How to connect Virustotal to Cursor

Trusted by teams atAWSGleanZoomAirtable
GET STARTED FOR FREEGET A DEMO

30 min · no commitment · see it on your stack

Virustotal logo
Cursor logo
divider

How to integrate Virustotal MCP with Cursor

Cursor is one of the leading AI-powered code editors. It is built to help developers write, understand, and refactor code faster with AI assistance built directly into the editor.

And in this guide, I will explain the easiest and most secure way to connect your Virustotal account to Cursor via Composio Connect, so it can scan this file hash for malware, get analysis report for suspicious URL, retrieve domain reputation details, and more without ever putting your account credentials at risk.

Also integrate Virustotal with

Why Composio?

  • 1,000+ SaaS toolkits out of the box. Skip the work of building and maintaining integrations, Composio gives you instant access to a vast catalog of pre-built connectors.
  • One MCP server for every app. Connect any of your applications on demand through a single endpoint, rather than juggling a separate server for each app.
  • Smart, context-aware tool loading. Unlike traditional MCP servers that dump every available tool into the LLM context window, Composio searches for and loads only the tools relevant to the task at hand. A remote CLI workbench lets LLMs compose these tools into workflows for complex automation.

Connect Virustotal to Cursor

Two ways to install — pick whichever you prefer.

1. Install with one click

Click the button below to add Composio to Cursor.

↗Install in Cursor

2. Or add manually

Add to your Cursor mcp.json

Open .cursor/mcp.json in your project root (or ~/.cursor/mcp.json for global config) and add the following configuration:

bash
{
  "servers": {
    "composio": {
      "type": "http",
      "url": "https://connect.composio.dev/mcp"
    }
  }
}

3. Authorize

Restart Cursor, then click "Connect" next to Composio in MCP Tools settings.

Cursor MCP Tools settings with Connect button next to Composio

A browser window will open to authorize.

Composio authorization browser window

Connect your Virustotal account

Back in Cursor, ask the agent to connect to Virustotal or give it any Virustotal-related task.

For example, ask it to:

  • "Scan this file hash for malware"
  • "Get analysis report for suspicious URL"
  • "Retrieve domain reputation details"

It will prompt you to authenticate and authorize access to Virustotal.

That is it. Composio tools are now available in Cursor, and your Virustotal account is ready to use.

Supported Tools & Triggers

Tools
Add VirusTotal CommentTool to add a comment to a virustotal resource (file, url, domain, or ip address).
Add VoteTool to add a vote (harmless/malicious) to a virustotal resource.
Get Analysis ReportTool to retrieve the analysis report of a file or url submission.
Get commentsTool to retrieve the latest comments on a virustotal resource.
Get Domain RelationshipsTool to retrieve relationship objects for a given domain.
Get Domain ReportTool to retrieve the analysis report of a domain.
Get File ReportTool to retrieve the analysis report of a file.
Get IP Address RelationshipsTool to retrieve objects related to a specific ip address by relationship type.
Get IP Address ReportTool to retrieve the analysis report of an ip address.
Get VirusTotal MetadataTool to retrieve virustotal metadata.
Get URL ReportTool to retrieve the analysis report of a url.
Get VotesTool to retrieve votes on files, urls, domains, or ip addresses.
Rescan FileTool to re-analyze a previously submitted file.
Scan URLTool to submit a url for scanning.
Search VirusTotalTool to search for objects in the virustotal database.
Upload FileTool to upload a file for scanning.

Conclusion

You have successfully connected Virustotal to Cursor using Composio Connect. Your agent can now use Virustotal securely without exposing credentials in prompts or local scripts.

How to build Virustotal MCP Agent with another framework

ChatGPT logo

ChatGPT

Use Virustotal MCP with ChatGPT

OpenAI Agents SDK logo

OpenAI Agents SDK

Use Virustotal MCP with OpenAI Agents SDK

Claude Agent SDK logo

Claude Agent SDK

Use Virustotal MCP with Claude Agent SDK

Claude Code logo

Claude Code

Use Virustotal MCP with Claude Code

Claude Cowork logo

Claude Cowork

Use Virustotal MCP with Claude Cowork

Codex logo

Codex

Use Virustotal MCP with Codex

OpenClaw logo

OpenClaw

Use Virustotal MCP with OpenClaw

Hermes logo

Hermes

Use Virustotal MCP with Hermes

CLI logo

CLI

Use Virustotal MCP with CLI

Google ADK logo

Google ADK

Use Virustotal MCP with Google ADK

LangChain logo

LangChain

Use Virustotal MCP with LangChain

Vercel AI SDK logo

Vercel AI SDK

Use Virustotal MCP with Vercel AI SDK

Mastra AI logo

Mastra AI

Use Virustotal MCP with Mastra AI

LlamaIndex logo

LlamaIndex

Use Virustotal MCP with LlamaIndex

CrewAI logo

CrewAI

Use Virustotal MCP with CrewAI

FAQ

What are the differences in Tool Router MCP and Virustotal MCP?

With a standalone Virustotal MCP server, the agents and LLMs can only access a fixed set of Virustotal tools tied to that server. However, with the Composio Tool Router, agents can dynamically load tools from Virustotal and many other apps based on the task at hand, all through a single MCP endpoint.

Can I use Tool Router MCP with Cursor?

Yes, you can. Cursor fully supports MCP integration. You get structured tool calling, message history handling, and model orchestration while Tool Router takes care of discovering and serving the right Virustotal tools.

Can I manage the permissions and scopes for Virustotal while using Tool Router?

Yes, absolutely. You can configure which Virustotal scopes and actions are allowed when connecting your account to Composio. You can also bring your own OAuth credentials or API configuration so you keep full control over what the agent can do.

How safe is my data with Composio Tool Router?

All sensitive data such as tokens, keys, and configuration is fully encrypted at rest and in transit. Composio is SOC 2 Type 2 compliant and follows strict security practices so your Virustotal data and credentials are handled as safely as possible.

Used by agents from

Context
Letta
glean
HubSpot
Agent.ai
Altera
DataStax
Entelligence
Rolai
Context
Letta
glean
HubSpot
Agent.ai
Altera
DataStax
Entelligence
Rolai
Context
Letta
glean
HubSpot
Agent.ai
Altera
DataStax
Entelligence
Rolai

Never worry about agent reliability

We handle tool reliability, observability, and security so you never have to second-guess an agent action.

Get started for freeGet a demo↗