mcp-virustotal

Name: mcp-virustotal
Author: w0h1v

Warning

MCP server for VirusTotal API — analyze URLs, files, IPs, and domains with comprehensive security reports, relationship analysis, and pagination support.

151stars

23forks

TypeScript

Installation

# Add to your Claude Code skills
git clone https://github.com/w0h1v/mcp-virustotal

Getting Started

Guides for using mcp servers skills like mcp-virustotal.

Best MCP Servers in 2026
Category-by-category picks: databases, dev tools, productivity, browser automation.
What is an AI Skills Marketplace?
Definitions, how marketplaces work, and how to choose between them in 2026.
Getting Started with AI Skills
First-time install walkthrough for Claude Code, Codex CLI, and ChatGPT.

Security ReportWarning

Last scanned: 6/5/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@hono/node-server: @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "axios: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "express-rate-limit: express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "file-type: file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "follow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "hono: Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "qs: qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "undici: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client",
      "severity": "high"
    }
  ],
  "status": "WARNING",
  "scannedAt": "2026-06-05T08:08:03.385Z",
  "npmAuditRan": true,
  "pipAuditRan": true
}

Compare with similar skills

See how mcp-virustotal compares with popular alternatives.

mcp-virustotal vs n8n

See comparison

mcp-virustotal vs scrapling

See comparison

mcp-virustotal vs trendradar

See comparison

README.md

Frequently Asked Questions

What is mcp-virustotal?

mcp-virustotal is an open-source mcp servers skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by w0h1v. MCP server for VirusTotal API — analyze URLs, files, IPs, and domains with comprehensive security reports, relationship analysis, and pagination support. It has 151 GitHub stars.

Is mcp-virustotal safe to use?

mcp-virustotal returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.

How do I install mcp-virustotal?

Clone the repository with "git clone https://github.com/w0h1v/mcp-virustotal" and add it to your Claude Code skills directory (see the Installation section above).

What programming language is mcp-virustotal written in?

mcp-virustotal is primarily written in TypeScript. It is open-source under w0h1v on GitHub, so you can review or fork the full source.

Are there alternatives to mcp-virustotal?

Yes. SkillsLLM lists many other MCP Servers skills you can browse and compare side by side. Open the MCP Servers category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh mcp-virustotal against similar tools.

AI Courses · Agentic AI, LLM Engineering & MCP

Beginner to professional · First lesson free · Lifetime access

20% off

Comments (0)

to leave a comment.

No comments yet. Be the first to share your thoughts!

Related Skills

rea

by morluto

Reverse engineer anything with agents, from app behavior down to native binaries.

312,105

Popular in MCP Servers

Top skills in this category by stars

Scrapling

by D4Vinci

🕷️ A Web Scraping framework that handles everything from a single request to a full-scale crawl! Don't be shy, join here: https://discord.gg/EMgGbDceNQ and follow here for daily tips and tricks: https://x.com/Scrapling_dev

88,356

mcp-k8s Veo-4-API

View on GitHub Compare Download ZIP Scan for vulnerabilities

Requires a passing catalog security scan.

⚠️ Third-Party Software Notice

This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.

Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.

Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.

Read the Terms of Service

MCP Serversai-toolsclaudecybersecurityiocmalware-analysismalware-detectionmcpmcp-servermodel-context-protocolsecuritythreat-intelligencetypescriptvirus-scanningvirustotal

Courses · 20% off

Maintainer of this skill?

AI Agentsagent-skillsai-agents

ECC

by affaan-m

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

282,768

42,009

JavaScript

AI Agentsai-agentsanthropic

The agent that grows with you

254,768

55,403

Python

AI Agentsaiai-agent

View details

Compare

n8n

by n8n-io

Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.

207,856

61,173

TypeScript

MCP Serversaiapis

View details

Compare

everything-claude-code

by affaan-m

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

185,940

28,768

JavaScript

AI Agentsai-agentsanthropic

Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.

166,441

9,001

JavaScript

AI Agentsagent-skillsai-agents

View details

Compare

MCP Serversaiai-scraping

TrendRadar

by sansan0

⭐AI-driven public opinion & trend monitor with multi-platform aggregation, RSS, and smart alerts.🎯 告别信息过载，你的 AI 舆情监控助手与热点筛选工具！聚合多平台热点 + RSS 订阅，支持关键词精准筛选。AI 智能筛选新闻 + AI 翻译 + AI 分析简报直推手机，也支持接入 MCP 架构，赋能 AI 自然语言对话分析、情感洞察与趋势预测等。支持 Docker ，数据本地/云端自持。集成微信/飞书/钉钉/Telegram/邮件/ntfy/bark/slack 等渠道智能推送。

62,990

24,912

Python

MCP Serversaibark

View details

mcp-virustotal is an MCP server that gives AI agents access to the VirusTotal v3 API. Hand your agent a hash, URL, IP or domain and get back the detection report plus the relationships an analyst would pivot on: contacted hosts, dropped files, resolutions, threat actors.

