io.github.w0h1v由 GitHub 帳號 w0h1v 發布v1.0.38更新於 Nov 5, 2026
MCP server for querying VirusTotal API with comprehensive security analysis tools.
透過 VirusTotal v3 API 讓助理查詢檔案、URL、IP 與網域的安全報告，並沿威脅關聯關係繼續追查。
Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。
參照 儲存庫 中的啟動說明。
[mcp-virustotal: threat intelligence for AI agents]
[npm version] [CI] [License: MIT] [Node 20 or newer] [MCP Registry]
Quickstart · Tools · HTTP · Security · Troubleshooting · Docs
mcp-virustotal is an MCP server that gives AI agents access to the VirusTotal v3 API. Hand your agent a hash, URL, IP or domain and get back the detection report plus the relationships an analyst would pivot on: contacted hosts, dropped files, resolutions, threat actors.
[!NOTE] Independent project, not affiliated with VirusTotal or Google. You need your own VirusTotal API key.
?relationships= call to save quota.get_url_report returns the cached VirusTotal report and only submits a scan on a cache miss.type:peexe positives:5+), merged sandbox behaviour summaries, and threat-actor and malware-family collections.Requirements: Node.js 20 or newer and a VirusTotal API key.
For Claude Desktop, VS Code and running from source, see Connect a client.
Then ask your agent: "Look up the SHA-256 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f (the EICAR test file) and show what it drops and contacts."
Eleven tools. Full parameters and relationship lists are in the tool reference.
stdio is the default. Set MCP_TRANSPORT=httpStream to run a standalone HTTP service:
A health check is served at /health.
[!WARNING] The HTTP transport has no authentication. Keep the port on localhost or behind an authenticating reverse proxy, or anyone who can reach it can spend your API quota.
Report vulnerabilities privately; see SECURITY.md.
logs/mcp-virustotal-server.log in the package directory.More in the troubleshooting guide.
The smoke test paces calls at 20 s for the public-tier limit and isn't suited to free tiers reduced to a few lookups a day. See CONTRIBUTING.md and the changelog.
MIT. See LICENSE.
來源：README.md，提交 470fc38
Get a comprehensive URL analysis report including security scan results and key relationships (communicating files, contacted domains/IPs, downloaded files, redirects, threat actors). Returns the cached VirusTotal report when available, or submits the URL for scanning and waits for results.
url必填Query a specific relationship type for a URL with pagination support. Choose from 22 relationship types including communicating files, contacted domains/IPs, downloaded files, redirects, referrers, threat actors, and collections. Useful for paging through the full list when the summary in get_url_report is truncated.
url必填limitcursorrelationship必填Get a comprehensive file analysis report using its hash (MD5/SHA-1/SHA-256). Includes detection results, file properties, and key relationships (behaviors, dropped files, network connections, embedded content, threat actors). Returns both the basic analysis and automatically fetched relationship data.
hash必填Query a specific relationship type for a file with pagination support. Choose from 40 relationship types including behaviors, network connections, dropped files, embedded content, execution chains, and threat actors. Useful for detailed investigation of specific relationship types.
hash必填limitcursorrelationship必填Get a comprehensive IP address analysis report including geolocation, reputation data, and key relationships (communicating files, historical certificates/WHOIS, resolutions). Returns both the basic analysis and automatically fetched relationship data.
ip必填Query a specific relationship type for an IP address with pagination support. Choose from 15 relationship types including communicating files, historical SSL certificates, WHOIS records, resolutions, and threat actors. Useful for detailed investigation of specific relationship types.
ip必填limitcursorrelationship必填Get a comprehensive domain analysis report including DNS records, WHOIS data, and key relationships (SSL certificates, subdomains, historical data). Optionally specify which relationships to include in the report. Returns both the basic analysis and relationship data.
domain必填relationshipsQuery a specific relationship type for a domain with pagination support. Choose from 24 relationship types including subdomains, resolutions, SSL certificates, WHOIS history, and threat actors. Useful for detailed investigation of specific relationship types.
limitcursordomain必填relationship必填Search the VirusTotal corpus for files, URLs, domains, IPs, or comments matching a query. Accepts plain IOCs (hash, URL, domain, IP), free text against comments, or VTI-style search modifiers like "type:peexe size:90kb+ tag:signed positives:5+". Paginated via cursor.
limitquery必填cursorGet a consolidated sandbox behaviour summary for a file (MD5/SHA-1/SHA-256), merged across every sandbox that analyzed it. Returns processes, files, registry, network activity, MITRE ATT&CK techniques, IDS alerts, and signature matches in a single view — far more useful than iterating individual behaviour reports.
hash必填Retrieve a VirusTotal collection by ID. Collections represent threat actors, malware families, campaigns, intel reports, and curated IOC sets — often referenced from the related_threat_actors and collections relationships on other tools. Optionally include relationships (files, urls, domains, ip_addresses, references, threat_actors, related_collections, related_references, comments, owner, autogenerated_graphs) to fetch member IOCs in the same call.
id必填relationships已滿足適用檢查項的 90%
該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。
請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。
flowchart LR A["AI agent<br/>(Claude, Codex, Gemini, VS Code)"] -->|"MCP over stdio or HTTP"| S["mcp-virustotal"] S -->|"validate input,<br/>HTTPS + API key"| V["VirusTotal v3 API"] V -->|"JSON"| S S -->|"formatted report text"| A# Claude Codeclaude mcp add --transport stdio --env VIRUSTOTAL_API_KEY=your-key virustotal -- npx -y @burtthecoder/mcp-virustotal
# Codex CLIcodex mcp add virustotal --env VIRUSTOTAL_API_KEY=your-key -- npx -y @burtthecoder/mcp-virustotal
# Gemini CLIgemini mcp add -e VIRUSTOTAL_API_KEY=your-key virustotal npx -y @burtthecoder/mcp-virustotalMCP_TRANSPORT=httpStream MCP_PORT=3000 VIRUSTOTAL_API_KEY=your-key node build/index.jsdocker build -t mcp-virustotal .docker run -p 127.0.0.1:3000:3000 -e VIRUSTOTAL_API_KEY=your-key -e MCP_TRANSPORT=httpStream mcp-virustotalgit clone https://github.com/w0h1v/mcp-virustotal && cd mcp-virustotalnpm cinpm test # build + unit tests, no key or networkVIRUSTOTAL_API_KEY=your-key npm run smoke # all 11 tools against the real API