VirusTotal · virustotal — Claude Code MCP server: what it does, how to install
Inspects suspicious files, links, and domains through VTAI before your agent runs them. Connects via OAuth without a personal API key.
claude mcp add --transport http virustotal-mcp https://ai.virustotal.com/mcpWhat VirusTotal does
The server links coding agents with VTAI to gather threat intelligence before executing untrusted files or opening remote resources. It inspects domain records and uploaded files. Your assistant can read existing verdicts or submit new samples. This stops dangerous payloads early.
Connection works via the remote endpoint https://ai.virustotal.com/mcp through OAuth. You do not need a personal VirusTotal API key because requests draw from the free tier of your VTAI account. Alternatively, you can run vt-mcp locally over stdio using uvx.
For stdio setups, the authentication token must sit in an isolated file pointed to by VTAI_TOKEN_FILE. Passing the raw token directly into prompts or shell arguments exposes your credentials to project history.
What it helps with
- inspect downloaded files before execution
- check domain and IP reputation
- submit suspicious links for scanning
- retrieve threat analysis reports
Example prompts for the agent
- Check domain
example.comwith VirusTotal before sending requests. - Scan the downloaded file
install.shfor malware. - Fetch the VirusTotal report for IP
198.51.100.24.
How to install VirusTotal
1Platform CLI: remote server
claude mcp add --transport http virustotal-mcp https://ai.virustotal.com/mcp2Platform CLI
claude mcp add --env VTAI_TOKEN_FILE=<VTAI_TOKEN_FILE> --transport stdio virustotal-virustotal -- uvx vt-mcpReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from vt-mcp <command>
1Platform CLI: remote server
codex mcp add virustotal-virustotal --url https://ai.virustotal.com/mcp2Platform CLI
codex mcp add virustotal-virustotal --env VTAI_TOKEN_FILE=<VTAI_TOKEN_FILE> -- uvx vt-mcpReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from vt-mcp <command>
Config file
{
"mcpServers": {
"virustotal-virustotal": {
"url": "https://ai.virustotal.com/mcp"
}
}
}{
"mcpServers": {
"virustotal-virustotal": {
"command": "uvx",
"args": [
"vt-mcp"
],
"env": {
"VTAI_TOKEN_FILE": "<VTAI_TOKEN_FILE>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from vt-mcp <command>
Config file
{
"servers": {
"virustotal-virustotal": {
"type": "http",
"url": "https://ai.virustotal.com/mcp"
}
}
}{
"servers": {
"virustotal-virustotal": {
"type": "stdio",
"command": "uvx",
"args": [
"vt-mcp"
],
"env": {
"VTAI_TOKEN_FILE": "<VTAI_TOKEN_FILE>"
}
}
}
}Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from vt-mcp <command>
1Platform CLI: remote server
gemini mcp add -t http virustotal-virustotal https://ai.virustotal.com/mcp2Platform CLI
gemini mcp add -e VTAI_TOKEN_FILE=<VTAI_TOKEN_FILE> virustotal-virustotal uvx vt-mcpReplace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from vt-mcp <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about VirusTotal
How do I install VirusTotal in Claude Code?
Add the remote endpoint by running claude mcp add --transport http virustotal-mcp https://ai.virustotal.com/mcp. Launch Claude Code, enter /mcp, and finish browser authentication.
Do I need a personal VirusTotal API key?
No personal API key is needed. The server connects to VTAI and operates under your account's free tier quotas using OAuth or an agent token.
How should I store credentials for stdio mode?
Save the token in an isolated user-readable file like ~/.config/vt-mcp/token. Then assign that path to the VTAI_TOKEN_FILE environment variable.
Similar MCP servers
Everything for Security →VirusTotal by other authors comes first.
