← All integrations

VirusTotal MCP server

19 operations0 webhooks

Threat intelligence with VirusTotal - read file, URL, domain and IP reports with every engine verdict, rescan and submit indicators, poll analyses, and comment and vote on files and URLs.

Use VirusTotal in Claude, ChatGPT, Cursor or another MCP client

Connect VirusTotal once in Corsair, then add one MCP address to your agent.

Connect VirusTotal
Setup steps for Claude, ChatGPT, Cursor and Claude Code

Building your own app on the Corsair SDK? Get API keys

Try VirusTotal with your agent

Connect VirusTotal, then paste this into Claude, ChatGPT or Cursor. For ideas from other apps, see the use cases.

Using Corsair, show me what you can do in VirusTotal on my account, then run one read-only example and show me the result.

Runs once, when you ask

VirusTotal tools and triggers

Tools are what your agent can do in VirusTotal through Corsair's MCP server. Triggers are the VirusTotal events a routine can start from.

Files

  • Add CommentWrite

    Comment on a file publicly; a word starting with # becomes a tag, and only the author can delete it

    files.addComment

  • CommentsRead-only

    List the comments on a file, newest first, with cursor paging

    files.comments

  • GetRead-only

    Read a file report by SHA-256, SHA-1 or MD5, including every engine verdict and the malicious tally

    files.get

  • RescanWrite

    Ask VirusTotal to reanalyse a file already uploaded; answers an analysis id to poll, and counts against the scan quota

    files.rescan

  • VoteWrite

    Vote a file harmless or malicious as your account

    files.vote

  • VotesRead-only

    List the votes on a file with their verdicts

    files.votes

Urls

  • Add CommentWrite

    Comment on a URL publicly

    urls.addComment

  • CommentsRead-only

    List the comments on a URL, with cursor paging

    urls.comments

  • GetRead-only

    Read a URL report by the base64url identifier `urlId()` builds or the SHA-256 id a report returns; the base64url form carries the full URL to VirusTotal

    urls.get

  • RescanWrite

    Ask VirusTotal to reanalyse a URL already submitted

    urls.rescan

  • ScanWrite

    Submit a URL for analysis; it is added to the public dataset, answers an analysis id to poll, and cannot be withdrawn

    urls.scan

Comments

  • DeleteDestructive

    Permanently delete one of your own comments, which cannot be restored

    comments.delete

Connect VirusTotal to Claude, ChatGPT or Cursor

  1. 1

    Connect VirusTotal in Corsair

    Add your VirusTotal API key once in Corsair. Corsair stores the credential encrypted and makes the VirusTotal API calls for your agent, so it never goes into a prompt or a config file. Connect VirusTotal

    If your link lets the agent add apps, you can skip this: it gives you a sign-in link the first time it needs VirusTotal. On a ChatGPT personal plan, connect VirusTotal here first.

  2. 2

    Add Corsair's MCP server to your agent

    Every client uses the same address:

    https://mcp.corsair.dev/mcp
    Open Customize → Connectors → Add custom connector, paste the address, then select Connect.

    Codex, Gemini CLI, VS Code, Zed and other clients with OAuth sign-in work the same way. Clients without it, such as GitHub Copilot's coding agent, use a link's own address and an API key. Setup for every client

  3. 3

    Sign in and choose what needs your approval

    Your client opens Corsair to sign in. Pick a link: the apps your agent can use and a mode that decides what it may do without asking. In the default Cautious mode, VirusTotal's read and write operations run right away and its 1 destructive operation waits for your approval. Strict mode asks before every write and refuses destructive operations, and Read mode allows reads only.

FAQ

Install corsair and @corsair-dev/virustotal, add the VirusTotal plugin, and connect with an API key. Then call methods like corsair.virustotal.api.analyses.get() from your app. Corsair keeps each tenant isolated.

Yes. VirusTotal requires an API key from your VirusTotal account or developer dashboard. Create credentials with access that matches what you automate, then paste them into Corsair or connect through managed auth in Hub.

Yes. One Corsair client can hit VirusTotal, GitHub, Notion, Stripe, and the rest. Trigger VirusTotal from a webhook, push updates to Slack, or chain actions across plugins. Same tenant context across integrations, plain TypeScript.

Teams use Corsair for threat intelligence with VirusTotal - read file, URL, domain and IP reports with every engine verdict, rescan and submit indicators, poll analyses, and comment and vote on files and URLs. Common builds include sync jobs, admin tooling, and agents that call VirusTotal APIs from your backend.

The SDK is open source. Self-host and you pay Corsair nothing for the integration layer. Hub bills for hosted auth and execution, not per VirusTotal API call. Hub has a generous free tier. For hobby projects you can probably run the whole thing on free. Paid plans start to matter with more tenants or heavier traffic.

We maintain @corsair-dev/virustotal in the open repo. When VirusTotal ships API changes, upgrade the package. Your call sites stay typed. You should not need to rewrite the integration layer each time.

No. Corsair does not read your VirusTotal data or hold individual access credentials. Credentials stay in your database. API calls run on your instance. We do not store VirusTotal data on your behalf.

Yes. Add https://mcp.corsair.dev/mcp as a custom connector or MCP server in Claude, ChatGPT, Cursor, VS Code, Claude Code, Codex or any client that supports remote MCP servers with OAuth sign-in, then sign in to Corsair. On ChatGPT personal plans, custom servers currently get read tools only.

Yes. Put VirusTotal on a link in Strict mode and every write waits for your approval, while destructive actions are refused. The default Cautious mode asks only before the 1 destructive VirusTotal operation. You can change a link's mode at hub.corsair.dev/me.