. |
| virustotal_get_file_report | Get reports via hash. |
| virustotal_scan_url / virustotal_get_url_report | Scan and analyze URLs. |
| virustotal_get_domain_report | Domain-specific threat intel. |
| virustotal_get_ip_report | IP address reputation. |
| virustotal_search | Search VT intelligence. |
| virustotal_post_comment | Add community notes to resources. |

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "virustotal mcp": {
            "virustotal": {
                "command": "uv",
                "args": [
                    "--directory",
                    "D:\\coolAI\\mcp-client",
                    "run",
                    "virustotal_mcp.py"
                ],
                "env": {
                    "VIRUSTOTAL_API_KEY": "<api_key_here>",
                    "API_BASE_URL": "https://www.virustotal.com/api/v3",
                    "REQUEST_TIMEOUT": "30.0"
                }
            }
        }
    }
}

McpServers

{
    "virustotal": {
        "command": "uv",
        "args": [
            "--directory",
            "D:\\coolAI\\mcp-client",
            "run",
            "virustotal_mcp.py"
        ],
        "env": {
            "VIRUSTOTAL_API_KEY": "<api_key_here>",
            "API_BASE_URL": "https://www.virustotal.com/api/v3",
            "REQUEST_TIMEOUT": "30.0"
        }
    }
}

A Model Context Protocol (MCP) server that enables LLMs to interact with the VirusTotal API for malware analysis, URL scanning, and threat intelligence.

🚀 Features

File Analysis: Upload files or retrieve reports via MD5, SHA-1, or SHA-256 hashes. URL & Domain Intelligence: Scan URLs and get reputation reports for domains. IP Reputation: Look up threat data associated with specific IP addresses. Threat Hunting: Perform advanced searches using VirusTotal query syntax.

Community Interaction: Post comments on files, URLs, domains, or IPs.

📋 Prerequisites

1. VirusTotal API Key: Obtain one from VirusTotal. 2. Python 3.13+: Required as per pyproject.toml. 3. uv: Recommended for fast dependency management.

🛠 Installation

1. Clone & Setup

bash
git clone https://github.com/your-username/virustotal-mcp.git
cd virustotal-mcp



2. Configure Environment
Create a .env file in the root directory:

bash
VIRUSTOTAL_API_KEY=your_api_key_here
API_BASE_URL=https://www.virustotal.com/api/v3
REQUEST_TIMEOUT=30.0


3. Install Dependencies

bash
uv pip install -e .



🔌 Claude Desktop Configuration
Add this to your claude_desktop_config.json:

json

{
  "mcpServers": {
    "virustotal": {
      "command": "uv",
      "args": [
        "--directory",
        "D:\\coolAI\\mcp-client",
        "run",
        "virustotal_mcp.py"
      ],
      "env": {
        "VIRUSTOTAL_API_KEY": "<api_key_here>",
        "API_BASE_URL": "https://www.virustotal.com/api/v3",
        "REQUEST_TIMEOUT": "30.0"
      }
    }
}
}



🛠 Available Tools


| Tool | Description |
|------|-------------|
|

virustotal_scan_file

 | Upload a local file for analysis. |
|

virustotal_get_file_report

 | Get reports via hash. |
|

virustotal_scan_url / virustotal_get_url_report

 | Scan and analyze URLs. |
|

virustotal_get_domain_report

 | Domain-specific threat intel. |
|

virustotal_get_ip_report

 | IP address reputation. |
|

virustotal_search

 | Search VT intelligence. |
|

virustotal_post_comment` | Add community notes to resources. |

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Details

Explore

Setting up with Highlight

From the repository

virustotal_scan_file

virustotal_get_file_report

virustotal_get_domain_report

virustotal_get_ip_report

virustotal_search

virustotal_post_comment

Claude Desktop / Cursor

McpServers

🚀 Features

📋 Prerequisites

🛠 Installation

1. Clone & Setup

🛠 Available Tools

More like this

Sequential Thinking

Filesystem

EverArt

Google Drive

`virustotal_scan_file`

`virustotal_get_file_report`

`virustotal_get_domain_report`

`virustotal_get_ip_report`

`virustotal_search`

`virustotal_post_comment`