VirusTotal AI (VTAI)

VTAI brings VirusTotal threat intelligence into AI agent workflows. It lets your agent check files, links and infrastructure, submit files for analysis, and act on the resulting evidence — either through the Model Context Protocol (MCP) or a direct REST API.

VTAI offers free access within quotas and does not require a VirusTotal API key to get started.

📘
Which entry point do I use?

VTAI (ai.virustotal.com) — agent-first. Keyless onboarding, MCP tools, Bearer token. Best for AI clients and autonomous agents. (This page.)

Classic VirusTotal API — programmatic REST with an x-apikey header. See the API Overview.

These are different doors to VirusTotal intelligence; pick the one that matches how you integrate.

What you can do

Check an indicator — look up existing reports for a file hash, URL, domain or IP address. Hash lookups do not upload files.
Analyze a file — submit a file and keep its SHA-256 and receipt.
Resume an analysis — recover a receipt or read an analysis ID without resending the file.

MCP tools

VTAI exposes a small, common set of MCP tools:

get_file_report
get_url_report
get_domain_report
get_ip_report
submit_file
get_submission
get_analysis

The stdio transport additionally exposes submit_local_file for submitting files from the local machine.

📘
Submission limits
Inline submissions accept up to 24,000,000 decoded bytes. Local file submissions (stdio) accept up to 32,000,000 bytes.

Supported clients and integrations

MCP clients: Claude Code, Codex (over HTTP or stdio), and Agy (Antigravity CLI).
Plugins: VT Sentinel for the Google Antigravity IDE, OpenClaw, and Hermes (file/hash reputation tools).

Direct API

For API-only use, register once, reuse the token, and query the REST API with a Bearer token. The base URL is https://ai.virustotal.com:

GET https://ai.virustotal.com/api/v3/domains/virustotal.com
Authorization: Bearer <VTAI token>

Getting started and reference

Product home: https://ai.virustotal.com
Installation guide: https://ai.virustotal.com/install.md
Agent overview manifest: https://ai.virustotal.com/llms.txt
API quickstart: https://ai.virustotal.com/skills/BASIC.md
API reference: https://ai.virustotal.com/docs
OpenAPI schema: https://ai.virustotal.com/openapi.json

❗️
Absence of evidence is not evidence of safety
A missing report, a pending analysis, or zero detections is not a guarantee that an item is safe. Keep analysis dates and coverage alongside your evidence when acting on VTAI results.