Home › Servers › VirusTotal

VirusTotal MCP server

VirusTotal's server for threat reports and file or URL submissions. A remote endpoint and a package are both declared.

Transport	Streamable HTTP (remote), stdio (local, pypi)
Auth	Local install declares secret environment variables
Registry name	io.github.VirusTotal/virustotal-mcp · 0.9.9
Source	https://github.com/VirusTotal/virustotal-mcp
Remote endpoints	https://ai.virustotal.com/mcp
Data source	Official MCP Registry
Date checked	2026-10-17

Install

Configs are generated only from packages and remotes on the registry entry. Empty optional flags are listed instead of inserted. Nothing is added that the entry does not declare.

Remote

https://ai.virustotal.com/mcp

Claude Desktop · mcpServers

{
  "mcpServers": {
    "virustotal": {
      "url": "https://ai.virustotal.com/mcp"
    }
  }
}

Cursor · mcpServers

{
  "mcpServers": {
    "virustotal": {
      "url": "https://ai.virustotal.com/mcp"
    }
  }
}

VS Code · .vscode/mcp.json

{
  "servers": {
    "virustotal": {
      "type": "http",
      "url": "https://ai.virustotal.com/mcp"
    }
  }
}

Claude Code · .mcp.json

{
  "mcpServers": {
    "virustotal": {
      "type": "http",
      "url": "https://ai.virustotal.com/mcp"
    }
  }
}

claude mcp add

claude mcp add --transport http virustotal https://ai.virustotal.com/mcp

Local package (pypi)

Claude Desktop · mcpServers

{
  "mcpServers": {
    "virustotal": {
      "command": "uvx",
      "args": [
        "--python",
        "3.12",
        "[email protected]"
      ],
      "env": {
        "VTAI_TOKEN_FILE": "<YOUR_VTAI_TOKEN_FILE>"
      }
    }
  }
}

Cursor · mcpServers

{
  "mcpServers": {
    "virustotal": {
      "command": "uvx",
      "args": [
        "--python",
        "3.12",
        "[email protected]"
      ],
      "env": {
        "VTAI_TOKEN_FILE": "<YOUR_VTAI_TOKEN_FILE>"
      }
    }
  }
}

VS Code · .vscode/mcp.json

{
  "servers": {
    "virustotal": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "--python",
        "3.12",
        "[email protected]"
      ],
      "env": {
        "VTAI_TOKEN_FILE": "<YOUR_VTAI_TOKEN_FILE>"
      }
    }
  }
}

Claude Code · .mcp.json

{
  "mcpServers": {
    "virustotal": {
      "command": "uvx",
      "args": [
        "--python",
        "3.12",
        "[email protected]"
      ],
      "env": {
        "VTAI_TOKEN_FILE": "<YOUR_VTAI_TOKEN_FILE>"
      }
    }
  }
}

claude mcp add

claude mcp add virustotal -- uvx --python 3.12 [email protected]

FAQ

What transport does VirusTotal use?

Streamable HTTP (remote), stdio (local, pypi).

What credentials are declared for VirusTotal?

Local install declares secret environment variables.

When was this checked, and what is the source?

These facts were checked on 2026-10-17. Registry name: io.github.VirusTotal/virustotal-mcp. Source: https://github.com/VirusTotal/virustotal-mcp.

Similar servers

Auth0

Security & Identity

Manages Auth0 tenants (applications, APIs, actions, logs, forms) through conversational requests.

stdio (local, npm)

Microsoft Sentinel

Security & Identity

Microsoft's hosted server for exploring security data in a Sentinel data lake.

Streamable HTTP (remote)

OSCAL (AWS Labs)

Security & Identity

An AWS Labs server for OSCAL security-control documents. It is a different registry entry from the AWS MCP Server.

stdio (local, pypi)

Snyk

Security & Identity

Runs Snyk security scans from an agent so vulnerabilities can be found and fixed in code.

stdio (local, npm)