Happy slice of mcp pizzaMCP.pizza

mcp-virustotal

MCP.Pizza Chef: w0h1v

Built on VirusTotal's threat database, this adds eleven lookup tools covering web addresses, file fingerprints, IP addresses and domain names, and reports what dozens of antivirus engines say about each one. A free VirusTotal account key is required, and the free tier is throttled to roughly four lookups a minute. It only reads: it cannot upload a file from your computer, so you must already have that file's fingerprint. Setup is a one-line command or a small config paste in Claude Desktop, Claude Code, VS Code Copilot, Gemini CLI or Codex.

Data
Web/Research

Use This MCP server To

Check whether a link from a suspicious email is malicious Look up a file's fingerprint to see if scanners flag it Find out who registered a domain and when it appeared See which servers a sketchy website quietly talks to Investigate an IP address that keeps hitting my website logs Page through every known file linked to one bad domain

README

VirusTotal MCP Server

MCP Registry smithery badge

A Model Context Protocol (MCP) server for querying the VirusTotal API. This server provides comprehensive security analysis tools with automatic relationship data fetching. It integrates seamlessly with MCP-compatible applications like Claude Desktop.

Quick Start (Recommended)

Claude Code

claude mcp add --transport stdio --env VIRUSTOTAL_API_KEY=your-key virustotal -- npx -y @burtthecoder/mcp-virustotal

Codex CLI

codex mcp add virustotal --env VIRUSTOTAL_API_KEY=your-key -- npx -y @burtthecoder/mcp-virustotal

Gemini CLI

gemini mcp add -e VIRUSTOTAL_API_KEY=your-key virustotal npx -y @burtthecoder/mcp-virustotal

Installing via Smithery

To install VirusTotal Server for Claude Desktop automatically via Smithery:

mcp-virustotal FAQ

Do I need a VirusTotal account?
Yes. You need a free VirusTotal key, and the server refuses to start without it. Signing up takes a minute and costs nothing.
Is the free version enough?
For occasional checks, yes. The public tier allows about four lookups per minute, and the project warns that some newer free keys are cut down to as little as one lookup a day. Heavy or automated use needs a paid plan.
Can I use this to check a file sitting on my computer?
Not directly. It accepts a file's fingerprint (its MD5, SHA-1 or SHA-256 checksum), never the file itself, so nothing on your machine is uploaded. If your assistant can calculate a checksum locally, it can then look that value up here.
Can it change or delete anything?
No. Every tool is a read-only lookup, with one exception worth knowing: if you ask about a web address VirusTotal has never seen, it submits that address for scanning, which makes the address visible to VirusTotal. Avoid pasting private or one-time links.
Which apps does it work in?
Claude Desktop, Claude Code, VS Code with GitHub Copilot, Gemini CLI and Codex CLI are all documented, and it can also run as a shared service over the network.
How hard is it to set up?
Easy. Paste one command or a short block of settings, add your key, and restart the app. No building or coding involved.
Can I use this to investigate a phishing message?
Yes. Give your assistant the link and the sender's domain and it will pull the reputation report, the registration details and the related addresses in one go.