Security

VirusTotal

Connect VirusTotal once and hand every teammate a governed MCP endpoint with 150 tools ready to call from Claude, ChatGPT, Cursor, or any MCP client, inside the same permissions they already have, with every call checked and logged.

Connect on Elaichi See how Elaichi works

Automations & dashboards

From answering questions to doing the work

A person no longer has to ask. A trigger starts the work, inside the same permissions and the same audit log as everything else. Automations and live dashboards ship on the Black plan.

Automations

Put VirusTotal work on a schedule.

A trigger starts a sequence of steps: call a VirusTotal tool, transform the result, branch, wait, and ask a person when it matters.

VirusTotal digest

Run 418 · started 2 minutes ago · on behalf of Emma Laurent

Run now

✓

Schedule

Every weekday at 08:00

0.2s
✓

Fetch collections

VirusTotal

1.4s
✓

Group by owner

Transform

0.1s
✓

Draft the digest

Agent step

Ran with 4 tools, returned a structured summary

6.2s
Approve the digest

Needs approval

Assigned to Michael Brennan

Approve Deny
Post the digest

VirusTotal

Queued

Collections and dashboards

Report on VirusTotal without asking.

Collections hold your own data, written by an automation and read by a dashboard that refreshes on a schedule.

VirusTotal health

Refreshed 4 minutes ago · every 15 minutes · from the collections collection

Live

Collections

1,284 ↓ 12%

Graphs

96 ↓ 8%

Needs attention

3 ↑ 2

Updated this week

412 ↑ 9%

Collections created

Last 14 days

By workspace

Share of activity

Engineering 34%

Product 27%

Support 21%

Sales 18%

AI tools

VirusTotal tools for your AI agents

150 tools are ready to call through Elaichi's MCP endpoint the moment you connect VirusTotal, governed by the same roles, restrictions, and audit log as everything else in Elaichi.

list_all_virustotal_ip_addresses

Get a VirusTotal IP address report by IP. Returns: data. Required: ip.

virustotal_ip_addresses_rescan

Rescan an IP address in VirusTotal to refresh its verdicts, whois information, and SSL certificates. Returns: type, id, links. The returned analysis id can be used with the Analyses endpoint to retrieve vendor verdicts. Required: ip_addresse_id.

virustotal_ip_addresses_list_comments

List comments posted on a VirusTotal IP address. Returns: type, id, attributes (text, html, tags, votes, date), links for each comment. Required: ip_addresse_id.

virustotal_ip_addresses_create_comment

Post a comment for a given IP address in VirusTotal. Any word starting with # in the comment text is treated as a tag and added to the comment's tag attribute. Returns the created comment object including its id, type, text, tags, html, date, and votes. Required: ip_addresse_id, data.

virustotal_ip_addresses_list_relationships

List objects related to a given IP address by relationship name in VirusTotal. Returns an array of related objects, each with type, id, links, and attributes. Required: ip_addresse_id, relationship.

virustotal_ip_addresses_list_relationship_descriptors

List relationship descriptors for a VirusTotal IP address, returning only the related objects' IDs and any context attributes instead of full object attributes. Returns: type, id, attributes. Required: ip_addresse_id, relationship.

virustotal_ip_addresses_list_votes

List votes cast on a VirusTotal IP address. Returns: type, id, attributes, links. Required: ip_addresse_id.

virustotal_ip_addresses_create_vote

Cast a vote for a VirusTotal IP address. The verdict must be either harmless or malicious. Returns the created vote object including type, id, and attributes with the verdict. Required: ip_addresse_id, data.

get_single_virustotal_ip_address_by_id

Get a VirusTotal IP address report by id, including threat reputation and context from antivirus products and security tools. Returns: type, id, links, attributes. Required: id.

list_all_virustotal_domains

Get information about a specific domain in VirusTotal. Returns: type, id, links, attributes, relationships, data. Required: domain.

virustotal_domains_rescan

Trigger a rescan of a domain in VirusTotal to refresh its verdicts, WHOIS information, and SSL certificates. Returns: type, id, links. Required: domain_id.

virustotal_domains_list_comments

List comments for a specific domain in VirusTotal. Returns: type, id, attributes, links. Required: domain_id.

