Virustotal Mcp

io.github.mrfentmenPublished by GitHub account mrfentmenv1.0.0Updated Oct 27, 2026

MCP server for VirusTotal: file, URL, domain, IP reports. Free key.

VerifiedSTDIODesktop onlySecurity & Monitoring

Overview

AI-generated overview

Local MCP server that lets an assistant pull VirusTotal reports on files, URLs, domains and IP addresses.

What you can do
  • Look up VirusTotal reports for files, URLs, domains and IP addresses.
  • Retrieve reputation and detection results for a given indicator.
  • The manifest lists no individual tools, so exact operations are not documented.
When to use it
Useful when you want an assistant to check whether a file hash, link, domain or IP address is known to VirusTotal while investigating suspicious content or doing quick threat triage.
Requirements
Runs as a local process over stdio, installed from the npm package virustotal-mcp, so Node.js and npm are needed. The description mentions a free key, implying a VirusTotal API key is required, though the manifest declares no environment variables or headers.
Before you install
A VirusTotal API key is implied but its configuration is undocumented; treat it as a secret. Queries send the file hashes, URLs, domains or IPs you look up to VirusTotal, a third party, so avoid submitting confidential indicators. Free-tier keys have usage limits.

Installation

In SourceWeft

  1. Open Virustotal Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

This repository has no README.

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.0LatestOct 17, 2026

Score

25% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • License10 pts

    Declare a license in the repository or the registry entry.