Integration

VirusTotal integration

Threat intelligence and malware analysis platform. Build integrations for scanning files, analyzing URLs, checking IP addresses, and accessing comprehensive threat data from 70+ antivirus engines and security vendors. VirusTotal provides real-time threat detection and detailed analysis reports.

Connect VirusTotal How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in VirusTotal.Built from the 15 VirusTotal tools below, on the connection you add once.

Common VirusTotal use cases

IOC extraction
Threat research
Threat investigation
Incident response
Threat hunting
Malware detection
Monitor API usage
Phishing detection
Share threat intel
IP reputation check

What you can do with VirusTotal

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

File, 4 operations

get_file_behaviorGet file behaviorGETRetrieves sandbox behavioral analysis for a file.
get_file_reportGet file reportGETRetrieves the analysis report for a file by its hash.
rescan_fileRescan filePOSTRequests a new analysis of a previously submitted file.
scan_fileScan filePOSTUploads and scans a file for malware detection.

Comment, 2 operations

add_commentAdd commentPOSTAdds a community comment to a resource.
get_file_commentsGet file commentsGETRetrieves community comments and votes on a file.

Url, 2 operations

get_url_reportGet url reportGETRetrieves the analysis report for a URL.
scan_urlScan urlPOSTSubmits a URL for malware and phishing detection.

Analysis, 1 operation

get_analysisGet analysisGETRetrieves the status and results of a scan analysis by its ID.

Domain, 1 operation

get_domain_reportGet domain reportGETRetrieves threat intelligence and analysis for a domain.

Domain relationship, 1 operation

get_domain_relationshipsGet domain relationshipsGETRetrieves related objects for a domain.

Intelligence, 1 operation

searchSearchGETSearches VirusTotal's database using advanced query syntax.

Ip, 1 operation

get_ip_reportGet ip reportGETRetrieves threat intelligence and analysis for an IP address.

Quota, 1 operation

get_quotaGet quotaGETRetrieves API quota usage and limits.

Relationship, 1 operation

get_file_relationshipsGet file relationshipsGETRetrieves related objects for a file (domains, IPs, dropped files, etc.).

Use VirusTotal from Claude Code, Cursor or Codex

Connect VirusTotal in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its VirusTotal operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect VirusTotal

Create your workspace
Sign up free. Nothing to install.
Connect VirusTotal once
Add your VirusTotal connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

VirusTotal integration FAQ

What can you do with the VirusTotal integration?

LiveContext exposes 15 operations on VirusTotal, covering file, comment, url and analysis. Common uses include IOC extraction, Threat research and Threat investigation.