Skip to content
appsgit

Virustotal

Virustotal is an MCP server that adds tools to AI assistants such as Claude Desktop, Claude Code and Cursor. MCP server for querying VirusTotal API with comprehensive security analysis tools. It has 151 GitHub stars, is released under the MIT license and runs locally with npx -y @burtthecoder/mcp-virustotal.

github.com/w0h1v/mcp-virustotal (opens in a new tab)

Data as of from the GitHub API and the official MCP registry; description from the project's repository. Report an error

View on GitHub (opens in a new tab)

Install Virustotal

Generated from the server's MCP registry entry. Replace your-value with your own values.

Claude Desktop

claude_desktop_config.json
{
  "mcpServers": {
    "virustotal": {
      "command": "npx",
      "args": [
        "-y",
        "@burtthecoder/mcp-virustotal"
      ],
      "env": {
        "VIRUSTOTAL_API_KEY": "your-value"
      }
    }
  }
}

Settings > Developer > Edit Config. macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\. Restart Claude Desktop afterwards.

Claude Code

claude mcp add --env VIRUSTOTAL_API_KEY=your-value --transport stdio virustotal -- npx -y @burtthecoder/mcp-virustotal

Cursor

.cursor/mcp.json
{
  "mcpServers": {
    "virustotal": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@burtthecoder/mcp-virustotal"
      ],
      "env": {
        "VIRUSTOTAL_API_KEY": "your-value"
      }
    }
  }
}

Project file; use ~/.cursor/mcp.json to enable it in every project.

VS Code

.vscode/mcp.json
{
  "inputs": [
    {
      "type": "promptString",
      "id": "virustotal_api_key",
      "description": "VIRUSTOTAL_API_KEY",
      "password": true
    }
  ],
  "servers": {
    "virustotal": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@burtthecoder/mcp-virustotal"
      ],
      "env": {
        "VIRUSTOTAL_API_KEY": "${input:virustotal_api_key}"
      }
    }
  }
}

Config formats checked against the official docs on Oct 7, 2026: modelcontextprotocol.io (opens in a new tab), code.claude.com (opens in a new tab), cursor.com (opens in a new tab), code.visualstudio.com (opens in a new tab).

Environment variables

Variables the server reads at startup.

NameRequiredDescription
VIRUSTOTAL_API_KEYsecretYesYour VirusTotal API key

About Virustotal

Quickstart · Tools · HTTP · Security · Troubleshooting · Docs mcp-virustotal is an MCP server that gives AI agents access to the VirusTotal v3 API. Hand your agent a hash, URL, IP or domain and get back the detection report plus the relationships an analyst would pivot on: contacted hosts, dropped files, resolutions, threat actors.

  • malware-analysis
  • mcp
  • security
  • threat-intelligence
  • typescript
  • virustotal
  • ai-tools
  • claude
  • cybersecurity
  • ioc

Similar MCP servers

More other MCP servers

All Other

FAQ

Virustotal FAQ

Still curious? Email info@appsgit.com.

How do I install the Virustotal MCP server?

Add the command npx -y @burtthecoder/mcp-virustotal to your MCP client: put it in claude_desktop_config.json for Claude Desktop, run claude mcp add for Claude Code, or add it to .cursor/mcp.json (Cursor) or .vscode/mcp.json (VS Code). The snippets on this page are ready to paste.

Is Virustotal free?

The server is open source under the MIT license, so running it is free. It needs credentials (VIRUSTOTAL_API_KEY) for the service it connects to, which may require a paid account.

Is Virustotal actively maintained?

The most recent commit was on Oct 20, 2026. appsgit only lists MCP servers with a commit in the last six months.