VirusTotal MCP Server MCP Server

About

## VirusTotal MCP Server: Malware Analysis and Threat Intelligence The **VirusTotal MCP Server** integrates the world's largest malware database into Google Antigravity, enabling file analysis, URL scanning, and threat intelligence gathering with results from 70+ antivirus engines. ### Why VirusTotal MCP? - **Multi-engine scanning** - Results from 70+ antivirus vendors - **File analysis** - Upload and analyze suspicious files - **URL checking** - Scan URLs for malicious content - **Threat intelligence** - Access detailed malware behavior reports - **Community data** - Leverage crowd-sourced threat information ### Key Features #### 1. File Scanning ```python # Scan file for malware result = await mcp.call("virustotal", "scan_file", { "file_path": "/downloads/suspicious.exe" }) print(f"Detection Ratio: {result[\"positives\"]}/{result[\"total\"]}") for engine, detection in result["scans"].items(): if detection["detected"]: print(f" {engine}: {detection[\"result\"]}") ``` #### 2. Hash Lookup ```python # Check file hash hash_result = await mcp.call("virustotal", "get_file_report", { "hash": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f" }) if hash_result["response_code"] == 1: print(f"Detections: {hash_result[\"positives\"]}/{hash_result[\"total\"]}") print(f"First Seen: {hash_result[\"first_seen\"]}") print(f"File Type: {hash_result[\"type\"]}") else: print("File not found in VirusTotal database") ``` #### 3. URL Analysis ```python # Scan URL for threats url_scan = await mcp.call("virustotal", "scan_url", { "url": "https://suspicious-site.example.com" }) print(f"URL: {url_scan[\"url\"]}") print(f"Detections: {url_scan[\"positives\"]}/{url_scan[\"total\"]}") for engine, result in url_scan["scans"].items(): if result["detected"]: print(f" {engine}: {result[\"result\"]}") ``` #### 4. Behavior Analysis ```python # Get detailed behavior report behavior = await mcp.call("virustotal", "get_behavior", { "hash": "abc123..." }) print("Network Activity:") for dns in behavior.get("dns_lookups", []): print(f" DNS: {dns[\"hostname\"]}") print("File Operations:") for file_op in behavior.get("files_written", []): print(f" Write: {file_op[\"path\"]}") print("Registry Changes:") for reg in behavior.get("registry_keys_set", []): print(f" Set: {reg[\"key\"]}") ``` ### Configuration ```json { "mcpServers": { "virustotal": { "command": "npx", "args": ["-y", "@anthropic/mcp-virustotal"], "env": { "VT_API_KEY": "your-virustotal-api-key" } } } } ``` ### Use Cases **Malware Analysis**: Investigate suspicious files and understand behavior. **Threat Hunting**: Research IOCs and track threat actor infrastructure. **Email Security**: Check attachments and links before opening. **Incident Response**: Quickly assess severity of potential infections. The VirusTotal MCP Server brings world-class malware intelligence to your workflow.

Installation

{
  "mcpServers": {
    "virustotal": {
      "mcpServers": {
        "virustotal": {
          "env": {
            "VT_API_KEY": "YOUR_API_KEY"
          },
          "args": [
            "-y",
            "mcp-virustotal"
          ],
          "command": "npx"
        }
      }
    }
  }
}

How to Use

1. 1File scanning
2. 2URL analysis
3. 3Multi-engine detection