Free Security-Scanning APIs for AI Agents: VTAI and the Alternatives

VirusTotal's new VTAI service made a real dent in a real problem: an AI coding agent that wants to check whether a file hash, URL, domain or IP is malicious has historically needed a paid VirusTotal API key, a manual signup flow, or a workaround. VTAI (ai.virustotal.com) fixes that with a one-time registration call, a Bearer token, a REST API, and an MCP server exposing seven tools — free within quota. It is genuinely useful. It is also not the only option, and for some use cases it is not the best-fitting one. Here is how it actually compares to the real free alternatives an agent or MCP-connected tool can reach today.

VTAI, Briefly, for Comparison

VTAI gives an agent get_file_report, get_url_report, get_domain_report, get_ip_report, get_analysis, submit_file and submit_local_file — all four indicator types, plus the ability to submit an unknown file (up to 24MB via the API, 32MB for local submission) or URL for fresh multi-engine analysis. Auth is a single POST /api/v3/agents/register returning a vtai_ Bearer token, and an MIT-licensed MCP server wraps the same API for direct use from Claude, Cursor, or any other MCP client. Free-tier quotas are reported by third parties at roughly 60 requests per minute and 1,000 per day; PlayCISO has not independently confirmed those against VirusTotal's own published limits, so treat them as directionally right rather than contractual.

What VTAI gets right is the registration model: one endpoint, one token, no credit card, no manual approval queue. That is the bar the rest of this list gets measured against.

The Real Alternatives

abuse.ch — URLhaus, MalwareBazaar, ThreatFox

abuse.ch runs three separate but complementary threat-intel platforms under one umbrella, and as of their current API design, one free Auth-Key from the abuse.ch authentication portal works across all three:

• URLhaus — malicious URL lookups, plus hostname and IP context for the infrastructure serving them.
• MalwareBazaar — file-hash lookups (MD5, SHA-1, SHA-256, plus imphash/TLSH/telfhash/gimphash for more advanced matching) against a database of shared malware samples.
• ThreatFox — IOC lookups spanning domains, IPs, IP:port pairs, URLs and hashes, tagged by malware family and C2 role.

Between the three, abuse.ch covers all four indicator types VTAI covers — file, URL, domain, IP — through one free key, which makes it the closest single-vendor match to VTAI's shape. The catch is that it is three APIs with three response formats rather than one unified schema, and none of them run your own file through an antivirus engine the way VirusTotal or MetaDefender do — they tell you whether something has already been reported by the community, not whether an unknown file is malicious. Published rate limits are vague ("fair use principles," with query results capped at a maximum entry count rather than a documented requests-per-minute ceiling), which is workable for occasional agent lookups but not something to build a high-volume pipeline on without asking abuse.ch directly.

A small community MCP server, lokallost/abusech-mcp (MIT-licensed), wraps all three platforms into four tools — get_file_report, get_url_report, get_domain_report, get_ip_report — deliberately shaped to look like a VirusTotal-style interface. It is early-stage (a handful of commits, single-digit stars at the time of writing) rather than an established, heavily-used project, so treat it as a starting point to fork or vet rather than a drop-in production dependency.

urlscan.io — Live URL Scanning

urlscan.io does one thing and does it well: it actually visits a URL in a sandboxed browser and returns what happened — a screenshot, the rendered DOM, the full list of requests made, and the resulting verdict, rather than just a reputation lookup against a static list. Its search API can also be filtered by domain, IP or ASN, but that searches URLs already scanned by the community, not a direct domain/IP reputation check the way VTAI's get_domain_report or get_ip_report work — urlscan.io is fundamentally a URL tool, not a four-indicator-type tool.

Search queries work with no API key at all. Submitting a URL for scanning and pulling full scan results needs a free account and an API-Key header. urlscan.io's own docs describe unauthenticated use as receiving "minor quotas" and point registered users to a personal quota endpoint rather than publishing one fixed number for every account — in practice this means a free registered account gets meaningfully more headroom than anonymous use, but the exact daily ceiling depends on your account and isn't a single published figure to plan around blind.

Two small community MCP servers exist — scan-url-mcp-server and the more feature-complete urlscan-mcp (14 tools spanning scan, search, screenshot retrieval and account/quota checks, MIT-licensed). Both are new, low-adoption projects rather than anything urlscan.io itself maintains, so the same caveat applies as with the abuse.ch wrapper: real, but worth reading before you trust it with production traffic.

Google Safe Browsing API

The Safe Browsing Lookup API checks URLs only — it explicitly does not take a file hash, and it is not a domain- or IP-reputation tool in the way VTAI's separate domain and IP endpoints are, since a URL check necessarily implies a host but the API's threat lists are built and matched at the URL level. It is free with no listed cost for typical use, and Google states outright that "there is no cost for use of this API," but the exact default quota is not published as a fixed public number the way VTAI's ballpark figures are — it is allocated per Google Cloud project and viewable in your own console, with more available on request.

The friction is in getting started: unlike VTAI's single registration endpoint or abuse.ch's single Auth-Key portal, Safe Browsing requires creating a Google Cloud project and enabling the API there before you get a key. For a one-off script that's a few extra minutes; for an agent you want spun up quickly with minimal setup ceremony, it is the most involved onboarding of anything in this roundup. PlayCISO did not find a maintained, purpose-built MCP server wrapping Safe Browsing specifically — Google's own mcp-security repository covers other Google security products (Chronicle, Security Operations SOAR, Google Threat Intelligence, Security Command Center) but Safe Browsing is not one of the servers in it.

