官方 VirusTotal MCP 服务器：针对 AI 代理：威胁情报、文件分析及通过 VTAI 恢复。
概览
官方的 VirusTotal MCP 服务器在您的代理开启链接、运行下载文件或调查可疑基础设施之前，提供威胁情报。连接 MCP 客户端与 VTAI，提供文件、URL、域名和 IP 地址的报告、文件和网络分析提交以及收据恢复。 请使用免费的VTAI服务及其当前的访问权限限制。您不需要自己的VirusTotal API密钥。 在兼容的远程MCP客户端中使用。用你的VTAI账户登录并批准连接权限;无需本地Python安装、静态令牌或个人VirusTotal API密钥。 官方插件包含 OAuth 连接、威胁情报技能以及本地文件上传功能，无需模型生成的 base64。 需要 Claude 代码，并且在其 PATH 上。Node.js 22 和 24 由插件 CI 验证。该插件包括 https://ai.virustotal.com/mcp.
概述（AI 翻译）
官方的 VirusTotal MCP 服务器会在您的代理开启链接、运行下载文件或调查可疑基础设施之前，提供威胁情报。vt-mcp 将 MCP 客户端连接到 VTAI，提供文件、URL、域名和 IP 地址的报告、文件和网络分析提交以及收据恢复。
请使用免费的VTAI服务及其当前的访问权限限制。您不需要自己的VirusTotal API密钥。
远程连接OAuth
在兼容的远程MCP客户端中使用**https://ai.virustotal.com/mcp**。登录
使用你的 VTAI 账户并批准连接权限;不使用本地 Python
需要安装、静态令牌或个人 VirusTotal API 密钥。
Claude 代码：安装插件
官方插件包含 OAuth 连接，这是一种威胁情报技能 以及本地文件上传，无需模型生成的 base64。
需要在 PATH 上使用 Claude Code 2.1.283 或更高版本 和 Node.js 22.22 或更高版本。Node.js 22 和 24 由插件 CI 验证。该插件包含 https://ai.virustotal.com/mcp。
如果你用插件替换已有的手动连接，请阅读 迁徙与恢复指南 在移除任何东西之前。
本页由 AI 翻译，技术细节请以原文为准。
README
以下为原文 README 节选，完整内容请查看原文。
VirusTotal MCP
The official VirusTotal MCP server gives your agent threat intelligence before it opens a link, runs a downloaded file or investigates suspicious infrastructure. vt-mcp connects MCP clients to VTAI, with reports for files, URLs, domains and IP addresses, file and network analysis submission, and receipt recovery.
Use the free VTAI service with its current access limits. You do not need your own VirusTotal API key.
Connect remotely with OAuth
Use https://ai.virustotal.com/mcp in a compatible remote MCP client. Sign in
with your VTAI account and approve the connection’s permissions; no local Python
installation, static token or personal VirusTotal API key is required.
Claude Code: install the plugin
The official plugin includes the OAuth connection, a threat-intelligence skill and local file uploads without model-generated base64.
claude plugin marketplace add VirusTotal/virustotal-mcp
claude plugin install virustotal@virustotal
Requires Claude Code 2.1.283 or later and Node.js 22 or later on its PATH. Node.js 22 and 24 are verified by the plugin CI. The plugin includes https://ai.virustotal.com/mcp.
If you are replacing an existing manual connection with the plugin, read the migration and recovery guide before removing anything. Recover uncertain submissions through the original connection first; keep a working manual connection if you choose that alternative.
Start a new session or use /reload-plugins, then /mcp to complete browser
sign-in when needed. The plugin already supplies the MCP connection; do not add
a duplicate. See plugin setup, file access and credential-name protection.
Claude Code alternative: manual HTTP without Node.js
For report lookups without the local upload hook, use the direct connection:
claude mcp add --transport http virustotal https://ai.virustotal.com/mcp
Open Claude Code, run /mcp, select virustotal and complete browser sign-in.
See the Claude Code OAuth instructions
and the VirusTotal connection guide.
Choose this alternative or the plugin. Adding a server configures it; complete authentication and a tool call to check
that your connection works.
OAuth connections share the signed-in VTAI account’s free quota and use the permissions approved for each connection. Existing Agent Tokens keep their rights and quotas. If your client needs configurable HTTP headers, use one protected
安装
This server does not publish a one-line install command.
Open the repository installation guide 新手？先看 mcpskill.org 教程 →配置
{
"mcpServers": {
"virustotal": {
"command": "vt-mcp",
"args": [],
"env": {
"VTAI_TOKEN_FILE": "~/.config/vt-mcp/token"
}
}
}
}