VirusTotal MCP Server

A Model Context Protocol (MCP) server for querying the VirusTotal API. This server provides comprehensive security analysis tools with automatic relationship data fetching. It integrates seamlessly with MCP-compatible…

Local serverstdioMIT

What is the VirusTotal MCP Server?

VirusTotal source profile. From the maintainer documentation: “A Model Context Protocol (MCP) server for querying the VirusTotal API. This server provides comprehensive security analysis tools with automatic relationship data fetching. It integrates seamlessly with MCP-compatible applications like Claude Desktop.”

Local setup

The project provides a local client configuration using mcp-virustotal. Follow the repository’s build and installation steps before copying it, and replace example paths with the paths on your own computer.

Configuration values

The example declares VIRUSTOTAL_API_KEY. Secret-looking values have been replaced with placeholders. Required and optional labels are shown only when the documentation states them.

Source

Project documentation · Repository · Discovery listing. This profile records the public documentation checked on 2026-10-08.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

Tool	What it does
Parameters	id (required): Collection ID (e.g. threat-actor-- , malware-family-- )
relationships	optional): Array of relationship names to include
relationship	required): Type of relationship to query
limit	optional, default: 20): Maximum number of results (1-300)
cursor	optional): Continuation cursor for pagination

How to install the VirusTotal MCP Server

{
  "mcpServers": {
    "virustotal": {
      "command": "mcp-virustotal",
      "env": {
        "VIRUSTOTAL_API_KEY": "YOUR_VIRUSTOTAL_API_KEY"
      }
    }
  }
}

From the project documentation. Replace placeholders and example paths before connecting.