VirusTotal MCP Server

by virustotal Your server? Claim it

answering

VirusTotal is answering right now. Last checked 6 min ago. 184 installs a week from pypi. Last commit 14 Oct 2026.

Official VirusTotal MCP server: threat reports, file and URL submissions, and analysis recovery.

Installs per day peak 332 · avg 54 · -43% w/w

a month agotoday

Uptime history 54 days of history

54 days agonow

100.0%

Uptime 24h

91 of 91 checks

—

Tools

hidden behind auth

342 ms

Response time

average over 24h

184

Installs / week

npm and PyPI

What the code does

We read the source, 3 d ago · rules 995398eba69f

Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

Touches key and credential files plugins/claude-code/client-contracts.json:16, src/vt_mcp/client_contracts.json:16, [пакет] src/vt_mcp/client_contracts.json:16

  "credential_filename_pattern": "^(?:\\.env.*|id_(?:rsa|dsa|ecdsa|ed25519|xmss).*|ssh_host_.*_key.*|\\.netrc|\\.npmrc|\\.pypirc|\\.git-credentials|\\.pgpass|\\.htpasswd|credentials.*|kubeconfig)$|\\.(?:pem|key|kdbx|p12|pfx|ppk|jks|keystore)$"

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

This code can reach further than it looks

We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 6 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add virustotal-mcp --transport http https://ai.virustotal.com/mcp

Settings → Connectors → Add custom connector, then paste this address

https://ai.virustotal.com/mcp

~/.codex/config.toml

[mcp_servers.virustotal-mcp]
url = "https://ai.virustotal.com/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "virustotal-mcp": {
      "url": "https://ai.virustotal.com/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "virustotal-mcp": {
      "type": "http",
      "url": "https://ai.virustotal.com/mcp"
    }
  }
}

This endpoint answered with an authorization challenge. The server is running, and it signs you in through your browser: there is no API key to paste.

Endpoints

URL	Transport	State	Latency	Checked
https://ai.virustotal.com/mcp	streamable-http	sign-in	158 ms	6 min ago

Alternatives to VirusTotal

same job, measured the same way

VirusTotal

by king-tero

VirusTotal reports for files, URLs, domains and IPs, plus file submission and analysis recovery.

answering

Virustotal MCP

by mrfentmen

MCP server for VirusTotal: file, URL, domain, IP reports. Free key.

110 installs/wk local only

Google Analytics

by codechap

MCP server for Google Analytics 4 — reports, realtime data, and admin

local only

RDL MCP Server

by bethmaloney

Edit SSRS reports using AI - simple tools to read and modify RDL files

85 installs/wk local only

MCP Abap Adt

by fr0ster

MCP server for SAP ABAP ADT over HTTP, RFC or SNC: repository analysis and RAP/classic ABAP CRUD

1 839 installs/wk local only

Miro

by miroapp

Official Miro MCP server - Supports context to code and creating diagrams, docs, and data tables.

answering

Data Report MCP

by diyaluo

Local-first CSV/XLSX analysis report MCP server (stats, Excel charts, Markdown), no upload.

local only

Actual Budget MCP Server

by agigante80

Manage Actual Budget accounts, transactions, budgets, rules and reports from an AI assistant.

1 648 installs/wk local only

VirusTotal — questions

Answers built from our own checks of this server.

Why is there no tool list for VirusTotal?

The server answered our handshake with an authorization challenge, so it is running — but it will not describe its tools to an anonymous client. To see them you need to connect with your own credentials. We record it as alive, not as broken: 100.0% of checks in the last 24 hours got a reply.

Is VirusTotal working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 342 ms. The bar chart above shows every period we have measured.

How do I connect VirusTotal?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address. You sign in through your browser once and the client keeps the session: no key to copy, and it refuses anonymous clients.

How do you sign in to VirusTotal?

No API key is involved. VirusTotal answers our knock with an OAuth challenge, so you authorise it once in your browser and the client keeps the session. That is also why we see no tool list: it will not describe itself to an anonymous client, and that is the server working as intended, not a fault.

How fast is VirusTotal?

It answers our handshake in 342 ms on average, which is faster than 41% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.

How many people use VirusTotal?

The pypi package vt-mcp was installed 184 times in the last week. Week over week that is -43%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.

Is VirusTotal open source?

The code is open source: it is published under the Apache-2.0 licence, written in Python and 25 stars on GitHub. The licence covers the code in the repository, not the hosted service at ai.virustotal.com, which runs on its operator's own terms.