Awesome MCP › Security & Reverse Engineering

BurtTheCoder/mcp-virustotal

⭐ 149 TypeScript added to this list on 2025-05-14 repository created 2024-12-13

VirusTotal MCP Server exposes VirusTotal, the multi-engine malware and reputation scanning service, to MCP clients. Its tools take the four indicator types VirusTotal covers — a URL, a file hash, an IP address or a domain — and return the aggregated verdicts of the antivirus engines and reputation sources, along with the metadata VirusTotal holds. Two design choices go beyond a thin API wrapper. Relationship data is fetched automatically, so a report on a domain also brings back the associated files, resolutions and URLs that VirusTotal links to it, letting a model pivot across an investigation without a separate call for each edge. Pagination is handled explicitly, which matters because relationship sets on well-known indicators are large and would otherwise be truncated silently. The server is TypeScript, published on npm as @burtthecoder/mcp-virustotal, listed in the MCP registry and on Smithery, and requires a VIRUSTOTAL_API_KEY; the README gives one-line install commands for Claude Code, Codex CLI, Gemini CLI and Claude Desktop. The audience is incident responders and malware analysts who work in indicators of compromise and want the enrichment step — check this hash, then check what else it touches — driven conversationally.

https://github.com/BurtTheCoder/mcp-virustotal

mcpvirustotalmalware-analysisthreat-intelligenceiocsecuritytypescript