> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# VirusTotal

> Give the Sazabi agent tools to check file hashes, URLs, domains, and IP addresses against VirusTotal reports while investigating a security signal.

[All VirusTotal integration capabilities](https://docs.sazabi.com/catalogs/integrations/virustotal)

## About

This is an MCP connector that gives the Sazabi agent tools from VirusTotal's hosted MCP server (`ai.virustotal.com/mcp`). VirusTotal authenticates via OAuth with dynamic client registration: you sign in to your VirusTotal account in the browser and approve access once. Sazabi requests only the read-reports scope, so the agent can look up reports VirusTotal already has but cannot submit files or URLs or request new analyses. Those tools are blocked.

**What the agent can do:**

* Look up file reports by MD5, SHA-1, or SHA-256 hash
* Check URLs, domains, and IP addresses for detections and reputation
* Read existing submission and analysis records

**What stays read-only:** VirusTotal also has tools that upload files and request new analyses. Standard VirusTotal submissions are shared with the security community and partners, so Sazabi blocks them and the agent never sends anything to VirusTotal on your behalf. Every report lookup counts against your VirusTotal query quota, and a URL lookup sends the complete URL to VirusTotal.

## Prerequisites

* A VirusTotal account with access to the VirusTotal MCP server (VTAI)
* Permission to authorize an OAuth client in VirusTotal

## Set up in the dashboard

Configure connectors in the dashboard under [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors).

**Step 1**

### Open the connector

Find VirusTotal in [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors).

**Step 2**

### Authorize

Start the connection. Sazabi redirects you to VirusTotal to sign in and approve read access to reports, then back.

## Set up with the CLI

You can also connect VirusTotal with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) (installed and authenticated — see [`sazabi mcp-connectors` reference](https://docs.sazabi.com/reference/cli/mcp-connectors)).

VirusTotal authenticates over OAuth, so the CLI opens a browser to complete authorization:

```bash theme={"system"}
sazabi mcp-connectors connect virustotal
```

Add `--project-id <project>` to target a specific project. In `--json` mode the command prints an authorization URL to open, then polls until the connection completes. Confirm the result with `sazabi mcp-connectors list`.

## Verify

Open the connector's connection page under [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors) and confirm Sazabi lists the tools it discovered. Then, in a thread, ask the agent to check a file hash or a domain and confirm it returns a VirusTotal report. If no tools appear, confirm the connection is authorized.

## Troubleshooting

**No tools discovered** — Disconnect and reconnect from [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors), and approve the access request when VirusTotal asks.

**The agent says VirusTotal has no data for an indicator** — VirusTotal has no report for it. That does not mean the indicator is safe.

**Lookups fail with a quota error** — Your VirusTotal account has used its query quota. Wait for it to reset or check your plan.

**Connection shows needs attention** — The authorization may have expired or been revoked; reconnect from [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors).

## Further reading

> [card] [Agent tools](https://docs.sazabi.com/guides/investigate/agent-tools.md)
>
> How the agent uses connector tools.

> [card] [MCP connectors](https://docs.sazabi.com/catalogs/mcp-connectors.md)
>
> Browse the connector catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.