VirusTotal

liveSecurity

File, URL, domain, and IP reputation across 70+ AV engines. BYO key (free tier 4 req/min, 500/day).

4tools
0msauth
free tier50 calls/day
🔑Authentication

BYO key only — free tier is tight (4 req/min, 500/day). Pass _apiKey on the gateway URL.

Config with credentials
{
  "mcpServers": {
    "pipeworx-virustotal": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://gateway.pipeworx.io/virustotal/mcp?_apiKey=your_vt_key"
      ]
    }
  }
}

Get an API key →

Tools

lookup_filerequired: hash

Look up a file by hash (sha256, sha1, or md5). Returns last-analysis stats (malicious / suspicious / harmless / undetected detector counts), type description, size, names seen, and tags. Useful for tr

Parameters
NameTypeDescription
hashreqstringSHA-256 / SHA-1 / MD5
▶Try it
lookup_urlrequired: url

Look up a URL's reputation. Returns last-analysis stats across all engines, categories (per vendor), and whether the URL has been redirected. The URL is canonicalized before lookup; no submission step

Parameters
NameTypeDescription
urlreqstringFull URL including scheme
▶Try it
lookup_domainrequired: domain

Look up a domain's reputation via VirusTotal (no scheme, e.g. "example.com"). Returns engine analysis stats (malicious/suspicious/harmless/undetected counts and percent), reputation score, community v

Parameters
NameTypeDescription
domainreqstringFQDN, no scheme
▶Try it
lookup_iprequired: ip

Look up an IPv4 address. Returns last-analysis stats, ASN/owner, country, network range, and reputation score.

Parameters
NameTypeDescription
ipreqstringIPv4 address
▶Try it

Test with curl

The gateway speaks JSON-RPC 2.0 over HTTP POST. You can test any pack directly from the terminal.

List available tools
bash
curl -X POST https://gateway.pipeworx.io/virustotal/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
Call a tool
bash
curl -X POST https://gateway.pipeworx.io/virustotal/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"lookup_file","arguments":{"hash": "example"}}}'

Use with the SDK

Install @pipeworx/sdk to call tools from any TypeScript/Node project.

TypeScript
import { Pipeworx } from '@pipeworx/sdk';
const px = new Pipeworx();
const result = await px.call("lookup_file", {"hash":"example"});
ask_pipeworx
// Or ask in plain English:
const answer = await px.ask("file, url, domain, and ip reputation across 70+ av engines");