get_domain_report
Get Domain Report
Retrieve the reputation and contextual report for a domain. Returns WHOIS data, DNS records, detection results, community reputation, and popularity rankings.
Ask your agent in plain language. Each of these maps to a real tool on the server.
get_domain_report
Retrieve the reputation and contextual report for a domain. Returns WHOIS data, DNS records, detection results, community reputation, and popularity rankings.
manage_livehunt_ruleset
Create, update, enable/disable, or delete Livehunt YARA rulesets. Livehunt hooks into the stream of files submitted to VirusTotal and generates notifications when YARA rules match. **Premium feature.**
get_url_report
Retrieve the analysis report for a URL. Accepts a raw URL, its native SHA-256 identifier, or its base64url identifier without padding. Returns detection results from available URL scanners, final destination, category, and community reputation data.
add_comment
Add a community comment to any VirusTotal resource (file, URL, domain, or IP address). Comments support VirusTotal-flavored markdown.
manage_retrohunt
Create and manage Retrohunt jobs that apply YARA rules to VirusTotal's historical file collection. Corpus history, quotas and execution time depend on your hunting license. **Premium feature.**
get_comments
Retrieve community comments for a VirusTotal resource (file, URL, domain, or IP address). Comments include analysis notes, threat intelligence, and other context contributed by community members.
scan_file
Submit a file hash for re-analysis by VirusTotal's partnered antivirus engines and security tools. This triggers a new scan of an already-known file using its SHA-256, SHA-1, or MD5 hash. Use this to get fresh scan results for a previously submitted file.
get_connection_context
Verify the VirusTotal user bound to this API key and retrieve available native privileges and quota counters. Reconnect with the account username if this connection predates username verification.
add_vote
Cast a vote on a VirusTotal resource (file, URL, domain, or IP address) to contribute to community reputation. Vote either "malicious" or "harmless".
get_relationships
Retrieve relationships for any VirusTotal indicator (file, URL, domain, or IP address). Allows pivoting across IoCs to map threat campaigns and infrastructure. Common relationship types: - **Files:** contacted_domains, contacted_ips, contacted_urls, embedded_domains, embedded_ips, itw_urls, execution_parents, compressed_parents, bundled_files, pe_resource_parents - **Domains:** communicating_files, downloaded_files, referrer_files, resolutions, siblings, subdomains, urls - **IPs:** communicating_files, downloaded_files, referrer_files, resolutions, urls - **URLs:** contacted_domains, contacted_ips, downloaded_files, redirecting_urls, redirects_to, referrer_urls
get_analysis_status
Check the status and results of a file or URL analysis by its analysis ID. Use this after submitting a file or URL for scanning to retrieve the results once the analysis is complete.
scan_url
Submit a URL for scanning by VirusTotal's partnered URL scanners and blocklists. Returns an analysis ID that can be used to retrieve scan results once complete.
get_ip_report
Retrieve the reputation and contextual report for an IP address. Returns detection results, WHOIS data, geolocation, AS owner, and community reputation.
search_intelligence
Search VirusTotal's entire dataset using advanced search modifiers. Find files, URLs, domains, and IP addresses matching specific criteria such as file type, detection count, behavioral attributes, submission metadata, and more. **Premium feature.**
get_file_report
Retrieve the available summarized analysis report for a file by its hash. Returns the available detection results, file metadata, reputation scores, and community votes. Use SHA-256, SHA-1, or MD5 hash to look up the file.
Every client uses the same Magic MCP URL, and so does any other MCP client. Add it once and sign in with SSO.
{"mcpServers": {"metorial": {"url": "<your-magic-mcp-url>"}}}
claude mcp add --transport http metorial <your-magic-mcp-url>
codex mcp add metorial --url <your-magic-mcp-url>codex mcp login metorial
One governed layer for every app your agents reach, not a separate connector per tool.
Scan and analyze files, URLs, domains, and IP addresses for malware and security threats using 70+ antivirus engines and sandboxes. Retrieve threat reports by file hash, look up domain and IP reputation with passive DNS and WHOIS data, and explore IoC relationships to map threat infrastructure. Manage YARA Livehunt rulesets to monitor incoming submissions and run Retrohunt jobs against historical file collections. Add comments and votes to indicators, create visual relationship graphs of IoCs, search VirusTotal's dataset with advanced queries, and consume threat feeds. Download file samples and network traffic captures for offline analysis.
Common questions about connecting Virustotal to AI agents with Metorial.