VirusTotal MCP Server

by virustotal Your server? Claim it

answering

VirusTotal is answering right now. Last checked 8 min ago.

VirusTotal reports for files, URLs, domains and IPs, plus file submission and analysis recovery.

Uptime history 9 days of history

9 days agonow

100.0%

Uptime 24h

91 of 91 checks

—

Tools

hidden behind auth

270 ms

Response time

average over 24h

OAuth sign-in

Access

streamable-http

Nothing serious here today

Today is the operative word: we check VirusTotal every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 8 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add virustotal-mcp --transport http https://ai.virustotal.com/mcp

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "virustotal-mcp": {
      "url": "https://ai.virustotal.com/mcp"
    }
  }
}

~/.codex/config.toml

[mcp_servers.virustotal-mcp]
url = "https://ai.virustotal.com/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "virustotal-mcp": {
      "url": "https://ai.virustotal.com/mcp"
    }
  }
}

.vscode/mcp.json

{
  "mcpServers": {
    "virustotal-mcp": {
      "url": "https://ai.virustotal.com/mcp"
    }
  }
}

This one needs environment variables set before it will start: VTAI_TOKEN_FILE (Path to a protected file containing only your VTAI token. Get free access at https://ai.virustotal.com/connect/mcp.). The author declared them in the registry entry; get the values from the project itself.

This endpoint answered with an authorization challenge. The server is running, and it signs you in through your browser: there is no API key to paste.

Endpoints

URL	Transport	State	Latency	Checked
https://ai.virustotal.com/mcp	streamable-http	sign-in	213 ms	8 min ago

Alternatives to VirusTotal

same job, measured the same way

VirusTotal

by king-tero

VirusTotal reports for files, URLs, domains and IPs, plus file submission and analysis recovery.

answering

Malwagon

by malwagon

Submit files and URLs to a malware sandbox, poll scans, fetch reports, hashes and IOCs.

5 tools answering

Session Replay

by session-replay

Read and triage bug reports captured by Session Replay for your verified domains.

answering

Crédito & Score

by mcp-dir

Credit score and analysis for people and companies: score, dossier, defaults, positive reports, Cent

17 tools answering

Faldaro

by faldaro

Forms, submissions, workflows and reports in Faldaro, exactly as privileged as your API key.

45 installs/wk answering

Accessibility AI

by groundlogic-ai-source

Scan URLs for WCAG 2.1 violations, generate AI fixes, and produce VPAT 2.5 compliance reports.

4 tools answering

Sheriff

by ryansmith4

MCP server for fixing static analysis issues from SARIF reports with AI agents

local only

LDAP Assistant MCP

by droideck

MCP server for 389 Directory Server health diagnostics, log analysis, and SOS-report investigation

54 installs/wk local only

VirusTotal — questions

Answers built from our own checks of this server.

Why is there no tool list for VirusTotal?

The server answered our handshake with an authorization challenge, so it is running — but it will not describe its tools to an anonymous client. To see them you need to connect with your own credentials. We record it as alive, not as broken: 100.0% of checks in the last 24 hours got a reply.

Is VirusTotal working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 270 ms. The bar chart above shows every period we have measured.

How do I connect VirusTotal?

Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address. You sign in through your browser once and the client keeps the session: no key to copy, and it refuses anonymous clients.

How do you sign in to VirusTotal?

No API key is involved. VirusTotal answers our knock with an OAuth challenge, so you authorise it once in your browser and the client keeps the session. That is also why we see no tool list: it will not describe itself to an anonymous client, and that is the server working as intended, not a fault.

How fast is VirusTotal?

It answers our handshake in 270 ms on average, which is faster than 54% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.