mcp-virustotal MCP server

MCP server for VirusTotal API — analyze URLs, files, IPs, and domains with comprehensive security reports, relationship analysis, and pagination support.

What mcp-virustotal does

Summarised from the project README; check the repository for the latest details.

Features

• Reports with relationships. File, URL, IP and domain reports fetch key relationships in one batched `?relationships=` call to save quota.
• Cache first. `geturlreport` returns the cached VirusTotal report and only submits a scan on a cache miss.
• Pivot tools. Corpus search with VTI-style modifiers (`type:peexe positives:5+`), merged sandbox behaviour summaries, and threat-actor and malware-family collections.
• Full relationship paging. 100+ relationship types across files, URLs, IPs and domains, with cursor pagination.
• Two transports. stdio for desktop clients, HTTP streaming for a shared service.
• Tested. Unit tests for the formatters and API layer run in CI on Node 20, 22 and 24.

Tools exposed (1)

• Group – Tools

How to install mcp-virustotal

Listed on Socketlist – add this badge to your README:

Badge markdown[](https://socketlist.pages.dev/s/w0h1v-mcp-virustotal/)

Maintain this project? Get it featured for free during launch →

Compare with ida-pro-mcp →

Related Security MCP servers