virustotal_domains_create_comment

Post a comment for a specific domain in VirusTotal. Any word starting with # in the comment text is treated as a tag. Returns: type, id, attributes, links. Required: domain_id, data.

virustotal_domains_list_relationships

List objects related to a domain in VirusTotal by relationship type (e.g., resolutions, siblings, subdomains). Returns: type, id, links, attributes, relationships. Required: domain_id, relationship.

virustotal_domains_list_relationship_descriptors

List related object descriptors for a VirusTotal domain by relationship name, returning only the related objects' IDs instead of full attributes. Returns: type, id, attributes. Required: domain_id, relationship.

virustotal_domains_list_votes

List votes cast on a VirusTotal domain. Returns: type, id, attributes. Required: domain_id.

virustotal_domains_create_vote

Cast a vote on a VirusTotal domain. Returns: type, id, attributes. Required: domain_id, data. Verdict must be either harmless or malicious.

get_single_virustotal_domain_by_id

Get a VirusTotal domain report by id, including threat reputation and analysis context. Returns: type, id, links, attributes. Required: id.

get_single_virustotal_resolution_by_id

Get a VirusTotal DNS resolution by id. The resolution object ID is formed by appending the IP address and the domain it resolves to together. Returns: type, id, links, attributes. Required: id.

create_a_virustotal_file

Upload a file to VirusTotal for scanning with 70+ antivirus products and analysis tools. Returns an analysis descriptor with type and id — use the id with the GET /analyses/{id} endpoint to check the analysis status. Required: file. For files larger than 32MB, obtain a special upload URL via the get_upload_url method first; the actual size limit is 650MB.

virustotal_files_get_upload_url

Get a special one-time-use upload URL from VirusTotal for uploading files larger than 32MB. Returns a URL string to use as the POST target with the same multipart format expected by POST /files. Each upload URL can be used only once. No required parameters.

get_single_virustotal_file_by_id

Get a VirusTotal file report by its SHA-256, SHA-1, or MD5 hash, retrieving the analysis report including threat reputation and context from 70+ antivirus products and 10+ dynamic analysis sandboxes. Returns the File object including its type, id, attributes, and links. Required: id.

virustotal_files_rescan

Re-analyse a previously uploaded file in VirusTotal without re-uploading it. Returns an analysis descriptor with type and id — use the id with the analyses endpoint to poll results. Required: file_id. Do not rescan more than 50K files per day to avoid denial of service on the scanning infrastructure.

virustotal_files_get_download_url

Get a signed download URL for a file stored in VirusTotal. Returns the signed URL string which expires after 1 hour. Required: file_id. Getting the URL counts as a file download in your quota, but subsequent downloads via the URL do not consume additional quota.

virustotal_files_download

Download a file from VirusTotal by hash. Returns the file binary via redirect to a signed download URL valid for 1 hour. Required: file_id. Premium privileges required.

virustotal_files_list_comments

List comments on a VirusTotal file by hash. Returns: type, id, links, attributes. Required: file_id.

virustotal_files_create_comment

Post a comment on a VirusTotal file by hash. Words starting with # in the text are automatically added as tags. Returns: type, id, links, attributes. Required: file_id, data.

virustotal_files_list_relationships

List objects related to a VirusTotal file by relationship type, returning full object attributes. Returns: type, id, links, attributes. Required: file_id, relationship.

virustotal_files_list_relationship_descriptors

List descriptors of objects related to a VirusTotal file by relationship type, returning only IDs instead of full object attributes. Returns: type, id, attributes. Required: file_id, relationship.

virustotal_files_list_votes

List votes cast on a file in VirusTotal. Returns: type, attributes. Required: file_id.

virustotal_files_create_vote

Create a vote on a file in VirusTotal. Returns: type, attributes. The verdict must be either harmless or malicious. Required: file_id.

virustotal_files_get_behaviour_summary

Get a merged behavioural summary for a file in VirusTotal, combining sandbox reports from all integrated sandboxes. Returns: attributes. Required: file_id (SHA-256, SHA-1, or MD5).

virustotal_files_get_mitre_attack_summary

Get a summary of MITRE ATT&CK tactics and techniques observed in each sandbox report for a VirusTotal file. Returns a map keyed by sandbox name; each entry contains a tactics array with id, name, description, link, and nested techniques (id, name, description, link, signatures with severity and description). Required: file_id.

