Virustotal

@virustotal check the reputation of example-malware.com and show me the latest detection stats

Based on VirusTotal's domain report, example-malware.com has been flagged by 42 of 89 security vendors. Last analysis date: 2024-01-15. Categories include phishing (18 vendors) and malware distribution (24 vendors). The domain has 3 known subdomains and 127 communicating files in the past 30 days. Reputation score: -85 (malicious). This illustrative example shows how the MCP surfaces aggregated threat intelligence from multiple antivirus engines and URL scanners.

This example uses the Get Domain Report tool to fetch reputation data. Requires a valid API key with domain lookup permissions. Detection counts and categories reflect real-time vendor updates—results change as threat intelligence evolves. Free-tier API keys are rate-limited to 4 requests/minute.

@virustotal I analyzed suspicious-file.exe (SHA256: a1b2c3...) and confirmed it's a false positive—add a comment explaining it's a legitimate installer

Comment successfully added to file resource a1b2c3d4e5f6... on VirusTotal. Your note 'Confirmed false positive: legitimate installer for XYZ Software v2.1, signed by trusted publisher' is now visible to the community. This illustrative example demonstrates how the MCP enables collaborative threat analysis by letting you contribute context to shared intelligence feeds.

This example uses the Add VirusTotal Comment tool to post feedback on a file hash. Requires authentication and assumes you've already retrieved the file's analysis. Comments are public and permanent—use carefully in production environments. Side-effect: your account name appears alongside the comment in VirusTotal's interface.

@virustotal pull all related URLs and communicating files for IP address 203.0.113.45, then summarize any patterns suggesting botnet activity

Retrieved 23 related URLs and 14 communicating files for IP 203.0.113.45. Analysis shows: 18 of 23 URLs share identical URI path structure (/api/c2/beacon), 11 files exhibit common packer signatures (UPX), and 9 URLs were first seen within a 72-hour window in December 2024. Pattern suggests coordinated command-and-control infrastructure. This illustrative example shows how the MCP's relationship data enables the AI to identify behavioral indicators across linked resources.

This example combines the Get IP Address Relationships tool with AI reasoning to detect threat patterns. Relationship queries can return large datasets—responses may be truncated or paginated depending on API tier. Requires IP lookup permissions. Use this workflow when investigating infrastructure rather than isolated indicators.

When VirusTotal MCP speeds up malware ticket triage

A 6-person customer support team handling 40+ security tickets daily needs to quickly assess whether a flagged file or URL is actually malicious before escalating to engineering. The VirusTotal MCP wins here because the Get File Report and Get Domain Report tools pull multi-engine scan results in seconds, letting support agents make confident triage calls without waiting on internal security tooling. The Add Vote and Add Comment tools let the team build institutional knowledge directly in VirusTotal, so future tickets referencing the same hash skip the research step entirely. This setup breaks down if your team handles proprietary binaries or internal-only URLs—VirusTotal's public database won't have coverage, and you'll need a private sandbox instead. If 80% of your tickets involve public-facing threats (phishing links, known malware families), this MCP cuts triage time in half.

How a 3-person SOC uses this for domain pivoting

A startup's 3-person security operations team investigates a suspicious domain flagged by their SIEM and needs to map its infrastructure before deciding whether to block it network-wide. The Get Domain Relationships and Get IP Address Relationships tools let them pivot from one indicator to connected files, subdomains, and hosting IPs without leaving Switchy, building a threat graph in minutes instead of hours of manual lookups. The Get Comments tool surfaces context from the security community—if another analyst already documented this as a false positive or part of a known campaign, the team saves the investigation cycle. This approach hits limits around 10+ pivots per incident; VirusTotal's API rate limits and the MCP's 16-tool scope mean deep infrastructure mapping still needs dedicated threat intel platforms. For initial scoping and deciding whether to escalate, this MCP is the right first move.

When this MCP handles employee-reported phishing URLs

A 12-person IT helpdesk at a 200-employee company processes 5-10 employee-reported phishing emails per week and needs a repeatable workflow to verify URLs before sending company-wide warnings. The Get Analysis Report tool lets helpdesk staff submit a suspicious link and retrieve its scan verdict in under a minute, while the Add VirusTotal Comment tool documents internal handling notes ("reported by finance team, blocked at proxy") for audit trails. This beats forwarding every report to a security vendor or waiting on manual sandbox analysis. The workflow breaks if employees report internal application URLs or password-reset links from legitimate SaaS tools—VirusTotal flags anything it hasn't seen before, creating false-positive noise. If your phishing reports are 90% external threats (fake invoices, credential harvesting), this MCP turns a 20-minute investigation into a 2-minute ticket close.