virustotal — Claude Code MCP server: setup
This MCP server lets an AI coding client query VirusTotal for reports on files, URLs, IPs and domains plus related threat data.
claude mcp add virustotal -e VIRUSTOTAL_API_KEY=<VIRUSTOTAL_API_KEY> -- npx -y @burtthecoder/mcp-virustotalWhat virustotal does
virustotal connects Claude Code and other MCP clients to the VirusTotal v3 API. An agent can inspect a file hash, URL, IP address or domain, follow related hosts and files, search with VTI-style filters, and read merged sandbox behaviour summaries. The server exposes 11 tools.
The default transport is stdio; httpStream can run it as a shared service. Setup requires Node.js 20 or newer and your own VIRUSTOTAL_API_KEY. Input is checked before requests are built. HTTP has no authentication, so keep its port on localhost or put it behind an authenticating reverse proxy to prevent others from using your API quota.
What it helps with
- check a file hash against VirusTotal
- inspect a report for a URL, IP or domain
- trace related hosts and dropped files
- review a sample’s sandbox behaviour
- search threat collections with filters
Example prompts for the agent
- Check this file hash in VirusTotal and show the hosts it contacted and files it dropped.
- Look up this domain and list its resolutions and related IP addresses.
- Search for samples matching
type:peexe positives:5+and summarize the results.
How to install virustotal
Platform CLI
claude mcp add virustotal -e VIRUSTOTAL_API_KEY=<VIRUSTOTAL_API_KEY> -- npx -y @burtthecoder/mcp-virustotalReplace <…> with your own values
Platform CLI
codex mcp add w0h1v-virustotal --env VIRUSTOTAL_API_KEY=<VIRUSTOTAL_API_KEY> -- npx -y @burtthecoder/mcp-virustotalReplace <…> with your own values
Config file
{
"mcpServers": {
"w0h1v-virustotal": {
"command": "npx",
"args": [
"-y",
"@burtthecoder/mcp-virustotal"
],
"env": {
"VIRUSTOTAL_API_KEY": "<VIRUSTOTAL_API_KEY>"
}
}
}
}Replace <…> with your own values
Config file
{
"servers": {
"w0h1v-virustotal": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@burtthecoder/mcp-virustotal"
],
"env": {
"VIRUSTOTAL_API_KEY": "<VIRUSTOTAL_API_KEY>"
}
}
}
}Replace <…> with your own values
Platform CLI
gemini mcp add -e VIRUSTOTAL_API_KEY=<VIRUSTOTAL_API_KEY> w0h1v-virustotal npx -y @burtthecoder/mcp-virustotalReplace <…> with your own values
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about virustotal
How do I install virustotal in Claude Code?
Run claude mcp add virustotal -e VIRUSTOTAL_API_KEY=<VIRUSTOTAL_API_KEY> -- npx -y @burtthecoder/mcp-virustotal. Replace the placeholder with your VirusTotal API key.
What does virustotal do?
It gives an AI agent VirusTotal reports for files, URLs, IPs and domains, along with relationship lookups, filtered search and sandbox behaviour summaries.
What does virustotal require?
You need Node.js 20 or newer and VIRUSTOTAL_API_KEY. Its HTTP transport has no authentication, so keep the port on localhost or place it behind an authenticating reverse proxy.
