VirusTotal
Official VirusTotal MCP server: threat reports, file and URL submissions, and analysis recovery.
MCP server · by VirusTotal
About
VirusTotal is an MCP server published by VirusTotal. Marketplaces we read that list it: 2 (Official MCP Registry, PyPI (MCP servers)). The last change we recorded was on 2026-10-24. As of our marketplace pass on 2026-10-24.
What it asks for
- Runs remotely
- Runs on your machine
- Settings: 1
Requires: VTAI_TOKEN_FILE
What it declares, asks for and runs, in full
Only install plugins from developers you trust. We list what marketplaces publish and do not test plugins.
Package
- PyPI downloads/week: 114 (2026-10-24)
- PyPI downloads/month: 1 474 (2026-10-24)
- Latest version on PyPI: 0.9.9, published 2026-10-11
No known vulnerabilities in OSV for 0.9.9 (checked 2026-10-24)
PyPI facts come from pypi.org, PyPI downloads from pypistats.org. Each figure is the registry's own and is never added to another. A registry that publishes no figure shows none: no number is not zero. Vulnerability records come from OSV.dev (CC BY 4.0) and concern the declared version only; a listing that declares no version gets no answer. We do not scan code.
Works with
- Claude Code
- Codex
- Cursor
- VS Code
- Copilot CLI
A one-click link opens the client, which asks you to confirm before it adds the server.
From the marketplaces that list it and the MCP transport it declares, as each client documents them. We do not test plugins.
Connect
Commands and configs built only from what its marketplaces declare. We do not run them for you and do not test plugins.
As a remote MCP server
Built from what Official MCP Registry declares.
claude mcp add --transport http virustotal-mcp https://ai.virustotal.com/mcp[mcp_servers.virustotal-mcp]
url = "https://ai.virustotal.com/mcp"{
"mcpServers": {
"virustotal-mcp": {
"url": "https://ai.virustotal.com/mcp"
}
}
}Where it is published
| Marketplace | Status | Version | Figures | Verified | First seen |
|---|---|---|---|---|---|
| Official MCP Registry (Open the registry record) | Listed | 0.9.9 | Downloads/month (PyPI): 1 474 Downloads/week (PyPI): 114 Forks (GitHub): 2 Stars (GitHub): 21 |
Not marked | |
| PyPI (MCP servers) (Open on PyPI) | Listed | 0.9.9 | Downloads/month (PyPI): 1 474 Downloads/week (PyPI): 114 Forks (GitHub): 2 Stars (GitHub): 21 |
Not marked |
Each figure is the marketplace's own and is never added up across marketplaces. A marketplace that publishes no figure shows none: no number is not zero.
How its figures have moved
- 2026-10-162
- 2026-10-232
- 2026-10-1520
- 2026-10-1621
- 2026-10-2321
Each dot is a day we read a different number; flat stretches are days the number did not move. Figures of different marketplaces are never added up.
What changed
Nothing has moved on this plugin since we started watching it.
Possibly the same plugin
Listings that share a signal with this one but not enough for us to treat them as the same product.
Similar plugins
Products whose own names, descriptions, tools and skills are closest in meaning to this one, on every marketplace we read. Closeness is ranked within this list only.
-
virustotal-mcp io.github.mrfentmen/virustotal-mcp
MCP server for VirusTotal: file, URL, domain, IP reports. Free key.
-
VirusTotal MCP — file / URL / domain / IP reputation (BYO key)
-
Protected research briefs, bounded scrolls, and private video feeds for agents.
-
MalwareBazaar MCP — abuse.ch malware sample database (free, key required)
-
virustotal io.github.BurtTheCoder/virustotal
MCP server for querying VirusTotal API with comprehensive security analysis tools.
-
Proofpoint TAP threats, VAPs, clickers, and IOCs from your terminal, with a local threat store.
-
Security-first MCP server for reverse engineering, malware analysis, forensics, and SAST.
-
ThreatFox MCP — abuse.ch indicator-of-compromise feed (free, key required)
-
Threat-intelligence verdicts on a URL, domain or IP before a coding agent connects to it.
-
Submit files and URLs to a malware sandbox, poll scans, fetch reports, hashes and IOCs.
Similar plugins by marketplace
The same question asked of one marketplace at a time: is there an analog of this plugin there?
