Virustotal MCP server

Connect Virustotal to Claude, ChatGPT, Cursor, Claude Code, Codex, Gemini, GitHub Copilot and any other MCP client, for your whole team. Metorial adds security, governance, and tracing, and gives everyone one Magic MCP URL to connect.

What you can do with the Virustotal MCP server

Ask your agent in plain language. Each of these maps to a real tool on the server.

  • Use the get domain report tool in Virustotal
  • Use the manage livehunt ruleset tool in Virustotal
  • Use the get url report tool in Virustotal
  • Use the add comment tool in Virustotal
  • Use the manage retrohunt tool in Virustotal
  • Use the get comments tool in Virustotal

Supported Tools

get_domain_report

Get Domain Report

Retrieve the reputation and contextual report for a domain. Returns WHOIS data, DNS records, detection results, community reputation, and popularity rankings.

manage_livehunt_ruleset

Manage Livehunt Ruleset

Create, update, enable/disable, or delete Livehunt YARA rulesets. Livehunt hooks into the stream of files submitted to VirusTotal and generates notifications when YARA rules match. **Premium feature.**

get_url_report

Get URL Report

Retrieve the analysis report for a URL. Accepts a raw URL, its native SHA-256 identifier, or its base64url identifier without padding. Returns detection results from available URL scanners, final destination, category, and community reputation data.

add_comment

Add Comment

Add a community comment to any VirusTotal resource (file, URL, domain, or IP address). Comments support VirusTotal-flavored markdown.

manage_retrohunt

Manage Retrohunt

Create and manage Retrohunt jobs that apply YARA rules to VirusTotal's historical file collection. Corpus history, quotas and execution time depend on your hunting license. **Premium feature.**

get_comments

Get Comments

Retrieve community comments for a VirusTotal resource (file, URL, domain, or IP address). Comments include analysis notes, threat intelligence, and other context contributed by community members.

scan_file

Scan File

Submit a file hash for re-analysis by VirusTotal's partnered antivirus engines and security tools. This triggers a new scan of an already-known file using its SHA-256, SHA-1, or MD5 hash. Use this to get fresh scan results for a previously submitted file.

get_connection_context

Get Connection Context

Verify the VirusTotal user bound to this API key and retrieve available native privileges and quota counters. Reconnect with the account username if this connection predates username verification.

add_vote

Add Vote

Cast a vote on a VirusTotal resource (file, URL, domain, or IP address) to contribute to community reputation. Vote either "malicious" or "harmless".

get_relationships

Get IoC Relationships

Retrieve relationships for any VirusTotal indicator (file, URL, domain, or IP address). Allows pivoting across IoCs to map threat campaigns and infrastructure. Common relationship types: - **Files:** contacted_domains, contacted_ips, contacted_urls, embedded_domains, embedded_ips, itw_urls, execution_parents, compressed_parents, bundled_files, pe_resource_parents - **Domains:** communicating_files, downloaded_files, referrer_files, resolutions, siblings, subdomains, urls - **IPs:** communicating_files, downloaded_files, referrer_files, resolutions, urls - **URLs:** contacted_domains, contacted_ips, downloaded_files, redirecting_urls, redirects_to, referrer_urls

get_analysis_status

Get Analysis Status

Check the status and results of a file or URL analysis by its analysis ID. Use this after submitting a file or URL for scanning to retrieve the results once the analysis is complete.

scan_url

Scan URL

Submit a URL for scanning by VirusTotal's partnered URL scanners and blocklists. Returns an analysis ID that can be used to retrieve scan results once complete.

get_ip_report

Get IP Report

Retrieve the reputation and contextual report for an IP address. Returns detection results, WHOIS data, geolocation, AS owner, and community reputation.

search_intelligence

Search Intelligence

Search VirusTotal's entire dataset using advanced search modifiers. Find files, URLs, domains, and IP addresses matching specific criteria such as file type, detection count, behavioral attributes, submission metadata, and more. **Premium feature.**

get_file_report

Get File Report

Retrieve the available summarized analysis report for a file by its hash. Returns the available detection results, file metadata, reputation scores, and community votes. Use SHA-256, SHA-1, or MD5 hash to look up the file.

Connect Virustotal to your AI client

Every client uses the same Magic MCP URL, and so does any other MCP client. Add it once and sign in with SSO.

  1. Enable Virustotal in Metorial. In your Metorial portal, enable the Virustotal MCP server and sign in with the account that owns the data. Access stays governed by your team policies.
  2. Add a custom connector. Open Customize, then Connectors. Select Add, then Custom, then Web.
  3. Paste your Metorial MCP URL. Name it Metorial, paste your Magic MCP URL (<your-magic-mcp-url>) and continue.
  4. Sign in. Select Add and sign in to load Virustotal tools.