[!NOTE] Independent project, not affiliated with VirusTotal or Google. You need your own VirusTotal API key.

Highlights

Reports with relationships. File, URL, IP and domain reports fetch key relationships in one batched ?relationships= call to save quota.
Cache first. get_url_report returns the cached VirusTotal report and only submits a scan on a cache miss.
Pivot tools. Corpus search with VTI-style modifiers (type:peexe positives:5+), merged sandbox behaviour summaries, and threat-actor and malware-family collections.
Full relationship paging. 100+ relationship types across files, URLs, IPs and domains, with cursor pagination.
Two transports. stdio for desktop clients, HTTP streaming for a shared service.
Tested. Unit tests for the formatters and API layer run in CI on Node 20, 22 and 24.

How it works

flowchart LR
    A["AI agent<br/>(Claude, Codex, Gemini, VS Code)"] -->|"MCP over stdio or HTTP"| S["mcp-virustotal"]
    S -->|"validate input,<br/>HTTPS + API key"| V["VirusTotal v3 API"]
    V -->|"JSON"| S
    S -->|"formatted report text"| A

Quickstart

Requirements: Node.js 20 or newer and a VirusTotal API key.

# Claude Code
claude mcp add --transport stdio --env VIRUSTOTAL_API_KEY=your-key virustotal -- npx -y @burtthecoder/mcp-virustotal

# Codex CLI
codex mcp add virustotal --env VIRUSTOTAL_API_KEY=your-key -- npx -y @burtthecoder/mcp-virustotal

# Gemini CLI
gemini mcp add -e VIRUSTOTAL_API_KEY=your-key virustotal npx -y @burtthecoder/mcp-virustotal

For Claude Desktop, VS Code, Smithery and running from source, see Connect a client.

Then ask your agent: "Look up the SHA-256 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f (the EICAR test file) and show what it drops and contacts."

Tools

Eleven tools. Full parameters and relationship lists are in the tool reference.

Group	Tools
Reports (with relationships)	`get_file_report`, `get_url_report`, `get_ip_report`, `get_domain_report`
Relationship paging	`get_file_relationship`, `get_url_relationship`, `get_ip_relationship`, `get_domain_relationship`
Search and pivot	`search_vt`, `get_file_behaviour_summary`, `get_collection`

HTTP streaming transport

stdio is the default. Set MCP_TRANSPORT=httpStream to run a standalone HTTP service:

MCP_TRANSPORT=httpStream MCP_PORT=3000 VIRUSTOTAL_API_KEY=your-key node build/index.js

docker build -t mcp-virustotal .
docker run -p 127.0.0.1:3000:3000 -e VIRUSTOTAL_API_KEY=your-key -e MCP_TRANSPORT=httpStream mcp-virustotal

A health check is served at /health.

Environment variables

Variable	Default	Description
`VIRUSTOTAL_API_KEY`	(required)	Your VirusTotal API key
`MCP_TRANSPORT`	`stdio`	`stdio` or `httpStream`
`MCP_HOST`	`localhost`	Bind address (`httpStream` only). The Docker image sets `0.0.0.0`
`MCP_PORT`	`3000`	HTTP port (`httpStream` only)
`MCP_ENDPOINT`	`/mcp`	HTTP endpoint path (`httpStream` only)

Security

[!WARNING] The HTTP transport has no authentication. Keep the port on localhost or behind an authenticating reverse proxy, or anyone who can reach it can spend your API quota.

Tool arguments are validated with zod schemas before any request is built.
The API key is read from the environment and sent only to VirusTotal.
Lookups send your indicators to VirusTotal. A URL scan on a cache miss submits that URL for analysis.

Report vulnerabilities privately; see SECURITY.md.

Troubleshooting

Wrong API key: the key is usually 64 characters with no spaces or quotes. Restart the client after changing config.
429 errors: the public tier allows 4 requests per minute.
Logs: logs/mcp-virustotal-server.log in the package directory.

Development

git clone https://github.com/w0h1v/mcp-virustotal && cd mcp-virustotal
npm ci
npm test                                  # build + unit tests, no key or network
VIRUSTOTAL_API_KEY=your-key npm run smoke # all 11 tools against the real API

The smoke test paces calls at 20 s for the public-tier limit and isn't suited to free tiers reduced to a few lookups a day. See CONTRIBUTING.md and the changelog.

License

MIT. See LICENSE.