virustotal_files_list_behaviours

List all sandbox behaviour reports for a VirusTotal file. Returns each report's id, type, and attributes including sandbox_name, analysis_date, has_html_report, has_pcap, processes_tree, signature_matches, mitre_attack_techniques, and others. Required: file_id.

get_single_virustotal_sigma_rule_by_id

Get a single VirusTotal Sigma Rule by id. Returns the Sigma Rule object including its type, id, and attributes. Required: id.

get_single_virustotal_yara_ruleset_by_id

Get a YARA Ruleset from VirusTotal by id. Returns the ruleset object including its type, id, links, and attributes. Required: id.

get_single_virustotal_file_behaviour_by_id

Get a VirusTotal file behaviour sandbox report by id. The id combines the analysed file's SHA256 and the sandbox name joined by an underscore. Returns: type, id, links, attributes. Required: id.

virustotal_file_behaviours_list_relationships

List objects related to a VirusTotal file behaviour sandbox report by relationship name. Returns: type, id, links, attributes. Required: sandbox_id, relationship.

virustotal_file_behaviours_list_relationship_descriptors

List only the IDs (and context attributes, if any) of objects related to a VirusTotal file behaviour sandbox report, without returning full attributes. Returns: type, id, attributes. Required: sandbox_id, relationship.

virustotal_file_behaviours_get_html_report

Get the HTML report for a VirusTotal file behaviour sandbox analysis. Returns the rendered HTML report content for the sandbox execution. Required: sandbox_id.

virustotal_file_behaviours_get_evtx

Fetch the EVTX (Windows Event Log) file associated with a VirusTotal sandbox execution. This endpoint is only available for users with special privileges. Returns the EVTX file content. Required: sandbox_id.

virustotal_file_behaviours_get_pcap

Download the PCAP (packet capture) file associated with a VirusTotal sandbox execution. Returns the raw binary PCAP file content. Required: sandbox_id. This endpoint requires special privileges.

virustotal_file_behaviours_get_memdump

Download the memory dump file associated with a VirusTotal sandbox execution. Returns the raw binary memory dump file content. Required: sandbox_id. This endpoint requires special privileges.

create_a_virustotal_url

Scan a URL with VirusTotal to analyse it with 70+ antivirus products. Returns an analysis descriptor with id, type, and links that can be used to retrieve the analysis via the Analyses endpoint. Required: url.

get_single_virustotal_url_by_id

Get a URL report from VirusTotal by id. Returns the URL object with type, id, links, and attributes. Required: id.

virustotal_urls_rescan

Trigger a rescan of a previously scanned URL in VirusTotal. Returns an analysis descriptor with id, type, and links for tracking the new analysis via the Analyses endpoint. Required: url_id.

virustotal_urls_list_comments

List community comments for a specific URL in VirusTotal. Returns comment objects with type, id, attributes, and links. Required: url_id.

virustotal_urls_create_comment

Post a comment on a specific URL in VirusTotal. Returns the created comment object with type, id, attributes, and links. Any word starting with # in the comment text is treated as a tag. Required: url_id, data.

virustotal_urls_list_relationships

List objects related to a VirusTotal URL by relationship name, returning full related objects with all attributes. Returns: type, id, links, attributes, relationships. Required: url_id, relationship. Some relationships are accessible only to VirusTotal Enterprise users.

virustotal_urls_list_relationship_descriptors

List descriptors (IDs and context attributes only) of objects related to a VirusTotal URL by relationship name, without returning full object attributes. Returns: type, id, attributes. Required: url_id, relationship.

virustotal_urls_list_votes

List VirusTotal Vote objects for a given URL. Returns: type, attributes. Required: url_id.

virustotal_urls_create_vote

Post a vote for a given VirusTotal URL. The verdict attribute must be either harmless or malicious. Returns: type, attributes. Required: url_id, data.

list_all_virustotal_comments

List the latest comments added to VirusTotal. Returns each comment with id, type, links, and attributes including date, tags, html, text, and votes. The filter parameter allows narrowing results by tag (e.g. filter=tag:malware).

get_single_virustotal_comment_by_id

Get a single VirusTotal comment by id. Returns the comment object including id, type, links, and attributes with date, tags, html, text, and votes. Required: id.

