VirusTotal

Name: VirusTotal
Author: VirusTotal

by VirusTotalversion 0.9.9i★ –iComputer or cloud

Registry nameio.github.VirusTotal/virustotal-mcp

Install

Overview

Description from the maker (original English)

Official VirusTotal MCP server: threat reports, file and URL submissions, and analysis recovery.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Computer or cloud
Transport: stdio, Streamable HTTP
Category: Other
You need to fill in: VTAI_TOKEN_FILE

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on the maker’s server: what you ask it goes through their server.
You fill in yourself: VTAI_TOKEN_FILE

You need

Runs in the cloudNothing to install; it connects over the internet
PyPIPython’s uv installed (for the uvx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Works in Claude on the web, desktop and mobile:

Open Settings → Connectors
Press Add custom connector
Paste the address below and press Add
If it asks you to sign in, sign in with the maker

https://ai.virustotal.com/mcp

Or run it on your computer

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "virustotal": {
      "command": "uvx",
      "args": [
        "vt-mcp"
      ],
      "env": {
        "VTAI_TOKEN_FILE": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add --transport http virustotal https://ai.virustotal.com/mcp

Or run it on your computer

claude mcp add virustotal --env VTAI_TOKEN_FILE=your-value -- uvx vt-mcp

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "virustotal": {
      "url": "https://ai.virustotal.com/mcp"
    }
  }
}

Or run it on your computer

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "virustotal": {
      "command": "uvx",
      "args": [
        "vt-mcp"
      ],
      "env": {
        "VTAI_TOKEN_FILE": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "virustotal": {
      "type": "http",
      "url": "https://ai.virustotal.com/mcp"
    }
  }
}

Or run it on your computer

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "virustotal": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "vt-mcp"
      ],
      "env": {
        "VTAI_TOKEN_FILE": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

ChatGPT connects only to servers on the internet:

Open ChatGPT on the web → Settings → Connectors (Apps)
Press Create or Add (some plans need Developer mode under Advanced first)
Paste the address below, give it a name and save
If it asks you to sign in, sign in with the maker

https://ai.virustotal.com/mcp

Menu names can differ slightly by plan and over time.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

VTAI_TOKEN_FILE required env
Path to a protected file containing only your VTAI token. Get free access at https://ai.virustotal.com/connect/mcp.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

We have not read this server’s tool list yet; we check endpoints in rotation.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account VirusTotal, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
… Not checked yet
Endpoint responds
Not checked yet; we check endpoints in rotation
… Not checked yet
Sign-in with OAuth
Not checked yet; we check endpoints in rotation
… Not checked yet
No hidden instructions in tool descriptions
Not checked yet; we read the tool list when we check the endpoint

Compared with others in Otheri

More stars than 0% of the other 32725 servers in this category
Published to the registry more recently than 59% of the other 32725 servers in this category
Basic checks equal to or better than 100% of the other 32725 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is VirusTotal safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: VTAI_TOKEN_FILE

Does it run on my computer or in the cloud?

Either way works: install it on your computer or connect to the cloud version.

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.9.9) reached the registry 27 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, Signoff

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

by formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Runs on your computer★ 440MITUpdated 14 months ago

Install

Remote Desktop Commander

by desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Runs in the cloud★ 211Updated 2 days ago

Install

Signoff

by ayuanxx-max

Five gates that make an agent's 'done' provable: run them, read the verdict, audit the record.

Runs on your computerUpdated today

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

VirusTotal MCP

The official VirusTotal MCP server gives your agent threat intelligence before it opens a link, runs a downloaded file or investigates suspicious infrastructure. vt-mcp connects MCP clients to VTAI, with reports for files, URLs, domains and IP addresses, file and network analysis submission, and receipt recovery.

Use the free VTAI service with its current access limits. You do not need your own VirusTotal API key.

Connect remotely with OAuth

Use `https://ai.virustotal.com/mcp` in a compatible remote MCP client. Sign in with your VTAI account and approve the connection's permissions; no local Python installation, static token or personal VirusTotal API key is required.

Claude Code: install the plugin

The official plugin includes the OAuth connection, a threat-intelligence skill and local file uploads without model-generated base64.

claude plugin marketplace add VirusTotal/virustotal-mcp

claude plugin install virustotal@virustotal

Requires Claude Code 2.1.283 or later and Node.js 22 or later on its PATH. Node.js 22 and 24 are verified by the plugin CI. The plugin includes https://ai.virustotal.com/mcp.

If you are replacing an existing manual connection with the plugin, read the migration and recovery guide before removing anything. Recover uncertain submissions through the original connection first; keep a working manual connection if you choose that alternative.

Start a new session or use /reload-plugins, then /mcp to complete browser sign-in when needed. The plugin already supplies the MCP connection; do not add a duplicate. See plugin setup, file access and credential-name protection.

Claude Code alternative: manual HTTP without Node.js

For report lookups without the local upload hook, use the direct connection:

claude mcp add --transport http virustotal https://ai.virustotal.com/mcp

Open Claude Code, run /mcp, select virustotal and complete browser sign-in. See the Claude Code OAuth instructions and the VirusTotal connection guide. Choose this alternative or the plugin. Adding a server configures it; complete authentication and a tool call to check that your connection works.

OAuth connections share the signed-in VTAI account's free quota and use the permissions approved for each connection. Existing Agent Tokens keep their rights and quotas. If your client needs configurable HTTP headers, use one protected Authorization: Bearer or x-apikey credential instead of OAuth. Other local clients can use the stdio installation below.

