VTAI: VirusTotal’s Free API for AI Agents, Explained

VirusTotal has released VTAI, a free, purpose-built API and MCP server that lets AI agents check file, URL, domain and IP reputation without an API key. It formalizes something VirusTotal first previewed via community plugins back in April 2026, and as of September it has an official MCP registry listing, full documentation, and setup guides for eight popular AI coding tools. This is what it actually does, what its real limits are, and what to know before an engineer on your team wires it into an agent.

What VTAI actually is

VTAI exposes VirusTotal's reputation database through two interfaces built specifically for AI agents rather than humans clicking through a dashboard: an MCP (Model Context Protocol) server — the emerging standard for how AI agents call external tools and data — and a matching REST API. Getting access requires a single registration request naming your client (an agent_family and agent_version) to ai.virustotal.com/api/v3/agents/register, which returns a token starting with vtai_ immediately, no email, OAuth, or account creation required for the token-based path. Every subsequent call authenticates with that one token as a Bearer credential.

The 7 tools

VTAI's toolset is deliberately narrow and reads exactly like what an agent needs mid-task, not a general-purpose VirusTotal client:

• get_file_report, get_url_report, get_domain_report, get_ip_report — four lookup tools that retrieve existing scan results. None of these start a new scan; they read what VirusTotal already has on file.
• submit_file — submits a file for fresh analysis (inline content up to 24,000,000 bytes over the REST/MCP interface).
• get_analysis — reads back an analysis by ID once a submission has processed.
• submit_local_file — available only on the local, stdio-based version of the server, this lets an agent submit a file by local path rather than inline content, with a larger 32,000,000-byte ceiling.

A separate submission-receipt endpoint lets an agent re-retrieve a prior submission by its SHA-256 hash — the documented guidance is explicit that if a submission's connection drops, the right move is to look up the receipt by hash, not resubmit the file.

Real limits, and what counts against them

VirusTotal's own documentation describes VTAI's free access as generous relative to the conventional public API: roughly 60 requests per minute and 1,000 per day (UTC-based), shared across both the REST and MCP interfaces, versus the standard public API's key-gated tier of about 4/minute and 500/day. (We could not independently pull the exact current figures from VirusTotal's rate-limit documentation as part of writing this piece — treat them as VirusTotal's stated numbers, and check ai.virustotal.com directly before architecting anything against them.) A lookup that returns no results, or a VirusTotal-side disruption, still counts against the quota. Registration and usage may be visible on a public leaderboard, which is worth knowing if you'd rather your organization's usage pattern not be publicly attributable.

Responses are built for a context window, not a person

This is the detail that distinguishes VTAI from just calling the standard API yourself: results come back as concise, LLM-friendly JSON with judgment labels ("clean," "malicious," "phishing") rather than a raw list of forty antivirus engine names, alongside the scan date, the number of engines that evaluated it, and a link to the full report. VirusTotal's documentation is also explicit about a failure mode worth internalizing: a 404 (no scan result on file), a zero-detection result, or an error response are not grounds for concluding something is safe — absence of a bad verdict is not a good verdict. The documentation states plainly that scan-result text should be treated as judgment material for a human or downstream logic to weigh, not as an instruction the agent should act on unilaterally. That is the same discipline this blog has already written about for any tool output an agent consumes — see our piece on prompt injection and treating tool output as data, not instructions. A malicious actor who knows an agent auto-trusts a "clean" verdict has a reason to try to manufacture one.

Eight supported clients, three actually verified end-to-end

VirusTotal's documentation lists setup procedures for eight AI coding tools: Antigravity's CLI ("Agy"), Claude Code, Codex, Cursor, VS Code, GitHub Copilot CLI, Devin, and Cascade/Windsurf. Worth knowing before you assume broad support is equally solid everywhere: only Agy, Claude Code and Codex are documented as verified through full, end-to-end tool invocation by the underlying model. The other five have documented connection steps but are noted as only partially checked, with full model-driven tool use unverified as of this writing. If you're rolling this out to a team on one of the other five clients, budget time to actually test that the agent calls the tools correctly rather than assuming the setup guide alone is sufficient.

What's official, and what isn't

Two adjacent projects are worth distinguishing clearly. The MCP server itself (king-tero/vt-mcp, MIT-licensed) and the documentation at ai.virustotal.com and docs.virustotal.com are the official product. A separate set of community plugins for the OpenClaw and Hermes agent platforms — published under the same author's personal GitHub account — were how VTAI's capability first appeared publicly back in April, and VirusTotal's own blog is explicit that those integrations are community projects, not official releases. There is also an IDE extension, VT-Sentinel, published on the Open-VSX marketplace for VS Code and Antigravity, which runs a local proxy checking files downloaded by tools like npm, pip and curl against VirusTotal before letting them through — and blocks the download outright if it can't reach VirusTotal within a default 15-second window. That fail-closed behavior is a deliberate security choice, and also a real operational one: a flaky network path to VirusTotal can turn into a blocked package install.

The bottom line

VTAI is a genuine, well-thought-out piece of infrastructure: it lowers the friction for giving an AI agent real reputation-checking capability from "get an API key, read the docs, handle auth" down to one registration call, while keeping the response format small enough to actually fit usefully in an agent's context. It is also, definitionally, a new place your organization's file names, URLs, domains and IPs of interest flow to a third party, on every lookup an agent makes. That tradeoff is entirely reasonable for a security team that wants it — but it is a tradeoff, and it deserves the same deliberate rollout as any other tool you hand an agent. We cover exactly that in a companion piece on rolling VTAI out safely across an engineering team.

Frequently asked questions

What is VTAI? VTAI is VirusTotal's official API and MCP (Model Context Protocol) server built for AI agents, live at ai.virustotal.com. It lets a coding agent or any MCP-connected tool look up existing malware/reputation scan results for files, URLs, domains and IPs, and submit new files for analysis — all without a traditional API key, using a one-time agent registration that returns a token prefixed vtai_.

Do I need a VirusTotal account or API key to use VTAI? No account or API key is required to get started. A single POST request to the registration endpoint (with an agent_family and agent_version identifying your client) returns an agent token immediately. Re-registering repeatedly to get a fresh quota, or to bypass limits, is explicitly against VirusTotal's terms — the token is meant to be requested once and reused.

What are the 7 VTAI tools? Four retrieve existing results — file, URL, domain and IP reports — without starting a new scan. One submits a file for fresh analysis, one reads back an analysis by ID, and one re-retrieves a prior submission's receipt by SHA-256 (so an interrupted upload can be checked instead of resent). The local stdio version of the MCP server adds an eighth, local-file-path submission tool.

Does a VTAI lookup start a new scan? No — file, URL, domain and IP lookups only retrieve existing scan results already on file at VirusTotal. Only the explicit submission tools trigger new analysis. This matters for privacy: a hash lookup never sends the file itself, but a URL lookup sends the complete URL, including anything after a ? or #, so a URL carrying an API key or session token in its query string is sent to VirusTotal as part of the lookup.

Is VTAI the same as VirusTotal's standard public API? No. The conventional public API requires a personal API key and is limited to roughly 4 requests/minute and 500/day on the free tier. VTAI is a separate, purpose-built service for AI agents with a simpler no-key registration flow and documented limits around 60/minute and 1,000/day (per VirusTotal's own documentation) shared across both its REST and MCP interfaces.