Data & Analytics · Virustotal + Claude
VirusTotal MCP with Claude: Faster Threat Checks for Security Teams
The short answer
Claude works with VirusTotal through the Model Context Protocol (MCP), an open standard that lets Claude securely use outside software. Once connected with an API key, Claude can submit files or URLs for scanning, retrieve threat reports and analyse suspicious indicators, all through natural language. Your team controls what Claude can access and approves consequential actions.
What is Virustotal?
VirusTotal is a malware analysis service that checks files and URLs against dozens of antivirus engines. Individuals and organisations use it to quickly detect and investigate potential threats. Security analysts, IT administrators and incident responders often rely on it when a suspicious email attachment, download or link needs a fast second opinion before anyone opens or clicks it.
How Claude connects to Virustotal through MCP
The Model Context Protocol (MCP) is an open standard that lets Claude securely use other software, reading information and taking actions with permissions your organisation controls. Think of it as a universal adapter between Claude and the tool. For VirusTotal, the connection is made using your API key, so access is tied to a credential you can issue, limit and revoke.
Once connected, Claude can typically look up the reputation of a file hash, URL or domain, submit a file or link for scanning, retrieve the detailed threat report and summarise which engines flagged it and why. It can also pull together related indicators so an analyst can see the bigger picture in one place rather than across many screens.
Permissions and approvals keep people in charge. We set up least-privilege access so Claude only reaches the functions your team needs. Consequential actions, such as blocking a domain or escalating an incident, are routed to a named person for approval, and every request is written to an audit log for review.
What you can automate
Triage of suspicious email attachments
When a staff member reports a suspicious attachment, Claude can check its hash and submit the file for scanning, then summarise the results in plain language. The analyst receives a short verdict, the engines that flagged it and a recommended next step, which shortens the time before a decision is made.
Checking links in phishing reports
Service desk teams often receive reports of suspicious links. Claude can check the URL and its domain against VirusTotal, retrieve the reputation history and draft a reply to the reporter. Analysts keep final say on whether the link is blocked across the organisation.
Investigating indicators during an incident
During an incident, responders need to move quickly across many indicators. Claude can take a list of hashes, IP addresses or domains, retrieve reports for each and group the findings by risk, so the incident lead can prioritise containment steps.
Weekly threat summaries for management
Security leads can ask Claude to review the week's scanned items and produce a readable summary of trends, such as recurring malicious domains or file types. This helps non-specialist leaders understand risk without reading raw reports.
Onboarding checks for software downloads
IT teams can use Claude to check installers and tools before they are approved for use. Claude retrieves the scan results and notes any engines that disagree, giving the approver a clear basis for a decision that is recorded for audit.
An end-to-end workflow: Phishing report triage to ticket resolution
TriggerA user reports a suspicious email with an attachment and link to the IT service desk through the ticketing system.
The ticket is opened in the service desk system and Claude is notified with the attachment hash and link.
Claude checks the file hash and URL against VirusTotal and retrieves the threat reports.
Claude summarises the verdict, the number of engines that flagged the item and the key indicators in the ticket.
If the verdict is clearly malicious, Claude proposes blocking the domain and quarantining the email, and routes the request to an analyst for approval.
Once approved, the action is carried out in the email security tool and Claude drafts a reply to the user.
The ticket, scan results and approval are logged for audit and closed.
OutcomeTypically, suspicious items are triaged faster, analysts spend less time gathering context by hand, and every decision has a documented trail. Results vary by organisation and volume.
How we set it up
Free automation audit
We review how your security and IT teams currently check suspicious files and links, and identify the workflows worth automating. You receive a clear recommendation at no cost.
Secure API key connection
We connect Claude to VirusTotal using your API key, stored in a managed secrets vault. The key is scoped to the access your team needs and can be rotated or revoked at any time.
Workflow design across your systems
We design the end-to-end flow across VirusTotal and your other systems, such as Microsoft 365, your ticketing platform or your CRM, with approval points for consequential actions.
Testing and launch with monitoring
We test against real past cases, confirm the results match your analysts' judgement, then launch with monitoring, alerts and audit logs switched on.
Team training and handover
We train your analysts and IT staff on how to use Claude with VirusTotal, what the approval steps mean and how to review the audit trail, leaving your team confident to run it.
Who benefits
- Security analysts
- Get a clear verdict and context for suspicious files and links without switching between multiple screens.
- IT and service desk managers
- Handle phishing and suspicious-file reports faster, with consistent, documented decisions.
- Incident response leads
- Review many indicators at once and prioritise containment steps during an active incident.
- Chief information security officers and risk owners
- Receive readable summaries of threat trends and an audit trail that supports governance reviews.
Security and control
- Least-privilege API access, so Claude reaches only the functions each workflow needs.
- Human approval for consequential actions such as blocking domains, quarantining mail or escalating incidents.
- Full audit logs of every request Claude makes to VirusTotal and every approval given.
- Secure storage of the API key in a managed secrets vault, with regular rotation and prompt revocation if needed.
- Clear guidance that Claude's summaries support, but do not replace, analyst judgement on any verdict.
For teams in the US, UK, India and the Middle East
Organisations in the United States, the United Kingdom, India and the Middle East each have their own data protection rules, and we design workflows to meet them. In India, we align handling of personal data with the Digital Personal Data Protection Act, 2023. In the UAE and Saudi Arabia, we follow the relevant local data protection laws. We choose the hosting region for your Claude deployment, in India, the United States, the United Kingdom or the European Union, to meet your residency requirements.
Learn more about Claude and MCP
Anthropic's AI model and assistant.
Secure links between Claude and business tools.
How engineers build and change software with Claude.
Hosted agents that run multi-step work.
The open standard Claude uses to connect to tools.
Frequently asked questions
What does the VirusTotal MCP server do?
The VirusTotal MCP server acts as a secure bridge between Claude and VirusTotal. It lets Claude request scans of files and URLs, retrieve threat reports and look up reputation data for indicators such as hashes, domains and IP addresses. Your team controls which of these functions are available through the permissions we set.
Is connecting VirusTotal to Claude secure?
It can be, when set up carefully. We use an API key stored in a managed secrets vault, limit access to what each workflow needs, route consequential actions through human approval and keep full audit logs. Security depends on how the connection is configured, so we review this as part of every project.
What can Claude do with VirusTotal once connected?
Typically, Claude can check reputation for file hashes, URLs and domains, submit items for scanning, retrieve detailed reports and summarise which engines flagged them. It can also group indicators during an investigation and draft summaries for analysts or managers.
How long does setup take?
Many projects move from the free audit to a tested launch within a few weeks, depending on how many systems are involved and how complex the approval process is. A simple connection for one workflow can be quicker. We give you a timeline after the audit.
Which VirusTotal plan or permissions do I need?
In general, the connection uses an API key, and the functions available depend on the access level and usage limits associated with that key. We check your current key and the volume you expect during the audit, so you know whether it meets your needs or whether an upgrade would be useful.