{"id":"virustotal-api","name":"VirusTotal API","homepage":"https://developers.virustotal.com","repo_url":"https://github.com/VirusTotal/vt-py","category":"security","subcategories":["malware-analysis","threat-intelligence","url-scanning","file-analysis"],"tags":["virustotal","malware","threat-intelligence","url-scanning","file-hash","security","rest-api","mcp-server","sdk"],"what_it_does":"Aggregates antivirus scan results from 70+ engines for files, URLs, domains, and IP addresses. Provides threat intelligence, behavioral analysis, and community-driven reputation data.","use_cases":["Scanning URLs and files for malware before processing in agent pipelines","Enriching security incidents with multi-engine threat verdicts","Lookups of file hashes (MD5/SHA1/SHA256) against known malware database","Domain and IP reputation checks in email security or web filtering workflows","Automated triage of suspicious artifacts in SOC automation"],"not_for":["Real-time endpoint protection (analysis takes time, not inline blocking)","Submitting private/confidential files (all submissions become publicly visible)","High-volume automated scanning on free tier (strict rate limits)","Definitive verdicts — single false positives are common from some AV engines"],"best_when":"A security agent needs to quickly check whether a file hash, URL, domain, or IP is known-malicious against a broad set of AV engines and threat intelligence sources.","avoid_when":"You need to submit confidential files (they become public), or need real-time inline blocking.","alternatives":["shodan-api","abuseipdb-api","haveibeenpwned-api"],"af_score":76.0,"security_score":80.0,"reliability_score":null,"package_type":"mcp_server","discovery_source":["github"],"priority":"low","status":"evaluated","version_evaluated":"current","last_evaluated":"2026-03-01T09:50:06.372482+00:00","performance":{"latency_p50_ms":500,"latency_p99_ms":5000,"uptime_sla_percent":99.9,"rate_limits":"4 req/min, 500/day on free; much higher on premium","data_source":"llm_estimated","measured_on":null}}