VirusTotal MCP: threat reports without leaving your AI app

Connect VirusTotal to your AI app

1. 1Click Connect VirusTotal free and sign in with your VirusTotal account.
2. 2Reports and searches only read. Uploading a file sends its contents to VirusTotal, and comments and votes add your team's verdict to a resource, so switch those off if you only want lookups.
3. 3Add ContextGate to your AI app as a connector or MCP server. The steps for each app are on the Works with page.
4. 4Paste a file hash into your AI app and ask for VirusTotal's report on it, then open Activity to see the call.

Threat lookups from Claude, ChatGPT or Cursor

• Get the analysis report for a file hash, URL, domain or IP address, including reputation and stats.
• Submit a URL or file for scanning and fetch the report when the analysis is done.
• Explore what a domain or IP is related to, such as connected files and URLs.
• Read the community's comments and votes on a resource.

Keep investigations contained

• Switch off file uploads so internal files aren't sent to VirusTotal by mistake.
• Switch off comments and votes; your AI app can read the community's view without adding to it.
• Activity records every lookup, which gives your security team a trail of what was checked.

What you get with VirusTotal and ContextGate

• Your AI apps can use VirusTotalClaude, Cursor, ChatGPT and other AI apps reach VirusTotal through the one ContextGate connection you add to them.
• You choose which tools they can useSwitch off any VirusTotal tool you don't want used. It's hidden from your AI apps and refused if called.
• Every call is checked and recordedYour policies check each call (for example, personal data is hidden and secrets are blocked), and Activity keeps a record of it.

ContextGate sees only the tool calls that go through it, not your AI app's built-in tools or your chats.

VirusTotal tools

Examples of what your AI apps can do in VirusTotal. You'll see the exact list of tools after you connect it.

• Get Analysis ReportTool to retrieve the analysis report of a file or url submission. use after obtaining an analysis id to fetch its detailed report.
• Get Domain ReportTool to retrieve the analysis report of a domain. use when you need detailed insight on a domain's reputation and analysis stats.
• Get File ReportTool to retrieve the analysis report of a file. use when you have a file's hash and need detailed scan metadata.
• Get IP Address ReportTool to retrieve the analysis report of an ip address. use when you need detailed insight on an ip's reputation, asn, country, and analysis stats.
• Get VirusTotal MetadataTool to retrieve virustotal metadata. use when you need to list all available api endpoints with methods, summaries, and urls.
• Get URL ReportTool to retrieve the analysis report of a url. use when you have a url identifier (base64-url without padding) and need detailed scan results, reputation, and metadata.
• Rescan FileTool to re-analyze a previously submitted file. use when you need updated analysis results after an initial scan.
• Scan URLTool to submit a url for scanning. use when you have a url and need to submit it to virustotal to obtain an analysis id for later retrieval.
• Search VirusTotalTool to search for objects in the virustotal database. use when locating files, urls, domains, ips, or comments matching a query. supports pagination with limit and cursor.
• Upload FileTool to upload a file for scanning. use when you have binary file content ready to submit for virustotal analysis.
• Add VirusTotal CommentTool to add a comment to a virustotal resource (file, url, domain, or ip address). use after analyzing a resource to leave contextual feedback. provide exactly one identifier per call.
• Add VoteTool to add a vote (harmless/malicious) to a virustotal resource. use after reviewing analysis results to submit your verdict.
• Get commentsTool to retrieve the latest comments on a virustotal resource. use when you need to review user-generated comments for a file, url, domain, or ip after obtaining its identifier.
• Get Domain RelationshipsTool to retrieve relationship objects for a given domain. use when you have a domain and need to explore its related entities.
• Get IP Address RelationshipsTool to retrieve objects related to a specific ip address by relationship type. use when you have an ip and need to explore connected files, urls, or other entities.
• Get VotesTool to retrieve votes on files, urls, domains, or ip addresses. use when you need to view community votes for a given object.