Virustotal MCP Server

Virustotal MCP server is a locally run integration for AI assistants that speak the Model Context Protocol. MCP server for querying VirusTotal API with comprehensive security analysis tools.

What you get

To install VirusTotal Server for Claude Desktop automatically via Smithery:

• Comprehensive Analysis Reports — Each analysis tool automatically fetches relevant relationship data along with the basic report using VirusTotal's ?relationships= query, batched to minimize API calls
• URL Analysis — Cached-report-first lookups with automatic fallback to scanning, plus contacted domains, downloaded files, and threat actors
• File Analysis — Detailed analysis of file hashes including behaviors, dropped files, and network connections
• IP Analysis — Security reports with historical data, resolutions, and related threats
• Domain Analysis — DNS information, WHOIS data, SSL certificates, and subdomains
• Detailed Relationship Analysis — Dedicated tools for querying specific types of relationships with pagination support

Setting it up

The server ships on npm as @burtthecoder/mcp-virustotal, so your MCP client can launch it on demand — there is no separate build step. Add the server block to your client's configuration, restart it, and the tools register themselves.

Configuration and credentials

You will need one environment variable: VIRUSTOTAL_API_KEY. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.

• Node.js (v20 or later) - A valid VirusTotal API Key

Before you rely on it

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the virustotal mcp server does with a few real requests.

Choosing this one

Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. It is maintained by BurtTheCoder; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.