Has a listing on Claude Code: claude-plugins-community (5)
-
Real-time security filter for MCP tool communications. Works as a Claude Code hook to inspect all data sent to and received from MCP servers. Detects prompt injection, API key…
-
MalChela is a Rust-based malware analysis toolkit for DFIR analysts and malware researchers. It exposes file triage, string extraction with IOC detection and MITRE ATT&CK mapping…
-
Manage Zscaler Zero Trust Exchange via 400+ tools — ZPA, ZIA, ZDX, ZCC, ZTW, ZMS, EASM, and more.
-
nodebench io.github.HomenShum/nodebench
260 MCP tools across 49 domains. AI Flywheel, quality gates, research, web scraping.
-
Connect AI assistants to Outline for document search, reading, and management
Has a listing on Claude Code: claude-plugins-official (5)
-
Manage Zscaler Zero Trust Exchange via 400+ tools — ZPA, ZIA, ZDX, ZCC, ZTW, ZMS, EASM, and more.
-
MCP server for terminal commands, file operations, and process management
-
Connect Claude to a private MCP server through an Anthropic MCP tunnel. The /create-docker-mcp-tunnel command drives the Docker Compose quickstart end to end: certificates, proxy…
-
mcp-server io.github.cap-js/mcp-server
Model Context Protocol (MCP) server for AI-assisted development of CAP applications.
-
Dynatrace observability skills: DQL query patterns, application and infrastructure monitoring, log analysis, problem investigation, and incident response workflows, with the…
Has a listing on Claude: knowledge-work-plugins (5)
-
MCP server for terminal commands, file operations, and process management
-
Search companies and contacts, enrich leads, find lookalikes, and get AI-ranked contact recommendations. Pre-built skills chain multiple ZoomInfo tools into complete B2B sales…
-
The Vanta plugin connects Claude Code to Vanta's security and compliance platform through the Vanta MCP server. It combines Vanta's test-specific remediation intelligence with…
-
Hosted MCP server for AI-assisted Grafana Cloud observability — no local installation required.
-
Official SigNoz plugin for MCP setup, docs, queries, dashboards, and alerts
Has a listing on Codex: openai-curated (openai/plugins) (5)
-
CrowdStrike Falcon Fusion skills for authoring, deploying, and executing Fusion workflows. Includes live action discovery, YAML authoring with schema validation, workflow import…
-
Codex Security workflows for security scans, analysis, and investigation.
-
CrowdStrike Falcon Foundry development skills for building cybersecurity applications on the Falcon platform. Includes UI development, collections, functions, workflows, API…
-
Available for US1 customers only. Analyze, investigate, and act on your Datadog telemetry directly from ChatGPT using natural language. Ask questions about your production…
-
Cloudflare platform plugin with curated skills for Workers, Wrangler, and Agents SDK plus the official Cloudflare API MCP server.
Has a listing on Community GitHub marketplaces (5)
-
Proofpoint TAP threats, VAPs, clickers, and IOCs from your terminal, with a local threat store.
-
Every Huntress endpoint, plus a local SQLite mirror that delivers fleet-wide incident, coverage
-
HaloPSA ticket triage, SLA-breach pre-emption, and cross-client analytics for any MCP agent.
-
Official VirusTotal threat intelligence and local file submission through OAuth.
-
Fleet-wide backup triage, stale-backup detection, and cross-engine analytics for any MCP agent.
Has a listing on Copilot CLI: github/awesome-copilot (5)
-
Complete toolkit for building Model Context Protocol (MCP) servers in Go using the official github.com/modelcontextprotocol/go-sdk. Includes instructions for best practices, a…
-
Complete toolkit for building Model Context Protocol (MCP) servers in TypeScript/Node.js using the official SDK. Includes instructions for best practices, a prompt for generating…
-
Safe BLE diagnostics, evidence workflows, and guarded automation for AI agents.
-
Build Model Context Protocol (MCP) servers in Java with the official MCP Java SDK 2.x. Includes a skill that generates a server project and an expert agent for guidance.
-
Complete toolkit for building Model Context Protocol (MCP) servers in Kotlin using the official io.modelcontextprotocol:kotlin-sdk library. Includes instructions for best…
Has a listing on Copilot CLI: github/copilot-plugins (5)
-
mcp-apps
Generate MCP App widgets for MCP tools. Produces self-contained HTML widgets using the MCP Apps protocol.