delete_a_virustotal_comment_by_id

Delete a VirusTotal comment by id. Returns an empty 204 response on success. Required: id.

virustotal_comments_list_relationships

List objects related to a VirusTotal comment by relationship name. Returns each related object with id, type, links, and type-specific attributes. Required: comment_id, relationship.

virustotal_comments_list_relationship_descriptors

List descriptors (IDs only) for objects related to a VirusTotal comment. Returns each related object descriptor with id, type, links, and attributes. Required: comment_id, relationship.

virustotal_comments_create_vote

Cast a vote on a VirusTotal comment by specifying a vote type. Returns the updated vote counts: abuse, negative, positive. Required: comment_id, data (positive, negative, or abuse).

get_single_virustotal_analysis_by_id

Get a specific VirusTotal analysis by id. Returns the analysis object including its type, id, attributes (status, progress), links, and relationships. Required: id.

virustotal_analyses_list_relationships

List related objects for a VirusTotal analysis by relationship name. Returns related objects with their type, id, attributes, links, and relationships. Required: analyse_id, relationship.

virustotal_analyses_list_relationship_descriptors

List relationship descriptors (ID and context attributes only) for a VirusTotal analysis. Returns related object descriptors with their type, id, attributes, links, and relationships. Required: analyse_id, relationship.

get_single_virustotal_submission_by_id

Get a VirusTotal submission by id. Returns the submission object including its type, id, attributes, and links. Required: id.

get_single_virustotal_operation_by_id

Get a specific VirusTotal operation by id. Returns the operation object including its type, id, and attributes with status, progress, files_ok, and files_error. Required: id.

get_single_virustotal_attack_tactic_by_id

Get a specific MITRE ATT&CK attack tactic in VirusTotal by id. Returns the attack tactic object including type, id, links, attributes, and relationships. Required: id.

virustotal_attack_tactics_list_relationships

List objects related to a VirusTotal attack tactic for a specified relationship. Returns each related object's type, id, links, and attributes. Required: attack_tactic_id, relationship.

virustotal_attack_tactics_list_relationship_descriptors

List descriptors of objects related to a VirusTotal attack tactic for a specified relationship. Returns each related object descriptor's type and id only, without full attributes. Required: attack_tactic_id, relationship.

get_single_virustotal_attack_technique_by_id

Get a specific VirusTotal attack technique by id. Returns the attack technique object including its type, id, links, and attributes. Required: id.

virustotal_attack_techniques_list_relationships

List objects related to a VirusTotal attack technique for a given relationship name. Returns related objects including their type, id, links, and attributes. Required: attack_technique_id, relationship.

virustotal_attack_techniques_list_relationship_descriptors

List descriptors of objects related to a VirusTotal attack technique for a given relationship name. Returns just the related object's type and id without full attributes. Required: attack_technique_id, relationship.

list_all_virustotal_popular_threat_categories

List popular threat categories in VirusTotal. Returns normalized malware category name strings (e.g., trojan, dropper, ransomware) commonly used in AV verdicts and set as part of a file's popular_threat_classification. No required parameters beyond API key authentication.

virustotal_codeinsights_analyse_binary

Analyze disassembled or decompiled code in VirusTotal Code Insights for malware-relevant functionality. Returns a Base64-encoded string containing the AI-generated description of the code's behavior. Required: data.code, data.code_type. Limited to 50 requests per day.

list_all_virustotal_saved_searches

List VirusTotal saved searches you have access to as owner, editor, or viewer. Returns each saved search with type, id, and attributes including name, description, search_query, private, tags, creation_date, last_modification_date, origin, and owner. Max 40 per page.

get_single_virustotal_saved_search_by_id

Get a single VirusTotal saved search by id. Returns: type, id, attributes. Required: id.

create_a_virustotal_saved_search

Create a new VirusTotal saved search; the caller automatically becomes its owner. Returns: type, id, attributes. Required: data.

virustotal_saved_searches_share

Grant viewer or editor access on a VirusTotal saved search to specific users or the owner's group. Editor privileges can only be granted to members of the same group as the owner. Returns: type, id, attributes. Required: saved_searche_id, access, data.

