# VirusTotal

Inspects suspicious files, links, and domains through VTAI before your agent runs them. Connects via OAuth without a personal API key.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 21
- Author: VirusTotal
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/VirusTotal/virustotal-mcp
- Updated: 2026-10-19
- HTML: https://affpapa.org/en/nevibecode/mcp/virustotal-virustotal

## What it does

The server links coding agents with VTAI to gather threat intelligence before executing untrusted files or opening remote resources. It inspects domain records and uploaded files. Your assistant can read existing verdicts or submit new samples. This stops dangerous payloads early.

Connection works via the remote endpoint `https://ai.virustotal.com/mcp` through OAuth. You do not need a personal VirusTotal API key because requests draw from the free tier of your VTAI account. Alternatively, you can run `vt-mcp` locally over stdio using uvx.

For stdio setups, the authentication token must sit in an isolated file pointed to by `VTAI_TOKEN_FILE`. Passing the raw token directly into prompts or shell arguments exposes your credentials to project history.

## Requirements
- Needs: Python and uv (commands run via uvx)
- Remote server: `https://ai.virustotal.com/mcp`
- Environment variables: `VTAI_TOKEN_FILE` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

1. **Platform CLI: remote server**
```bash
claude mcp add --transport http virustotal-mcp https://ai.virustotal.com/mcp
```

2. **Platform CLI**
```bash
claude mcp add --env VTAI_TOKEN_FILE=<VTAI_TOKEN_FILE> --transport stdio virustotal-virustotal -- uvx vt-mcp
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from vt-mcp <command>

### Codex

1. **Platform CLI: remote server**
```bash
codex mcp add virustotal-virustotal --url https://ai.virustotal.com/mcp
```

2. **Platform CLI**
```bash
codex mcp add virustotal-virustotal --env VTAI_TOKEN_FILE=<VTAI_TOKEN_FILE> -- uvx vt-mcp
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from vt-mcp <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "virustotal-virustotal": {
            "url": "https://ai.virustotal.com/mcp"
        }
    }
}
```
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "virustotal-virustotal": {
            "command": "uvx",
            "args": [
                "vt-mcp"
            ],
            "env": {
                "VTAI_TOKEN_FILE": "<VTAI_TOKEN_FILE>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from vt-mcp <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "virustotal-virustotal": {
            "type": "http",
            "url": "https://ai.virustotal.com/mcp"
        }
    }
}
```
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "virustotal-virustotal": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "vt-mcp"
            ],
            "env": {
                "VTAI_TOKEN_FILE": "<VTAI_TOKEN_FILE>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from vt-mcp <command>

### Gemini CLI

1. **Platform CLI: remote server**
```bash
gemini mcp add -t http virustotal-virustotal https://ai.virustotal.com/mcp
```

2. **Platform CLI**
```bash
gemini mcp add -e VTAI_TOKEN_FILE=<VTAI_TOKEN_FILE> virustotal-virustotal uvx vt-mcp
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from vt-mcp <command>

## When to use it
- inspect downloaded files before execution
- check domain and IP reputation
- submit suspicious links for scanning
- retrieve threat analysis reports

## Example prompts
- Check domain `example.com` with VirusTotal before sending requests.
- Scan the downloaded file `install.sh` for malware.
- Fetch the VirusTotal report for IP `198.51.100.24`.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

## Other versions with the same name
- [virustotal · w0h1v](https://affpapa.org/en/nevibecode/mcp/w0h1v-virustotal.md) — ★ 151

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md