MCP Virustotal

🚀 Virus Bus VirusTotal Project Introduction

This project, mcp-virustotal, offers threat intelligence query and relationship analysis functions, integrating the VirusTotal API for multi - source threat detection.

🚀 Quick Start

To install and run mcp-virustotal, execute the following command:

npm install mcp-virustotal

Configuration File Path

• Global installation configuration path: ~/.config/mcp-virustotal/config.json
• Current directory configuration path: config.json

Simple Configuration Example (Global Installation)

mcp-virustotal config --key VT_PUBLIC_KEY=your_api_key_here

✨ Features

Reporting Tool

Virus File Analysis

mcp-virustotal report file --hash 0a1b2c3d4e5f6a7b8c9d

URL Analysis

mcp-virustotal report url --url http://example.com

IP Address Analysis

mcp-virustotal report ip --ip 192.168.1.1

Relationship Analysis Tool

URL Relationship Analysis

mcp-virustotal relationship url --url http://example.com --type communicating_files

File Relationship Analysis

mcp-virustotal relationship file --hash 0a1b2c3d4e5f6a7b8c9d --type dropped_files

📦 Installation

Installation Steps

1. Global installation:

   npm install -g mcp-virustotal
   

2. Create a configuration file:

   mcp-virustotal config init
   

3. Configure the API key:

   mcp-virustotal config --key VT_PUBLIC_KEY=your_api_key_here
   

4. Start the service:

   mcp-virustotal start
   

Feature Overview

• Support threat intelligence queries for files, URLs, and IP addresses.
• Provide automated relationship analysis functions.
• Integrate the VirusTotal API for multi - source threat detection.
• Support result export and logging functions.
• Have proxy server configuration options.

💻 Usage Examples

Reporting Tool

File Analysis Interface

mcp-virustotal report file --hash <file_hash>

URL Analysis Interface

mcp-virustotal report url --url <target_url>

IP Address Analysis Interface

mcp-virustotal report ip --ip <target_ip>

Relationship Analysis Tool

Get File Relationship Information

mcp-virustotal relationship file --hash <file_hash> --type <relationship_type>

Get URL Relationship Information

mcp-virustotal relationship url --url <target_url> --type <relationship_type>

📚 Documentation

Configuration File Structure

{
  "key": "your_api_key_here",
  "proxy": {
    "enabled": false,
    "url": "http://proxy.example.com:1080"
  },
  "logging": {
    "level": "info",
    "file": "/var/log/mcp-virustotal.log"
  }
}

Error Handling

Common Errors and Solutions

1. API Request Failure

   • Check the network connection.
   • Verify the validity of the API key.
   • Ensure that the request frequency is within the limits of VirusTotal.

2. Configuration File Error

   • Confirm that the configuration file path is correct.
   • Verify that the JSON format is correct.
   • Check if the API key is set correctly.

Development Guide

Project Structure

• src/: Core business logic code
• config/: Configuration management module
• logger/: Logging component
• api/: API request handling functions

Contribution Guide

1. Clone the repository

   git clone https://github.com/virus-total/mcp-virustotal.git
   

2. Install dependencies

   npm install
   

3. Run tests

   npm test
   

Version History

v1.0.0 (Initial Version)

• Release date: May 1, 2023
• Main features:
  • Initial function implementation
  • Basic API support
  • Logging function
  • Simple configuration options

v1.1.0 (Updated Version)

• Release date: July 15, 2023
• Update content:
  • New relationship analysis module added
  • Enhanced error handling capabilities
  • Improved logging system
  • Optimized performance

Contributor List

• Zhang San (zhangsan)
• Li Si (lisi)
• Wang Wu (wangwu)

📄 License

This project follows the MIT License. For details, please visit:

MIT License

Reference Materials

1. VirusTotal API Documentation
2. Node.js Official Documentation
3. NPM Package Management Tool