update_a_virustotal_saved_search_by_id

Update attributes of an existing VirusTotal saved search. To modify tags, retrieve the current list first and submit the full resulting list. Returns: type, id, attributes. Required: id, data.

delete_a_virustotal_saved_search_by_id

Delete a VirusTotal saved search by id. Upon deletion, the search is permanently removed and will no longer be accessible to any users with whom it was previously shared. Returns an empty 204 response on success. Required: id.

virustotal_saved_searches_revoke_access

Revoke viewer or editor access to a VirusTotal saved search for specific users or the owner's entire group. Requires a request body even when using the DELETE method. Returns an empty 204 response on success. Required: saved_searche_id, access, and a data payload listing the users/groups to revoke.

virustotal_saved_searches_list_relationship_descriptors

List related object descriptors for a specific relationship of a VirusTotal saved search, returning just the related object's type and id instead of all attributes. Returns: type, id, attributes. Required: saved_searche_id, relationship. Max 40 related objects per page.

virustotal_saved_searches_list_relationships

List full related objects for a specific relationship of a VirusTotal saved search, returning all attributes of the related objects. Returns: type, id, links, attributes. Required: saved_searche_id, relationship. Max 40 related objects per page.

virustotal_search_search

Search VirusTotal for files, URLs, domains, IP addresses, or comments by query string. Returns a list of matching objects each with id, type, attributes, and links; the attributes shape varies by result type (e.g. comment attributes include date, html, tags, text, and votes). Required: query.

virustotal_intelligence_search_search

Search files in VirusTotal's dataset using Intelligence query syntax (same as the VT Intelligence UI). Returns matching objects with id, type, and context_attributes including confidence, match_in_subfile, snippet, and similarity_score. Required: query. Content searches cannot be sorted; fuzzy hash searches are throttled to 15 per minute.

virustotal_intelligence_search_get_snippets

Get file content snippets that matched a VirusTotal Intelligence search query. Returns a list of strings containing content hexdump and plain text, with matched content between * characters. Required: snippet.

list_all_virustotal_metadata

Get VirusTotal metadata including the full list of detection engines, available privileges, and object relationship descriptors. Returns: engines, privileges, relationships.

create_a_virustotal_collection

Create a new VirusTotal collection with IOCs provided as relationship descriptors or raw text. Returns: id, type, links, attributes, relationships, raw_items. Required: data (with type and attributes.name).

get_single_virustotal_collection_by_id

Get a single VirusTotal collection by id. Returns: id, type, links, attributes, relationships, raw_items. Required: id.

update_a_virustotal_collection_by_id

Update a VirusTotal collection's name or description and add IOCs via raw text by id. Returns: id, type, links, attributes, relationships, raw_items. Required: id, data (with type).

delete_a_virustotal_collection_by_id

Delete a VirusTotal collection by id. Returns an empty 204 response on success. Required: id.

virustotal_collections_list_comments

List comments on a VirusTotal collection. Returns: type, id, links, attributes. Required: collection_id.

virustotal_collections_create_comment

Post a comment on a VirusTotal collection. Any word starting with # in the comment text is treated as a tag and added to the comment's tags attribute. Returns: type, id, links, attributes. Required: collection_id, data. Comment IDs are auto-generated; do not include an id in the request body.

virustotal_collections_list_relationships

List related objects for a VirusTotal collection by relationship name. Returns an array of related objects with id, type, links, and attributes. Required: collection_id, relationship.

virustotal_collections_list_relationship_descriptors

List related object descriptors for a VirusTotal collection's relationship. This is the same as the full relationship endpoint but returns only the descriptor (type and id) instead of all attributes. Returns: type, id, links, attributes. Required: collection_id, relationship.

virustotal_collections_add_elements

Add new elements to a VirusTotal collection's relationship by sending object descriptors. Returns: id, type, attributes, raw_items, links. Required: collection_id, data.

virustotal_collections_delete_elements

Remove elements from a VirusTotal collection's relationship by sending object descriptors. Returns: data. Required: collection_id, data.

list_all_virustotal_collections

List VirusTotal IoC collections with optional filtering and sorting. Returns each collection with type, id, links, attributes (name, description, creation_date, last_modification_date, owner, source_region, targeted_region, targeted_industry, threat_category, tag), and relationships (domains, urls, ip_addresses, files). Max 40 per page.

