MCP server exposing 4 tools for virustotal.
This URL is a JSON-RPC 2.0 endpoint over HTTP. Issue POST requests with a JSON-RPC body. Browsers and search crawlers land here on GET.
POST https://gateway.pipeworx.io/virustotal/mcp
Content-Type: application/json
{"jsonrpc":"2.0","id":1,"method":"tools/list"}lookup_file — Look up a file by hash (sha256, sha1, or md5). Returns last-analysis stats (malicious / suspicious / harmless / undetected detector counts), type description, size, names seen, and tags. Useful for triaging hashes seen in alerts or logs.lookup_url — Look up a URL's reputation. Returns last-analysis stats across all engines, categories (per vendor), and whether the URL has been redirected. The URL is canonicalized before lookup; no submission step is required to read existing reports.lookup_domain — Look up a domain's reputation via VirusTotal (no scheme, e.g. "example.com"). Returns engine analysis stats (malicious/suspicious/harmless/undetected counts and percent), reputation score, community votes, tags, last-analyzed date, and a link to the VirusTotal GUI report.lookup_ip — Look up an IPv4 address. Returns last-analysis stats, ASN/owner, country, network range, and reputation score.Code samples (curl / TypeScript / one-click client install), schemas, and the live playground are on the pack page:
https://pipeworx.io/packs/virustotal/
Pipeworx is an open MCP gateway connecting AI agents to live data. pipeworx.io