Run Virustotal through the Metorial gateway

One governed layer for every app your agents reach, not a separate connector per tool.

  • Give Virustotal and every other app to your whole team through one MCP gateway, behind your SSO.
  • Scope which teams and agents can use Virustotal tools with role-based access control, and trace every call.
  • Prefer to run it yourself? Metorial is open source and self-hostable.

More integrations teams use with Virustotal

GitHub

Manage repositories, issues, and pull requests. Create and configure branches, star repositories, review code, and merge changes. Automate CI/CD workflows with GitHub Actions, manage workflow runs, secrets, and artifacts. Track issues with labels, milestones, and assignees. Search across code, repositories, issues, and users. Manage organizations, teams, and memberships. Create and manage projects, gists, packages, deployments, and environments. Access security alerts including code scanning, secret scanning, and Dependabot alerts. Read and write file contents in repositories. Manage webhooks, notifications, and codespaces.

Salesforce

Manage CRM data including Accounts, Contacts, Leads, Opportunities, Cases, and custom objects. Create, read, update, and delete records. Query data using SOQL and search across objects using SOSL. Perform bulk data operations for large-scale imports, exports, and migrations. Execute composite requests to batch multiple operations in a single API call. Access analytics, reports, and dashboards. Manage files and attachments associated with records. Interact with Chatter feeds, posts, and groups for social collaboration. Manage org metadata including custom objects, fields, layouts, and workflows. Query data using GraphQL for precise data retrieval across related objects.

Sharepoint

Manage SharePoint sites, document libraries, lists, and files. Create, read, update, and delete lists and list items with custom columns. Resolve site users to numeric Person/Group LookupId values. Upload, download, move, copy, and version files in document libraries. Search across sites, files, folders, lists, and list items using Microsoft Search. Manage permissions at site, list, and item levels with granular access control. Define and manage content types and site columns. Retrieve site properties and search for sites across Microsoft 365.

Airtable

Create, read, update, and delete records in Airtable bases and tables. Manage base schemas including creating tables and fields. Filter records using formulas, sort by fields, and scope queries to specific views. Upsert records to find, create, or update in a single call. Upload attachments to records, read and write record comments, list accessible bases, and receive real-time base change events through webhooks.

Sentry

Track, manage, and resolve application errors and performance issues. List, query, and bulk-update issues and error events with filters like status, assignment, and tags. Create and manage releases, associate commits, and upload source maps. Configure issue alert rules and metric alert rules with notification actions. Set up cron monitors to detect missed or failed scheduled jobs. Build custom dashboards with configurable widgets. Run ad-hoc Discover queries across errors and transactions for performance analysis. Manage organizations, teams, projects, and members. Provision users via SCIM. Access session replay data.

Bitbucket

Manage Git repositories, pull requests, and CI/CD pipelines on Bitbucket Cloud. Create, fork, and configure repositories within workspaces and projects. Create, review, approve, merge, and decline pull requests with inline code comments. Browse source code, list commits, and manage branches and tags. Trigger, monitor, and manage Bitbucket Pipelines. List workspace members, configure repository default reviewers and branch restrictions, create and manage repository webhooks, and search code across repositories.

Technical notes for Virustotal

Scan and analyze files, URLs, domains, and IP addresses for malware and security threats using 70+ antivirus engines and sandboxes. Retrieve threat reports by file hash, look up domain and IP reputation with passive DNS and WHOIS data, and explore IoC relationships to map threat infrastructure. Manage YARA Livehunt rulesets to monitor incoming submissions and run Retrohunt jobs against historical file collections. Add comments and votes to indicators, create visual relationship graphs of IoCs, search VirusTotal's dataset with advanced queries, and consume threat feeds. Download file samples and network traffic captures for offline analysis.

Frequently asked questions

Common questions about connecting Virustotal to AI agents with Metorial.

  1. How many tools does the Virustotal MCP server have?
    The Virustotal MCP server exposes 15 tools, including Get Domain Report, Manage Livehunt Ruleset, Get URL Report. Each one is governed and traced through Metorial.
  2. Virustotal exposes tools your agents call on demand; it does not publish event triggers yet. Everything still runs through one governed MCP URL.
  3. Any MCP client, including VS Code, Windsurf, Zed, OpenCode and Grok. Each one reaches the Virustotal MCP server through the same Metorial URL.
  4. Use role-based access control to decide which teams, users, and agents can use Virustotal and which of its tools they can call.
  5. Yes. Metorial is open source, so you can run the Virustotal MCP server yourself or use the hosted gateway.

Connect Virustotal to production AI agents

See how Metorial gives your team governed access to Virustotal, with tracing and security controls built in.