VirusTotal for AI agents
Agents read VirusTotal at once. Changes and sends are held for a person's approval by default.
About VirusTotal
VirusTotal is a free online service that analyzes files and URLs for viruses, worms, trojans, and other kinds of malicious content using multiple antivirus engines and website scanners.
What an agent can do in VirusTotal
Every VirusTotal action is classed by the platform as a read, a change or a send. Reads run at once. Changes and sends are held for a person by default.
Runs at once (reads)
Looks things up in VirusTotal without asking first. 11 actions.
- Get Analysis ReportTool to retrieve the analysis report of a file or URL submission. Use after obtaining an analysis ID to fetch its detailed report. Analysis results may be incomplete immediately after submission; poll
- Get Domain ReportTool to retrieve the analysis report of a domain. Use when you need detailed insight on a domain's reputation and analysis stats. No malicious signals on obscure or low-traffic domains may indicate li
- Get File ReportTool to retrieve the analysis report of a file. Use when you have a file's hash and need detailed scan metadata. Recently submitted files may return partial results; retry after a short delay before t
- Get IP Address ReportTool to retrieve the analysis report of an IP address. Use when you need detailed insight on an IP's reputation, ASN, country, and analysis stats. Low or zero detections indicate unknown risk, not saf
- Get VirusTotal MetadataTool to retrieve VirusTotal metadata. Use when you need information about available privileges, relationships between resources (like files, domains, IPs, URLs), and supported antivirus engines.
- Get URL ReportTool to retrieve the analysis report of a URL. Use when you have a URL identifier (base64-url without padding) and need detailed scan results, reputation, and metadata. Results may be incomplete immed
- Search VirusTotalTool to search for objects in the VirusTotal database. Use when locating files, URLs, domains, IPs, or comments matching a query. Supports pagination with limit and cursor.
- Get commentsTool to retrieve the latest comments on a VirusTotal resource. Use when you need to review user-generated comments for a file, URL, domain, or IP after obtaining its identifier.
- Get Domain RelationshipsTool to retrieve relationship objects for a given domain. Use when you have a domain and need to explore its related entities.
- Get IP Address RelationshipsTool to retrieve objects related to a specific IP address by relationship type. Use when you have an IP and need to explore connected files, URLs, or other entities.
- Get VotesTool to retrieve votes on files, URLs, domains, or IP addresses. Use when you need to view community votes for a given object.
Held for approval by default (changes and sends)
Held for a person's approval by default. The approval is recorded and the action is sent once, never twice, with 10 seconds to undo. 5 actions.
- Rescan FileTool to re-analyze a previously submitted file. Use when you need updated analysis results after an initial scan.
- Scan URLTool to submit a URL for scanning. Use when you have a URL and need to submit it to VirusTotal to obtain an analysis ID for later retrieval. The returned analysis ID is preliminary — scanning engines
- Upload FileTool to upload a file for scanning. Use when you have binary file content ready to submit for VirusTotal analysis.
- Add VirusTotal CommentTool to add a comment to a VirusTotal resource (file, URL, domain, or IP address). Use after analyzing a resource to leave contextual feedback. Provide exactly one identifier per call.
- Add VoteTool to add a vote (harmless/malicious) to a VirusTotal resource. Use after reviewing analysis results to submit your verdict.
Changes wait in Needs you
Changes and sends in VirusTotal are held for a person's approval by default. The approval is recorded, and the action is sent once, never twice, with 10 seconds to undo.
VirusTotal questions
Can an agent change data in VirusTotal on its own?
Not by default. Changes and sends in VirusTotal are held for a person's approval. The approval is recorded, and the action is sent once, never twice, with 10 seconds to undo.
What can an agent read in VirusTotal?
This connector lists 11 read actions. Reads run at once, without waiting for approval.
How does VirusTotal connect?
It connects with API key. Connectors are built and maintained by third-party developers; availability is confirmed during scoping.