# virustotal

This MCP server lets an AI coding client query VirusTotal for reports on files, URLs, IPs and domains plus related threat data.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 151
- Author: w0h1v
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/w0h1v/mcp-virustotal
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/mcp/w0h1v-virustotal

## What it does

\`virustotal` connects Claude Code and other MCP clients to the VirusTotal v3 API. An agent can inspect a file hash, URL, IP address or domain, follow related hosts and files, search with VTI-style filters, and read merged sandbox behaviour summaries. The server exposes 11 tools.

The default transport is `stdio`; `httpStream` can run it as a shared service. Setup requires Node.js 20 or newer and your own `VIRUSTOTAL_API_KEY`. Input is checked before requests are built. HTTP has no authentication, so keep its port on localhost or put it behind an authenticating reverse proxy to prevent others from using your API quota.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `VIRUSTOTAL_API_KEY` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add virustotal -e VIRUSTOTAL_API_KEY=<VIRUSTOTAL_API_KEY> -- npx -y @burtthecoder/mcp-virustotal
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add w0h1v-virustotal --env VIRUSTOTAL_API_KEY=<VIRUSTOTAL_API_KEY> -- npx -y @burtthecoder/mcp-virustotal
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "w0h1v-virustotal": {
            "command": "npx",
            "args": [
                "-y",
                "@burtthecoder/mcp-virustotal"
            ],
            "env": {
                "VIRUSTOTAL_API_KEY": "<VIRUSTOTAL_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "w0h1v-virustotal": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@burtthecoder/mcp-virustotal"
            ],
            "env": {
                "VIRUSTOTAL_API_KEY": "<VIRUSTOTAL_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e VIRUSTOTAL_API_KEY=<VIRUSTOTAL_API_KEY> w0h1v-virustotal npx -y @burtthecoder/mcp-virustotal
```
Replace <…> with your own values

## When to use it
- check a file hash against VirusTotal
- inspect a report for a URL, IP or domain
- trace related hosts and dropped files
- review a sample’s sandbox behaviour
- search threat collections with filters

## Example prompts
- Check this file hash in VirusTotal and show the hosts it contacted and files it dropped.
- Look up this domain and list its resolutions and related IP addresses.
- Search for samples matching `type:peexe positives:5+` and summarize the results.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md