VirusTotal is a free online service that analyzes files and URLs for viruses, worms, trojans and other kinds of malicious content. It aggregates many antivirus products and online scan engines to check for threats that the user's own antivirus may have missed.
AI-powered OSINT framework exposing 10 tools (email, username, breach, WHOIS, IP, subdomain, phone, Shodan, dorks, Pastebin) as an MCP server for Claude Code and Claude Desktop, with an autonomous agent REPL and direct CLI.
Last updated
2
20
1,219
MIT
Why this server?
Enriches threat intelligence by querying VirusTotal for malware and reputation data (optional API key).
A universal digital fingerprinting MCP server that combines 103 techniques across TCP, TLS, SSH, HTTP, DNS, and more into a single interface for AI agents, enabling full-spectrum fingerprinting on demand.
Last updated
2
13
18
3
AGPL 3.0
Why this server?
Automatically routes requests to VirusTotal through Tor to anonymize the origin IP, as it is a default OSINT/security target.
Routes web requests from AI tools through Tor for anonymized fetching, with selective per-URL routing to bypass Tor-blocking sites.
Last updated
8
4
1
MIT
Why this server?
Enables querying VirusTotal/Google Threat Intelligence for file hash, URL, domain, and IP analysis, providing reputation data and threat intelligence reports.
Enables MCP clients to interact with SentinelOne's cybersecurity platform for security analysis, threat investigation, and asset management through natural language queries. Provides read-only access to alerts, vulnerabilities, misconfigurations, and inventory data.
Last updated
33
86
MIT
Why this server?
Provides tools for domain reputation analysis, threat detections, and subdomain enumeration by querying the VirusTotal API.
A comprehensive reconnaissance toolset that provides AI agents with 37 tools across 12 data sources like Shodan and VirusTotal for automated intelligence gathering. It enables agents to perform domain reconnaissance, attack surface mapping, and cross-platform data correlation within a single conversational interface.
Last updated
2
37
402
2
MIT
Why this server?
Enables virus and threat intelligence lookups (e.g., domain, IP, hash analysis) as part of Maltego investigations.
Turns an LLM into a Maltego CE investigation copilot, enabling AI-assisted OSINT investigations by building, analyzing, and exporting Maltego graph files.
Last updated
52
MIT
Why this server?
Allows enrichment of DNS security analysis with VirusTotal threat intelligence for domain and IP reputation checks.
Comprehensive DNS security toolkit for AI agents: 103 tools across 13 categories including DNSSEC validation, subdomain takeover detection, email security audit, and more, all running locally with no external API calls required.
Last updated
100
38
5
MIT
Why this server?
Provides definitive URL safety checks by querying VirusTotal's API, integrated in the linksafe tool.
An MCP server providing 22 pay-per-call utility tools for AI agents (scrape, validate, embed, store, moderate, notify, convert, prevent loops) without accounts or API keys, using USDC payments via the x402 protocol.
Last updated
17
50
1
MIT
Why this server?
Provides access to VirusTotal for analyzing files and URLs against a vast threat intelligence database, integrated into AI-driven security pipelines.
Enables AI agents to orchestrate security research workflows by connecting to containerized security tools via MCP, allowing automated vulnerability analysis and pipeline execution.
