Skip to main content
All VirusTotal integration capabilities

​
About

This is an MCP connector that gives the Sazabi agent tools from VirusTotal’s hosted MCP server (ai.virustotal.com/mcp). VirusTotal authenticates via OAuth with dynamic client registration: you sign in to your VirusTotal account in the browser and approve access once. Sazabi requests only the read-reports scope, so the agent can look up reports VirusTotal already has but cannot submit files or URLs or request new analyses. Those tools are blocked. What the agent can do:
  • Look up file reports by MD5, SHA-1, or SHA-256 hash
  • Check URLs, domains, and IP addresses for detections and reputation
  • Read existing submission and analysis records
What stays read-only: VirusTotal also has tools that upload files and request new analyses. Standard VirusTotal submissions are shared with the security community and partners, so Sazabi blocks them and the agent never sends anything to VirusTotal on your behalf. Every report lookup counts against your VirusTotal query quota, and a URL lookup sends the complete URL to VirusTotal.

​
Prerequisites

  • A VirusTotal account with access to the VirusTotal MCP server (VTAI)
  • Permission to authorize an OAuth client in VirusTotal

​
Set up in the dashboard

Configure connectors in the dashboard under Settings > MCP connectors.
1

​
Open the connector

Find VirusTotal in Settings > MCP connectors.
2

​
Authorize

Start the connection. Sazabi redirects you to VirusTotal to sign in and approve read access to reports, then back.

​
Set up with the CLI

You can also connect VirusTotal with the Sazabi CLI (installed and authenticated — see sazabi mcp-connectors reference). VirusTotal authenticates over OAuth, so the CLI opens a browser to complete authorization:
Add --project-id <project> to target a specific project. In --json mode the command prints an authorization URL to open, then polls until the connection completes. Confirm the result with sazabi mcp-connectors list.

​
Verify

Open the connector’s connection page under Settings > MCP connectors and confirm Sazabi lists the tools it discovered. Then, in a thread, ask the agent to check a file hash or a domain and confirm it returns a VirusTotal report. If no tools appear, confirm the connection is authorized.

​
Troubleshooting

No tools discovered — Disconnect and reconnect from Settings > MCP connectors, and approve the access request when VirusTotal asks. The agent says VirusTotal has no data for an indicator — VirusTotal has no report for it. That does not mean the indicator is safe. Lookups fail with a quota error — Your VirusTotal account has used its query quota. Wait for it to reset or check your plan. Connection shows needs attention — The authorization may have expired or been revoked; reconnect from Settings > MCP connectors.

​
Further reading

Agent tools

How the agent uses connector tools.

MCP connectors

Browse the connector catalog.