VirusTotal MCP integration for AI agents.
Connect AI agents to VirusTotal through 16 structured actions, including get analysis, add comment, and rescan file. Review authentication, inputs, workflows…
- ACTION CONTRACTS
- 16
- AUTHENTICATION
- API key
- SOURCE STATUS
- Provider-backed
CATALOG SOURCE REVIEWED AUGUST 23, 2026 / ACTION NAMES AND SCHEMAS DERIVED FROM WORKING MACHINES PROVIDER SOURCE
CAPABILITY PROFILE
What the VirusTotal integration exposes
The VirusTotal Agent App exposes 16 provider-backed actions for security and data work. Its current contract lets an authorized agent retrieve a virustotal analysis object by analysis id, add a community comment to a file, url, domain, or ip address in virustotal, and request a fresh virustotal analysis for a previously submitted file. These operations are called through Working Machines as typed capabilities rather than through browser navigation or copied UI steps.
A connection uses API key. Before execution, the agent can inspect the selected action, its required fields, declared scopes, and expected output contract. Provider credentials remain inside the Working Machines runtime; the calling agent receives the capability and its structured result, not the underlying secret.
For reliable operation, start with the narrowest action that satisfies the task, resolve stable provider identifiers before changing state, and validate the returned object or status after execution. Availability still depends on the connected VirusTotal account, granted provider permissions, workspace policy, region, plan, and upstream API behavior.
VERIFIED ACTION SAMPLE
Real VirusTotal capabilities.
Showing 12 of 16 actions. Risk labels are conservative signals based on operation names, not substitutes for provider documentation or runtime policy.
get_analysisREADRetrieve a VirusTotal analysis object by analysis ID.
INPUTS: analysisId
add_commentWRITEAdd a community comment to a file, URL, domain, or IP address in VirusTotal.
INPUTS: fileId / url / urlId / domain / ipAddress
rescan_fileREVIEWRequest a fresh VirusTotal analysis for a previously submitted file.
INPUTS: fileId
add_voteWRITESubmit a harmless or malicious vote for a VirusTotal file, URL, domain, or IP.
INPUTS: fileId / url / urlId / domain / ipAddress
get_commentsREADRetrieve community comments for a file, URL, domain, or IP address in VirusTotal.
INPUTS: fileId / url / urlId / domain / ipAddress
get_domain_relationshipsREADRetrieve related VirusTotal objects for a domain, with an option to request descriptors only.
INPUTS: domain / relationship / limit / cursor / descriptorsOnly
get_domain_reportREADRetrieve the latest VirusTotal report for a domain.
INPUTS: domain
get_file_reportREADRetrieve the latest VirusTotal report for a file identifier.
INPUTS: fileId
get_ip_address_relationshipsREADRetrieve related VirusTotal objects for an IP address, with an option to request descriptors only.
INPUTS: ipAddress / relationship / limit / cursor / descriptorsOnly
get_ip_address_reportREADRetrieve the latest VirusTotal report for an IP address.
INPUTS: ipAddress
get_metadataREADRetrieve VirusTotal metadata, including available privileges, engines, and relationship names.
get_url_reportREADRetrieve the latest VirusTotal report for a URL using either a raw URL or a VirusTotal URL identifier.
INPUTS: url / urlId
INPUT CONTRACTS
Know what the action needs before it runs.
get_analysis
analysisIdOPTIONAL- Identifier of the analysis to retrieve.
add_comment
fileIdOPTIONAL- File identifier such as a SHA-256 hash.
urlOPTIONAL- Raw URL string that will be converted into a VirusTotal URL identifier.
urlIdOPTIONAL- VirusTotal URL identifier encoded as unpadded base64url.
domainOPTIONAL- Domain name to target.
ipAddressOPTIONAL- IPv4 or IPv6 address to target.
rescan_file
fileIdOPTIONAL- Identifier of the file to re-analyze.
add_vote
fileIdOPTIONAL- File identifier such as a SHA-256 hash.
urlOPTIONAL- Raw URL string that will be converted into a VirusTotal URL identifier.
urlIdOPTIONAL- VirusTotal URL identifier encoded as unpadded base64url.
domainOPTIONAL- Domain name to target.
ipAddressOPTIONAL- IPv4 or IPv6 address to target.
PROVIDER-SPECIFIC WORKFLOWS
Jobs this Agent App can support
Inspect Get Analysis
Retrieve a VirusTotal analysis object by analysis ID. Use this as a bounded discovery step, retain the returned identifier, and avoid expanding the read beyond the task's stated scope.
get_analysisControl Add Comment
Add a community comment to a file, URL, domain, or IP address in VirusTotal. Resolve the target first, present material changes for confirmation, and make retries idempotent where the provider supports it.
add_commentVerify with Get Comments
Retrieve community comments for a file, URL, domain, or IP address in VirusTotal. Compare the returned provider state with the intended outcome and preserve stable IDs or canonical links in the run record.
get_commentsSAFETY BOUNDARY
Operate VirusTotal with explicit limits
- Authorize VirusTotal with API key and grant only the provider access required by the selected actions.
- 3 actions are change-capable by name. Confirm the target identity and material parameters before allowing a write.
- Do not infer permission from catalog visibility. Workspace policy, connection identity, and upstream authorization still govern execution.
- No provider scope string is declared on the sampled actions. Verify the connected account's actual permissions in VirusTotal rather than assuming unrestricted access.
- After a call, inspect the structured result and execution record before reporting that the VirusTotal task completed successfully.
CONNECTION MODEL
API key
VirusTotal API key sent as the x-apikey header. Find it in your account user menu or at https://www.virustotal.com/gui/my-apikey, as documented at https://docs.virustotal.com/reference/authentication.
Working Machines stores provider credentials behind the execution boundary. An agent can use an authorized connection identity, but catalog discovery alone does not reveal OAuth tokens, API keys, or provider secrets.
- READ SIGNALS
- 11
- WRITE SIGNALS
- 3
- HIGH IMPACT
- 0
- REVIEW SIGNALS
- 2
EVIDENCE AND AVAILABILITY
Provider reference
Action names, input fields, authentication types, and counts on this page are generated from the Working Machines provider catalog. Provider behavior, quotas, object semantics, account eligibility, and regional availability remain governed by VirusTotal.