A Model Context Protocol (MCP) server for querying the VirusTotal API. This server provides comprehensive security analysis tools with automatic relationship data fetching. It integrates seamlessly with MCP-compatible applications like Claude Desktop.
Quick Start (Recommended)
Installing via Smithery
To install VirusTotal Server for Claude Desktop automatically via Smithery:
npx -y @smithery/cli install @burtthecoder/mcp-virustotal --client claude
Comprehensive Analysis Reports: Each analysis tool automatically fetches relevant relationship data along with the basic report, providing a complete security overview in a single request
URL Analysis: Security reports with automatic fetching of contacted domains, downloaded files, and threat actors
File Analysis: Detailed analysis of file hashes including behaviors, dropped files, and network connections
IP Analysis: Security reports with historical data, resolutions, and related threats
Domain Analysis: DNS information, WHOIS data, SSL certificates, and subdomains
Detailed Relationship Analysis: Dedicated tools for querying specific types of relationships with pagination support
Rich Formatting: Clear categorization and presentation of analysis results and relationship data
Description: Get a comprehensive URL analysis report including security scan results and key relationships (communicating files, contacted domains/IPs, downloaded files, redirects, threat actors)
Parameters:
url (required): The URL to analyze
2. File Report Tool
Name: get_file_report
Description: Get a comprehensive file analysis report using its hash (MD5/SHA-1/SHA-256). Includes detection results, file properties, and key relationships (behaviors, dropped files, network connections, embedded content, threat actors)
Parameters:
hash (required): MD5, SHA-1 or SHA-256 hash of the file
3. IP Report Tool
Name: get_ip_report
Description: Get a comprehensive IP address analysis report including geolocation, reputation data, and key relationships (communicating files, historical certificates/WHOIS, resolutions)
Parameters:
ip (required): IP address to analyze
4. Domain Report Tool
Name: get_domain_report
Description: Get a comprehensive domain analysis report including DNS records, WHOIS data, and key relationships (SSL certificates, subdomains, historical data)
Parameters:
domain (required): Domain name to analyze
relationships (optional): Array of specific relationships to include in the report
Relationship Tools (for Detailed Analysis)
1. URL Relationship Tool
Name: get_url_relationship
Description: Query a specific relationship type for a URL with pagination support. Choose from 17 relationship types including analyses, communicating files, contacted domains/IPs, downloaded files, graphs, referrers, redirects, and threat actors
Parameters:
url (required): The URL to get relationships for
relationship (required): Type of relationship to query
limit (optional, default: 10): Maximum number of related objects to retrieve (1-40)
cursor (optional): Continuation cursor for pagination
2. File Relationship Tool
Name: get_file_relationship
Description: Query a specific relationship type for a file with pagination support. Choose from 41 relationship types including behaviors, network connections, dropped files, embedded content, execution chains, and threat actors
Parameters:
hash (required): MD5, SHA-1 or SHA-256 hash of the file
relationship (required): Type of relationship to query
limit (optional, default: 10): Maximum number of related objects to retrieve (1-40)
cursor (optional): Continuation cursor for pagination
3. IP Relationship Tool
Name: get_ip_relationship
Description: Query a specific relationship type for an IP address with pagination support. Choose from 12 relationship types including communicating files, historical SSL certificates, WHOIS records, resolutions, and threat actors
Parameters:
ip (required): IP address to analyze
relationship (required): Type of relationship to query
limit (optional, default: 10): Maximum number of related objects to retrieve (1-40)
cursor (optional): Continuation cursor for pagination
4. Domain Relationship Tool
Name: get_domain_relationship
Description: Query a specific relationship type for a domain with pagination support. Choose from 21 relationship types including SSL certificates, subdomains, historical data, and DNS records
Parameters:
domain (required): Domain name to analyze
relationship (required): Type of relationship to query
