VirusTotal MCP connector
The VirusTotal connector lets Claude, ChatGPT, Cursor, any MCP client, and the Elaichi Agent look up files, domains, and IP addresses in VirusTotal, request rescans, and leave comments and votes, all under each analyst's own access with every call logged.
-
How it connects. Connects with an API key. The credential goes into a vault nobody reads back.
-
One address. https://api.elaichi.ai/mcp, the same for every user.
-
Their own access. An agent never gets more than the person it acts for.
150 tools
How to connect
How to connect VirusTotal to Claude, ChatGPT or Cursor
Two steps, about a minute.
In Elaichi
Connect VirusTotal once
-
Open Connections, choose Add connection, and pick VirusTotal.
-
Optionally set Share with to give a team access, then press Connect.
-
Paste a VirusTotal API key. One person generates a token in VirusTotal and pastes it once. Everyone else works through Share with, and never sees it.
The credential is vaulted. Nobody reads it back, not even the AI.
Add connection
Choose a connector.
In your AI client
Point it at one endpoint
Everyone in the organization uses the same address, and each person only ever reaches what their own account allows.
VirusTotal MCP connector for Claude
-
1
Open Customize, then Connectors.
-
2
Press Add.
-
3
Name it, paste the MCP server URL, then Continue.
https://api.elaichi.ai/mcp -
4
Sign in and approve.
On Team and Enterprise, an Owner adds it once. Everyone else turns it on for themselves.
VirusTotal MCP connector for ChatGPT
-
1
Open Plugins, then press the + button.
-
2
Name it and paste the endpoint into Server URL.
https://api.elaichi.ai/mcp -
3
Leave Authentication on OAuth, then tick the risk acknowledgement.
-
4
Press Create, then sign in and approve.
Works on the web today. The plugin directory lives at chatgpt.com/plugins.
VirusTotal MCP connector for Cursor
-
1
Open
~/.cursor/mcp.json. -
2
Add the endpoint under
mcpServers.https://api.elaichi.ai/mcp -
3
Reload Cursor, then sign in and approve.
~/.cursor/mcp.json
{
"mcpServers": {
"elaichi": {
"url": "https://api.elaichi.ai/mcp"
}
}
}
Set up per machine, so repeat it on each computer you work from.
Connect VirusTotal to any MCP client
-
1
Add the endpoint as a remote MCP server.
https://api.elaichi.ai/mcp -
2
Sign in and approve.
{
"mcpServers": {
"elaichi": {
"url": "https://api.elaichi.ai/mcp"
}
}
}
The Elaichi Agent already has these tools, with nothing to set up.
Use cases
What teams do with VirusTotal through Elaichi
Every one of these runs inside the access the person already has, and lands in the same audit log.
-
Security operations
Check a suspicious sender domain fast
Paste the domain from a phishing report and ask what VirusTotal knows about it, including detection results, related IP addresses, and what other analysts have said in comments.
-
Incident response
Pull the report for a file hash
During an incident, give the agent a file hash and get the VirusTotal report back in plain language, then ask for a fresh rescan if the last analysis is stale.
-
Threat intelligence
Trace where a domain has resolved
Ask which IP addresses a domain has pointed to and what else sits on those addresses, so an analyst can map infrastructure without clicking through each resolution by hand.
-
IT help desk
Vet an attachment before opening it
A staff member forwards an unfamiliar attachment, and the desk uploads it to VirusTotal through the agent and gets back a verdict before anyone opens the file.
-
Security operations
Record findings on an indicator
After an investigation, leave a comment and cast a vote on the IP address, domain, or file in VirusTotal so the next analyst who lands on it sees the conclusion.
-
Risk and compliance
Screen a vendor's public footprint
Before onboarding a vendor, ask for the VirusTotal standing of their domains and hosting IP addresses and get a short summary suitable for the risk file.
Try asking
- “Check the reputation of this ip address before we allowlist it.”
- “Summarize recent comments on this domain's VirusTotal record.”
- “List relationships for this file hash reported this week.”
