mcp-virustotal

[](https://www.npmjs.com/package/@tocharianou/mcp-virustotal) [](LICENSE) [](https://nodejs.org)

A Model Context Protocol (MCP) server that provides security analysis tools powered by the VirusTotal API v3. Analyse URLs, files, IP addresses and domains directly from your AI assistant.

Add the following to your claude_desktop_config.json:

{
  "mcpServers": {
    "virustotal": {
      "command": "npx",
      "args": ["-y", "@tocharianou/mcp-virustotal"],
      "env": {
        "VIRUSTOTAL_API_KEY": "<your-api-key>"
      }
    }
  }
}

Get your free API key at virustotal.com.

MCP_TRANSPORT=http MCP_HTTP_PORT=3000 VIRUSTOTAL_API_KEY=<key> npx @tocharianou/mcp-virustotal

Then point your MCP client at http://localhost:3000/mcp.

• URL analysis — full scan results, HTTP response details, trackers, redirection chains
• File analysis — hash lookup (MD5/SHA-1/SHA-256), sandbox verdicts, YARA/Sigma/IDS results
• IP analysis — geolocation, ASN, WHOIS, SSL certificate chain
• Domain analysis — DNS records, WHOIS, popularity rankings, threat severity
• Relationship traversal — paginated access to all VT relationship types per resource

| Environment variable | Required | Description | |---|---|---| | VIRUSTOTAL_API_KEY | ✓\* | VT API key, sent as x-apikey header (direct mode) | | VIRUSTOTAL_BASE_URL | – | Override API base URL (e.g. proxy endpoint) | | VIRUSTOTAL_AUTH_TOKEN | ✓\* | Bearer token for proxy authentication | | VIRUSTOTAL_TIMEOUT | – | Request t