id

MCP tool from MCP Virustotal by w0h1v

(required): Collection ID (e.g. threat-actor--<uuid>, malware-family--<id>)

How to use it

id is exposed by the MCP Virustotal MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the id tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.

Install MCP Virustotal

$claude mcp add --transport stdio --env VIRUSTOTAL_API_KEY=your-key virustotal -- npx -y @burtthecoder/mcp-virustotal

FULL MCP VIRUSTOTAL LISTING

Other tools in MCP Virustotal (9)

cursor

(optional): Continuation cursor for pagination

domain

(required): Domain name to analyze

hash

(required): MD5, SHA-1 or SHA-256 hash of the file

(required): IP address to analyze

limit

(optional, default: 10): Maximum number of related objects to retrieve (1-40)

query

(required): Search query. Examples: a SHA-256 hash, evil.com, 8.8.8.8, type:peexe size:90kb+ tag:signed positives:5+

relationship

(required): Type of relationship to query

relationships

(optional): Array of specific relationships to include in the report

url

(required): The URL to analyze