Compare
Elaichi vs Zapier MCP vs Composio for VirusTotal
All three can connect VirusTotal to an AI assistant, and all three have admin controls. They differ in where access lives and how you pay.
| What to check | Elaichi | Zapier MCP | Composio |
|---|---|---|---|
| Where the AI connects |
One address for the whole organization.
https://api.elaichi.ai/mcp
|
A server per member, created at sign-in. | An MCP endpoint per team, or an SDK. |
| Control over VirusTotal tools | Allow or restrict single VirusTotal tools, per role or user. | App and action restrictions on the account. | Role permissions, down to the action. |
| Record of calls | One audit entry per VirusTotal call. | A History tab of tool calls. | A log of every tool call. |
| Single sign-on | SAML or OIDC, plus SCIM, on Gold. | SAML on Enterprise. | SAML and OIDC on Enterprise. |
| Price | $15 per user per month. | 2 tasks per successful call. | Billed per tool call. |
Sources: Zapier MCP docs, security, usage; Composio docs, gateway, enterprise, pricing. Checked September 2026.
Longer take: Zapier MCP alternative and when you don't need an MCP gateway.
AI tools
VirusTotal tools for your AI agents
150 tools are ready to call through Elaichi's MCP endpoint the moment you connect VirusTotal, governed by the same roles, restrictions, and audit log as everything else in Elaichi.
No tools match your search.
See it in Elaichi
What connecting VirusTotal gets you
6 screens from the product, each doing one job for your VirusTotal account.
The agent
Ask VirusTotal questions, get live threat answers.
Ask about an ip, domain or file and get answers pulled from live VirusTotal records.
- domains
- ip addresses
- comments
- relationships
Ask Elaichi to work across your apps.
Check the reputation of this ip address before we allowlist it.
Summarize recent comments on this domain's VirusTotal record.
List relationships for this file hash reported this week.
Also runs in Claude, ChatGPT or Cursor
MCP clients
One VirusTotal endpoint for every client.
Claude, ChatGPT and Cursor connect to one governed VirusTotal endpoint, no SDK, no shared key.
ElaichiMCP clientsClaude
ChatGPT
Cursor
Copy the endpoint
Tool catalog
150 VirusTotal tools, zero custom code.
Browse 150 VirusTotal tools covering ip addresses, domains, comments and relationships.
- List all VirusTotal IP addresses
- VirusTotal IP addresses rescan
- VirusTotal IP addresses list comments
- VirusTotal IP addresses create comment
ElaichiToolsToolboxes
Every team gets its own VirusTotal toolbox.
Security, IT and fraud teams each work from a toolbox scoped to their needs.
- Security operations
- Threat intel
- IT
- Fraud
ElaichiToolboxesShared connections
Delegated VirusTotal access, no shared credentials.
See who connected each VirusTotal account and how many teams and members share it.
- Security Ops
- Threat Intel
- IT Support
- Fraud Review
ElaichiConnectionsAudit log
Every VirusTotal lookup, logged and attributable.
See who queried what, when, and against which ip, domain or file.
- When
- Who
- What happened
- Type
ElaichiAudit logLaunching soon
From answering questions to doing the work
A person no longer has to ask. A trigger starts the work, inside the same permissions and the same audit log as everything else. Automations and live dashboards are launching soon, on the Black plan.
Automations
VirusTotal triggers real work, not just chat.
A schedule fetches records, drafts a digest, and waits for approval before posting back.
VirusTotal digest
Run 418 · started 2 minutes ago · on behalf of Emily Carter
-
✓
Schedule
Every weekday at 8:00 AM
0.2s -
✓
Fetch domains
VirusTotal
1.4s -
✓
Group by owner
Transform
0.1s -
✓
Draft the digest
Agent step
Ran with 4 tools, returned a structured summary
6.2s -
Approve the digest
Needs approval
Assigned to Michael Brennan
Approve Deny -
Post the digest
VirusTotal
Queued
Collections and dashboards
VirusTotal health, computed, not requested.
A refreshing dashboard tracks records created over 14 days by team, no model involved.