virustotal_collections_export_iocs

Export all IoCs from a VirusTotal collection in json, csv, or stix format. Returns: type, id, links, attributes, relationships. Required: collection_id, format.

virustotal_collections_export_iocs_relationship

Export IoCs from a specific relationship of a VirusTotal collection in json, csv, or stix format. Returns: type, id, links, attributes, relationships. Required: collection_id, relationship, format.

virustotal_collections_export_aggregations

Export aggregation data from a VirusTotal collection in json or csv format. Returns: type, id, links, attributes. Required: collection_id, format.

virustotal_collections_search_iocs

Search IoCs inside a VirusTotal collection using VT Intelligence queries. By default searches files; use entity:domain/ip/url for other entity types. Returns: type, id, links, attributes, relationships. Required: collection_id, query. Max 40 per page.

create_a_virustotal_zip_file

Create a VirusTotal ZIP file containing files specified by their hashes. Returns: type, id, attributes. Required: data.hashes. The ZIP is built asynchronously — poll the get endpoint until status is 'finished'.

get_single_virustotal_zip_file_by_id

Get a VirusTotal ZIP file by id. Returns: type, id, attributes. The status field tracks creation progress through starting, creating, finished, timeout, error-starting, and error-creating. Required: id.

virustotal_zip_files_get_download_url

Get a signed download URL for a VirusTotal ZIP file. Returns the signed URL string, valid for 1 hour. Required: zip_file_id.

virustotal_zip_files_download

Download a VirusTotal ZIP file by redirecting to a signed download URL. The redirect URL remains valid for 1 hour. Required: zip_file_id.

list_all_virustotal_yara_rules

List VirusTotal Crowdsourced YARA rules. Returns each rule with id, type, attributes (including name, author, rule, tags, matches, enabled, creation_date, last_modification_date, and meta), and links. Supports filter and order query parameters for narrowing and sorting results.

get_single_virustotal_yara_rule_by_id

Get a single VirusTotal Crowdsourced YARA rule by id. Returns the rule object with id, type, attributes (including name, author, rule, tags, matches, enabled, creation_date, last_modification_date, and meta), and links. Required: id.

virustotal_yara_rules_list_relationships

List objects related to a VirusTotal YARA rule for a given relationship name. Returns related objects with id, type, attributes, links, and an error field for related items not present in VirusTotal's database. Required: yara_rule_id, relationship.

virustotal_yara_rules_list_relationship_descriptors

List descriptors of objects related to a VirusTotal YARA rule for a given relationship name. Returns related object descriptors with id, type, and context_attributes when available, without full object attributes. Required: yara_rule_id, relationship.

list_all_virustotal_ioc_stream

List objects from the VirusTotal IoC Stream including files, URLs, domains, and IP addresses, each carrying notification context attributes. Returns: type, id, links, context_attributes, attributes, relationships. Max 40 objects per page.

virustotal_ioc_stream_delete_notifications

Delete notifications from the VirusTotal IoC Stream matching a filter string. Uses the same filters as the list endpoint. Returns an empty 204 response on success.

get_single_virustotal_ioc_stream_notification_by_id

Get a single VirusTotal IoC Stream notification by id. Returns the notification object including its type, id, links, and attributes with notification_date, origin, sources, and tags. Required: id.

delete_a_virustotal_ioc_stream_notification_by_id

Delete a VirusTotal IoC Stream notification by id. Returns an empty 200 response on success. Required: id.

list_all_virustotal_hunting_rulesets

List VT Hunting Livehunt rulesets viewable by the current user. Returns each ruleset with type, id, and attributes including name, rules, enabled, limit, creation_date, modification_date, notification_emails, and match_object_type. Use the filter parameter to narrow by enabled status, name, rules content, or tags; order results by name, creation_date, or modification_date.

create_a_virustotal_hunting_ruleset

Create a new VT Hunting Livehunt ruleset. Returns the created ruleset including its type, id, and attributes (name, rules, enabled, limit, notification_emails, match_object_type, creation_date, modification_date, number_of_rules). Required: name, rules.