Connect your client

For compatible remote clients, connect with OAuth using the MCP URL. Otherwise, reuse your existing VTAI Agent Token or create one.
For stdio, save the token in a file readable only by your user, such as ~/.config/vt-mcp/token. Set the MCP server's environment variable VTAI_TOKEN_FILE to that path and its command to vt-mcp. The file contains only the token; never put the token itself in chat, command arguments or project files.
Follow the client-specific setup, restart or reconnect the client, and inspect its available tools.

Client	Setup
Antigravity CLI (`agy`)	Marketplace plugin with MCP and skill, local stdio or native OAuth recipe
Claude Code	OAuth plugin with local file uploads, HTTP or local stdio
Codex	HTTP or local stdio
ChatGPT	Install the published VirusTotal plugin · Connection guide
Cursor	HTTP recipe
VS Code with GitHub Copilot	HTTP recipe
GitHub Copilot CLI	HTTP OAuth recipe or local stdio
Devin CLI	HTTP OAuth recipe or local stdio
Windsurf / Devin Desktop	Cascade HTTP recipe
Antigravity IDE	Local stdio configuration or native OAuth recipe
Gemini CLI	Install the OAuth extension
Gemini Apps	Custom MCP connection and optional importable skill, subject to Google's account and regional availability; complete hosted workflow validation pending
Grok Build	Manual plugin installation; OAuth, reports and renewal verified
Kimi Code	Manual plugin installation; OAuth, reports and proactive renewal verified with an external model

Remote OAuth configuration for GitHub Copilot CLI and Devin CLI follows their official documentation; an OAuth-authenticated VirusTotal tool workflow has not yet been verified in either client.

See additional remote client recipes for Qwen Code, Mistral Vibe Work, Grok web and the xAI Responses API, with their validation limits. Qwen Code 0.25.1 has a known OAuth credential-storage incompatibility with VTAI; browser consent alone does not complete its connection.

The client validation guide distinguishes documented configuration, local transport checks and workflows exercised with a model. A recipe is not a claim of full validation in every client. Other agents can use the same MCP endpoint or the VTAI API directly.

In ChatGPT, install the published VirusTotal plugin, connect with Google when prompted, then select @VirusTotal in a new chat. Developer mode is not required for the published plugin; account and workspace policies still apply. The connection guide includes the separate custom-app alternative and validation limits. Initial OAuth consent, IP reports and automatic token renewal were verified separately on 2026-09-24; publication does not validate every workflow.

For a first query, ask your agent:

Use VirusTotal to get the domain report for virustotal.com. Show the source, analysis date, coverage and report link.

In ChatGPT, prefix the prompt with @VirusTotal. A report lookup does not read or upload local files. A missing report remains unknown, and zero detections do not establish safety.

Install for local stdio

For local stdio, install uv and run:

uv tool install --python 3.12 --default-index https://pypi.org/simple 'vt-mcp==0.9.9'

vt-mcp --version

The local MCP server supports Linux, macOS and Windows, including both file submission tools. Windows submission receipts require local NTFS storage; network shares and reparse points are rejected. The separate vt-mcp guard command remains Linux-only.

For automatic client configuration, choose Agy, Claude Code or Codex in the setup guide, then open its Agent Token alternative and choose your operating system. The installer protects the token using owner-only POSIX permissions or a Windows user-only ACL.

The command installs the package from the official PyPI index in an isolated tool environment. Python 3.12 or newer is required. Keep vt-mcp on the MCP client's PATH, or use its absolute executable path. The package does not modify client configuration.

Maintain an existing connection

Open your client's Agent Token alternative in the setup guide to check the configured transport and update a setup-managed installation without creating another token. The access check uses GET /api/v3/agents/me/access without query cost; a real report query consumes quota. Restart the client after an update. An access or configuration check does not exercise a tool or certify the model's behavior.

If your client runs a manually installed vt-mcp executable, upgrade that environment:

uv tool install --upgrade --python 3.12 --default-index https://pypi.org/simple 'vt-mcp==0.9.9'

vt-mcp --version

A client configured with uvx ... vt-mcp== uses that pinned version, independently of the installed executable. Update its pin or use the setup guide. Hosted HTTP connections use the deployed server; they do not need a local package upgrade. Keep existing tokens and submission receipts.

Missing-report, quota and temporary-service errors include next_steps and a documentation link. A missing report leaves the file or indicator unknown; verify its hash or value. Report lookups never authorize a submission or reanalysis. Use submission tools only when the user explicitly requests that action, under the sharing guidance below. Retain the file's SHA256 or a new UUIDv4 request_id for an intended network operation, then recover using that identifier. On quota or temporary service failures, honor retry_after_seconds when present, retain credentials and avoid tight retry loops. Never automatically replay an uncertain submission or replace its request ID: recover its receipt first.

Antigravity IDE

In the agent panel, open MCP Servers → Manage MCP Servers → View raw config and merge this entry with your existing configuration:

"mcpServers": { "virustotal": { "command": "vt-mcp", "args": [], "env": { "VTAI_TOKEN_FILE": "~/.config/vt-mcp/token" } } } }

Use an absolute exec

Only the beginning is shown; read the rest in the repo

VirusTotal

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Or run it on your computer

Or run it on your computer

Or run it on your computer

Or run it on your computer

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

Signoff

README from the maker

VirusTotal MCP

Connect remotely with OAuth

Claude Code: install the plugin

Claude Code alternative: manual HTTP without Node.js

Connect your client

Install for local stdio

Maintain an existing connection

Antigravity IDE