VirusTotal health
Refreshed 4 minutes ago · every 15 minutes · from the domains collection
Domains
1,284 ↓ 12%
Ip addresses
96 ↓ 8%
Needs attention
3 ↑ 2
Updated this week
412 ↑ 9%
Domains created
Last 14 days
By team
Share of activity
Security Ops 34%
Threat Intel 27%
IT Support 21%
Fraud Review 18%
Related connectors
More from the catalog
FAQ
Frequently asked questions
How do I connect VirusTotal to Claude?
Connecting VirusTotal to Claude takes two steps. In Elaichi, pick VirusTotal from the catalog and paste in your VirusTotal API key, which you copy from your VirusTotal account settings; there is no client ID or secret to generate. Then in Claude open Customize, then Connectors, then Add, and paste the endpoint https://api.elaichi.ai/mcp. Sign in with your Elaichi account and VirusTotal is available to Claude.
Does VirusTotal work with ChatGPT and Cursor as well as Claude?
Yes. Once VirusTotal is connected in Elaichi, the same endpoint, https://api.elaichi.ai/mcp, works in Claude, ChatGPT, Cursor, any other MCP client, and the Elaichi Agent. You connect VirusTotal once and every client you use picks it up.
What can an AI agent actually do with my VirusTotal data?
With VirusTotal connected, an agent can look up an IP address, domain, or file hash and explain the detection results, list what a domain resolves to and what else lives on an address, read and add analyst comments, cast votes, request a rescan, and upload a file for analysis. Because VirusTotal offers a large set of actions, short concrete asks work best, such as the domain or hash followed by what you want to know.
Does connecting VirusTotal give the AI everything in my VirusTotal account?
No. Every call to VirusTotal runs with the API key of the person who connected it, so the agent can only reach what that VirusTotal account already can, at that account's quota and privilege level. Elaichi can narrow that further with restrictions on specific actions, and it never widens access beyond what VirusTotal itself allows.
Can I stop an agent from changing things in VirusTotal?
Yes. Restrictions in Elaichi work per action, so you can allow lookups on files, domains, and IP addresses in VirusTotal while blocking uploads, comments, votes, or rescans. A blocked action is never shown to Claude, ChatGPT, Cursor, or any other client at all, so no prompt, however worded, can reach it.
What happens to a VirusTotal connection when someone leaves?
When you offboard a person in Elaichi, their access to VirusTotal through Elaichi ends at once, in every client they had set up. A shared VirusTotal connection keeps working for everyone else on the team. If you want VirusTotal gone entirely, disconnecting it once in Elaichi removes it from Claude, ChatGPT, Cursor, and every other client in one step.
Does the VirusTotal MCP connector work with Gemini, Codex, Claude Code or other MCP clients?
Yes. VirusTotal is reached over the same MCP endpoint every client uses, so anything that speaks MCP can call it — Gemini, Codex, Claude Code, Windsurf, Cline, Zed and OpenCode among them — alongside Claude, ChatGPT, Cursor, and the Elaichi Agent. The tools on offer and the access behind them are identical whichever client asks. Only the setup screen differs.
Is Elaichi an alternative to Zapier MCP for VirusTotal?
Yes. Both let Claude, ChatGPT or Cursor use VirusTotal. Zapier MCP fits a team that already automates in Zapier, since each person signs in and acts as themselves in that account. Elaichi fits when IT wants one address for the whole company, per-tool rules by role, and a record of every VirusTotal call.
How is Elaichi different from Composio for VirusTotal?
Composio gives AI agents tools and sign-in handling across 1,000+ apps, for developers building agents or people using an assistant, billed per tool call. Elaichi gives a company's own people governed access to VirusTotal: one address, restrictions per role or user, and $15 per user per month. Both have role permissions and a log of every call.
Put VirusTotal in front of your team
14 days on Gold, no credit card. Connect it once and pick what each team can call.
- Works with
-
and any other MCP client, or the Elaichi Agent.
- When the trial ends
- Nothing is deleted. Connections, roles and the audit log stay where they are, so subscribing picks up exactly where you left off.