MetaDefender Cloud (OPSWAT)

MetaDefender Cloud is the one alternative here that actually does what VirusTotal (and by extension VTAI) is known for: running a file through multiple antivirus engines and returning an aggregated verdict, plus Deep CDR sanitization and sandbox analysis on paid tiers. It splits into two APIs with two separate free-tier ceilings, both documented directly by OPSWAT: the Prevention API (file scanning/multiscanning) is capped at 40 requests per day on a free key, while the Reputation API (IP and domain lookups) allows up to 4,000 requests per day. That is a real, usable free tier for reputation lookups and a genuinely tight one for file scanning — 40 files a day is fine for spot-checking a handful of suspicious downloads, not for scanning every artifact an agent touches.

Auth is a standard API key issued on signup, comparable in friction to VTAI's registration flow. What MetaDefender doesn't give you for free is URL scanning in the urlscan.io sense (rendering and screenshotting a page) — its strength is the file and IP/domain side, which pairs naturally with urlscan.io or Safe Browsing for URL-facing checks.

Which One for Which Use Case

• All four indicator types behind one free key, VTAI-shaped: abuse.ch (URLhaus + MalwareBazaar + ThreatFox) is the closest match — community-reported IOC data, not a multi-engine scan of an unknown file.
• Knowing what a URL actually does before a user clicks it: urlscan.io, for the rendered screenshot and DOM/request capture a reputation-only lookup can't give you.
• Blocking known-bad URLs cheaply from a browser-adjacent tool: Google Safe Browsing, accepting the Google Cloud project setup as a one-time cost.
• An actual multi-engine verdict on a file the agent doesn't recognize: MetaDefender Cloud's Prevention API, budgeted around its 40-request daily cap, or VTAI/VirusTotal directly for higher-volume file scanning.
• Broadest single-vendor coverage with the least integration work: VTAI remains the strongest single answer — one token, one MCP server, all four indicator types, native submission of unknowns up to 32MB.

The Risk That Doesn't Go Away, Whichever One You Pick

Every service in this roundup, VTAI included, works the same way from a data-flow perspective: your agent sends an indicator — a hash, a URL, a domain, an IP, sometimes a full file — to a third party over the network, and gets a verdict back. That is the entire point of the service, and it is also, structurally, an information-disclosure vector. A URL pasted into an agent's context frequently carries a session token, an internal hostname, or an account-identifying query parameter. A file submitted for scanning is, by definition, leaving your environment and landing on infrastructure you don't control, however reputable the vendor. None of that changes because the API happens to be free, and it does not change because the auth model is a single Bearer token instead of a manual approval process — low friction to call an API is not the same thing as low risk in calling it.

The practical mitigation is the same regardless of which service an agent's tool config points at: strip query strings and auth tokens before a URL goes out for reputation checking, check a hash before ever submitting the actual file, and never wire a "scan this file" tool up to anything that might contain customer data, credentials, or regulated information without a review first. Before you trust an agent's MCP tool configuration to do any of that scrubbing correctly on its own, audit it with MCP Guard to see what the tool definitions your agent is actually calling send, and to whom — the free-tier convenience of any one of these services is worth nothing if the agent is leaking more in the request than the verdict is worth in the response.

FAQ

What is the best free VirusTotal alternative for an AI agent?

There is no single best answer because the services cover different indicator types. For file hashes and IOC lookups without per-vendor signup complexity, the abuse.ch trio (URLhaus, MalwareBazaar, ThreatFox) behind one free Auth-Key covers files, URLs, domains and IPs in a single account, closest in shape to VTAI. For live URL scanning with a rendered screenshot and DOM capture, urlscan.io is purpose-built. For real multi-engine file scanning, MetaDefender Cloud is the only one of these four that actually runs a file through multiple antivirus engines the way VirusTotal does, though its free file-scan quota is tight.

Do I need an API key for any of these services?

Yes, for all of them, including VTAI itself. None require a paid subscription to get one. VTAI needs a one-time registration call to receive a Bearer token. abuse.ch issues a single free Auth-Key that works across URLhaus, MalwareBazaar and ThreatFox. urlscan.io lets you query its search endpoint with no key at all, but scanning and higher limits need a free account. Google Safe Browsing requires enabling the API in a Google Cloud Console project, which is more setup friction than a single registration endpoint. MetaDefender Cloud issues a free API key on signup.

Can an AI agent check a file hash without uploading the actual file?

Yes, with several of these. VTAI's get_file_report, abuse.ch's MalwareBazaar hash lookup, and MetaDefender Cloud's Reputation API all accept an MD5, SHA-1 or SHA-256 hash and return a verdict from prior submissions without you ever sending the file itself. This is the safer default for an agent workflow: check the hash first, and only submit the actual file if the hash comes back unknown and you've decided the file isn't sensitive.

What does VTAI cover that the free alternatives do not?

Breadth in one place. VTAI wraps VirusTotal's aggregated multi-engine verdicts for all four indicator types (file, URL, domain, IP) behind one token and one MCP server with 7 tools, including submitting an unknown file or URL for fresh analysis up to 32MB. Getting the same four-indicator coverage from free alternatives means combining at least two services — abuse.ch for IOC-style lookups plus MetaDefender Cloud or urlscan.io for engine-based scanning or a rendered URL scan — each with its own key and its own response format.

Is it safe to send URLs, domains or file hashes to these free scanning APIs?

A hash alone leaks little, but a URL frequently contains session tokens, internal hostnames, or query parameters that identify a specific user or account, and a submitted file can contain anything that was in it. This is true of VTAI and every alternative in this roundup equally — you are handing indicators, and sometimes full files, to a third party as a matter of routine agent behavior. Scrub query strings and auth tokens before submission, never submit files with customer or credential data in them, and audit what your agent's tool configuration actually sends with a tool like MCP Guard before wiring any of these into a production workflow.