-
power-automate
Build, edit, run, and debug Power Automate cloud flows via the FlowAgent MCP server — connection lifecycle, surgical edits, copy across environments, run management, and validated…
-
workiq
Query Microsoft 365 data with natural language — emails, meetings, documents, Teams messages, and more.
-
Microsoft Dataverse plugin for coding agents, covering record CRUD, bulk data operations, advanced queries, schema and metadata, administration, security, environment management…
-
Analyze MSVC build performance using vcperf.exe and ETL traces.
Has a listing on Cursor: cursor/plugins (5)
-
Let Grok Bot reach MCP servers on your private Tailscale network. On your own tailnet it joins as one tag:grokbot device; on your team's company tailnet, turned on by a team…
-
Query and remediate compliance tests, controls, frameworks, risks, and vulnerabilities in Vanta.
-
Work with PostHog from chat: query product analytics and run SQL, manage feature flags and experiments, triage error tracking issues, and review session replays, surveys, and…
-
Search media and social mentions and pull analytics.
-
Track AI visibility, sentiment, and citations.
Has a listing on Docker MCP Catalog (5)
-
A comprehensive security scanner for MCP servers with YARA rules and static analysis capabilities.
-
Dynatrace-mcp io.github.dynatrace-oss/Dynatrace-mcp
[DEPRECATED] Dynatrace MCP Server. Migrate to dynatrace-for-ai or Dynatrace Remote MCP Server.
-
Remote MCP server for the Hackle Admin API: experiments, feature flags, remote config, messaging.
-
Official ClickHouse MCP server for querying and exploring ClickHouse clusters and chDB.
-
Manage Zscaler Zero Trust Exchange via 400+ tools — ZPA, ZIA, ZDX, ZCC, ZTW, ZMS, EASM, and more.
Has a listing on Official MCP Registry (5)
-
virustotal-mcp io.github.mrfentmen/virustotal-mcp
MCP server for VirusTotal: file, URL, domain, IP reports. Free key.
-
VirusTotal MCP — file / URL / domain / IP reputation (BYO key)
-
Protected research briefs, bounded scrolls, and private video feeds for agents.
-
MalwareBazaar MCP — abuse.ch malware sample database (free, key required)
-
virustotal io.github.BurtTheCoder/virustotal
MCP server for querying VirusTotal API with comprehensive security analysis tools.
Has a listing on PyPI (MCP servers) (5)
-
MCP proxy adding security scanning, behavioral profiling, risk gating, and safe tool call execution.
-
Exploit Intelligence Platform — CVE, Vulnerability and Exploit Database
Real-time CVE, exploit, and vulnerability intelligence for AI assistants (350K+ CVEs, 115K+ PoCs)
-
mcp-server-malcolm io.github.nagameTW/mcp-server-malcolm
MCP server for Malcolm (Zeek/Suricata/Arkime/OpenSearch): threat-hunting access for AI agents
-
Policy enforcement plane for MCP: every tool call ends in a verdict. Self-hosted, MIT.
-
Official ClickHouse MCP server for querying and exploring ClickHouse clusters and chDB.
Has a listing on npm registry (MCP servers) (5)
-
mcp com.dechonet/mcp
30 security tools for AI agents: phishing links, exposure maps, DNS, SSL, PQC, history, pivots.
-
Audit MCP servers for tool poisoning, rug pulls and supply-chain risk (OWASP MCP Top 10).
-
Governed Obsidian vault access: hybrid retrieval, Markdown-native memory, HITL confirmations.
-
CVE, KEV, EPSS, SBOM and advisory lookups; per-CVE exposure from Shodan data (© Shodan). Keyless.
-
mcp-tenant-isolation io.github.subodhkc/mcp-tenant-isolation
Static analysis scanner for MCP server code and multi-tenant SaaS applications.
Found by meaning, not by shared code or a shared repository: similar plugins stay separate products, and this is not a review or a recommendation.
Want this mark on your plugin in our catalog?
Prove you maintain it with a file in its repository, a file on your domain or a DNS record, and you can show this mark on the card, with live banners for your site and README. How verification works
You also get alerts when a marketplace lists it, drops it, changes its verified mark or what it asks for, and its remote endpoint goes on monitoring as a web service.
Data comes from the Official MCP Registry (registry.modelcontextprotocol.io), CC0 1.0. Package data comes from the Python Package Index (pypi.org). Figures come from our own regular passes over the marketplaces, last read on . We publish no contact details for plugin publishers.