virustotal_hunting_rulesets_delete_all

Delete all VirusTotal Hunting Livehunt rulesets owned by the user and remove the user from shared rulesets' editor lists. This asynchronous operation launches a background job and returns an Operation object immediately. Returns: data, id, links. Required: data. The x-confirm-delete header must be set to your username for this destructive operation.

get_single_virustotal_hunting_ruleset_by_id

Get a VirusTotal Hunting Livehunt ruleset by id. Returns the ruleset object including type, id, links, and attributes (enabled, limit, name, notification_emails, rules, creation_date, modification_date). Required: id.

update_a_virustotal_hunting_ruleset_by_id

Update a VirusTotal Hunting Livehunt ruleset by id, modifying attributes such as enabled, limit, name, notification_emails, and rules. Returns the updated ruleset object including type, id, and attributes. Required: id, data.

virustotal_hunting_rulesets_check_editor

Check whether a specific user or group has editing access to a VirusTotal hunting ruleset. Returns a boolean — true if the user or group is an editor, false otherwise. Required: hunting_ruleset_id, user_or_group_id.

virustotal_hunting_rulesets_revoke_editor

Revoke editing access for a user or group from a VirusTotal hunting ruleset. Returns an empty response on success. Required: hunting_ruleset_id, user_or_group_id.

delete_a_virustotal_hunting_ruleset_by_id

Delete a VirusTotal hunting ruleset by id. Returns an empty response on success. Required: id.

virustotal_hunting_rulesets_list_relationships

Retrieve all fully-expanded relationships for a VirusTotal hunting ruleset. Returns the hunting ruleset object including type, id, links, and attributes (name, enabled, limit, rules, notification_emails, match_object_type, creation_date, modification_date, number_of_rules). Required: hunting_ruleset_id.

virustotal_hunting_rulesets_list_relationship_descriptors

Retrieve descriptors for a specific relationship of a VirusTotal hunting ruleset, returning only the related object's descriptor and context attributes instead of full attributes. Returns: type, id, links, attributes. Required: hunting_ruleset_id, relationship.

virustotal_hunting_rulesets_grant_editor

Grant editor privileges on a VirusTotal Livehunt hunting ruleset to one or more users or groups. Returns the hunting ruleset object including type, id, and attributes (name, enabled, limit, rules, notification_emails). Required: hunting_ruleset_id, data.

virustotal_hunting_rulesets_transfer_ownership

Transfer ownership of a VirusTotal Livehunt hunting ruleset to another user. The new owner must belong to the same group the ruleset was created with. Returns the hunting ruleset object including type, id, and attributes (name, enabled, limit, rules, notification_emails). Required: hunting_ruleset_id, data.

list_all_virustotal_hunting_notifications

List VirusTotal hunting notifications triggered by your Livehunt rulesets or rules shared with you. Returns: id, type, attributes, relationships, links. Filter by tag, owner, or date; order by date ascending or descending.

virustotal_hunting_notifications_delete_all

Delete VirusTotal hunting notifications in bulk, optionally filtered by tag. If no tag is specified, all notifications are deleted. Returns an empty 200 response on success.

get_single_virustotal_hunting_notification_by_id

Get a single VirusTotal hunting notification by id. Returns: id, type, attributes, links. Required: id.

delete_a_virustotal_hunting_notification_by_id

Delete a single VirusTotal hunting notification by id. Returns an empty 200 response on success. Required: id.

virustotal_hunting_notifications_list_files

List files matching your VirusTotal hunting notifications, with context attributes describing each notification match. Returns: id, type, attributes, context_attributes, relationships, links.

list_all_virustotal_retrohunt_jobs

List VirusTotal Retrohunt jobs, optionally filtered by status. Returns each job with type, id, and attributes (rules, corpus, notification_email, time_range, status). Optional filter uses syntax status:(starting|running|aborting|aborted|finished).

create_a_virustotal_retrohunt_job

Create a new VirusTotal Retrohunt job with YARA rules to scan past files. Returns the created job including type, id, and attributes (rules, corpus, notification_email, time_range, status). Required: data.type and data.attributes.rules. Up to 10 concurrent jobs and 300 YARA rules per job.

get_single_virustotal_retrohunt_job_by_id

Get a single VirusTotal Retrohunt job by id. Returns: type, id, attributes. Required: id.

delete_a_virustotal_retrohunt_job_by_id

Delete a VirusTotal Retrohunt job by id. Returns: type, id, attributes, data. Required: id.

