mcp-virustotal

The VirusTotal MCP Server exposes a set of reporting tools that query VirusTotal data and automatically fetch related artifacts (domains, IPs, files) to provide a comprehensive security analysis. It supports a range of report tools including get_url_report, get_file_report, get_ip_report, and get_domain_report, as well as relationship-oriented tools for deeper investigations. You can connect this MCP server to Claude Desktop, Codex CLI, or Gemini CLI, or run it directly as an HTTP streaming service. To use it, supply your VirusTotal API key via VIRUSTOTAL_API_KEY and invoke the appropriate tool through MCP-capable clients. For HTTP streaming mode, you can run the server with MCP_TRANSPORT=httpStream to expose a shared endpoint, and connect multiple clients to that endpoint.

Prerequisites:

• Node.js and npm installed on your system
• Internet access to install npm packages

Manual installation steps:

1. Install the server globally via npm:

npm install -g @burtthecoder/mcp-virustotal

2. Add to your Claude Desktop configuration (example):

{
  "mcpServers": {
    "virustotal": {
      "command": "mcp-virustotal",
      "env": {
        "VIRUSTOTAL_API_KEY": "your-virustotal-api-key"
      }
    }
  }
}

3. If you run from source instead:

git clone <repository_url>
cd mcp-virustotal
npm install
npm run build

4. Start in standard stdio mode (default) or in HTTP streaming mode by setting MCP_TRANSPORT as needed. For HTTP streaming, see the Environment Variables section and docker instructions in the project README.

Notes and tips:

• Always provide VIRUSTOTAL_API_KEY to enable API access.
• The server supports HTTP streaming mode via MCP_TRANSPORT=httpStream; in this mode, MCP_PORT controls the listening port and MCP_ENDPOINT sets the HTTP path (default /mcp).
• When running in HTTP streaming mode, health is exposed at /health to indicate readiness.
• If you deploy via Docker, build the image with the repository and run with -e VIRUSTOTAL_API_KEY and optional MCP_TRANSPORT settings.
• For VS Code integration, ensure your mcp.json is configured with the correct command and environment variables for virustotal.
• The npm package name is @burtthecoder/mcp-virustotal; use npx or npm -g as preferred to run the server.