virustotal_retrohunt_jobs_abort

Abort a running VirusTotal Retrohunt job. Returns the job object including type, id, and attributes (rules, corpus, notification_email, time_range, status). Required: retrohunt_job_id.

virustotal_retrohunt_jobs_list_matching_files

List files matching a VirusTotal retrohunt job's YARA rules. Returns: type, id, links, attributes. Required: retrohunt_job_id.

virustotal_graphs_search

Search VirusTotal graphs by filter criteria and free-text query. Returns each graph record with id, type, attributes (nodes, links, graph_data, position, private, creation_date), and links. The filter parameter supports modifiers such as id:, name:, owner:, private:, creation_date:, and node-related modifiers combinable with AND, OR, and NOT; order supports name, owner, creation_date,…

get_single_virustotal_graph_by_id

Get a single VirusTotal graph by id. Returns: id, type, attributes, links. Required: id.

update_a_virustotal_graph_by_id

Update a VirusTotal graph's nodes, links, graph_data, position, or private status. Returns the updated graph object with id, type, attributes, and links. Required: id.

delete_a_virustotal_graph_by_id

Delete a VirusTotal graph by id. Returns an empty 200 response on success. Required: id.

virustotal_graphs_list_comments

List comments posted on a VirusTotal graph. Returns each comment with id, type, attributes (text, html, tags, votes, date), and links. Required: graph_id.

virustotal_graphs_create_comment

Post a comment to a VirusTotal graph. Returns: type, id, attributes, links. Required: graph_id.

virustotal_graphs_list_relationships

List objects related to a VirusTotal graph by relationship name. Returns: type, id, attributes, links. Required: graph_id, relationship.

virustotal_graphs_list_relationship_descriptors

List just the IDs (and context attributes, if any) of objects related to a VirusTotal graph, instead of returning full attributes. Returns: type, id, attributes, links. Required: graph_id, relationship.

virustotal_graphs_list_viewers

List users who can view a VirusTotal graph. The graph must be shared with them as Viewer for them to appear. Returns each viewer's id, type, attributes (first_name, last_name, profile_phrase, reputation, status, user_since), and links. Required: graph_id.

virustotal_graphs_add_viewer

Add a user or group as a viewer of a VirusTotal graph. Returns the updated list of viewers with id, type, attributes (first_name, last_name, profile_phrase, reputation, status, user_since), and links. Required: graph_id.

virustotal_graphs_check_viewer

Check if a user or group has Viewer access to a VirusTotal graph. Returns true if the user or group has Viewer access, false otherwise. Required: graph_id, user_or_group_id.

virustotal_graphs_delete_viewer

Revoke viewer access from a user or group for a VirusTotal graph. Returns an empty 204 response on success. Required: graph_id, user_or_group_id.

virustotal_graphs_list_editors

List the users and groups that have Editor access to a VirusTotal graph. The graph must be shared with them as Editor for them to appear. Returns: id, type, attributes, links. Required: graph_id.

virustotal_graphs_add_editor

Add a user or group as an editor of a VirusTotal graph. Returns: id, type, attributes, links. Required: graph_id, data.

virustotal_graphs_check_editor

Check if a user or group has Editor access to a VirusTotal graph. Returns true if the user or group has Editor access, false otherwise. Required: graph_id, user_or_group_id.

virustotal_graphs_delete_editor

Revoke edit graph permissions from a user or group in VirusTotal. Returns an empty 204 response on success. Required: graph_id, user_or_group_id.

How it works

From VirusTotal account to governed MCP endpoint

Connect

Link a VirusTotal account through Elaichi's hosted connect flow. Credentials are vaulted, so nobody, including the AI, ever sees them.

Compose

The connection becomes a toolbox instantly. Curate which VirusTotal tools are exposed, rename them, or freeze arguments.

Authorize

Point Claude, ChatGPT, Cursor, or any MCP client at the one Elaichi endpoint and sign in with OAuth, governed by roles, restrictions, and audit logs.

Put your agents to work in the tools you already use

Start a 14-day Gold trial. Connect a product, curate a toolbox, and paste a governed MCP endpoint into Claude, ChatGPT, or Cursor in minutes.

Start free trial Talk to us