How to integrate Virustotal MCP with DeepSeek Harness

Connect DeepSeek Harness to Virustotal MCP. Scan this file hash for malware, get analysis report for suspicious url, and more using natural language, with authentication handled for you.

Get started for free Get a demo

Virustotal

Api Key

Virustotal is a malware analysis service that checks files and URLs against dozens of antivirus engines. It helps individuals and organizations quickly detect and investigate potential threats.

16 Tools

Managed auth

Connect Virustotal without auth hassles

We manage OAuth, API keys, token refresh, and scopes — you just build.

Book a call

Explore the MCP Gateway

Introduction

DeepSeek Harness (dsh) is an open-source agent runtime from DeepSeek AI, and every part of it is a plugin, so you can swap out the model adapter, the tool registry, or the agent loop. It runs on the Cordis framework and comes with a local Web UI, a headless CLI runner, and a Python SDK. You can point it at DeepSeek V4-Pro and V4-Flash, or at Anthropic, OpenAI, and other OpenAI-compatible providers. It is MIT licensed and still in developer preview.

This guide shows how to connect your Virustotal account to DeepSeek Harness, and you can do it with either the Composio Connect CLI or the Composio Connect MCP. The dsh-base bundle gives shell execution as a first-class tool, so the CLI is the easiest path for personal use. It is quick to set up and needs no server config, and the MCP path works well too, since the harness comes with a built-in MCP client.

Also integrate Virustotal with

What is Composio Connect?

Composio Connect lets anyone plug 1,000+ applications directly into their agent harness, including DeepSeek Harness, through a single hosted MCP endpoint. Each task runs as a session, a scoped runtime that ties together the user, the available toolkits, authentication, and execution state. It can:

Discover and load tools on-demand. A small set of meta tools lets the agent search for the right tool at runtime, so you never load hundreds of tool definitions into context.
Chain tools in a sandboxed remote workbench. Multi-step workflows run server-side, passing outputs between tools and working with files in the session's sandbox, so long chains finish without a lot of back-and-forth with the LLM.
Manage authentication end-to-end. Managed OAuth, per-user connected accounts, and account isolation are all handled for you, so you never wire up auth yourself.

Connect Virustotal to DeepSeek Harness with Composio

Prerequisites: Install DeepSeek Harness

DeepSeek Harness needs Node.js (20 or 22) and pnpm. Build it from source. This is also what the MCP path in Option 2 requires, since the built-in MCP client resolves its dependencies from the checkout:

bash

git clone https://github.com/deepseek-ai/deepseek-harness.git
cd deepseek-harness
pnpm install
pnpm run build
pnpm dsh web

The Web UI listens on http://127.0.0.1:3080 by default. Open that address to confirm it is up.

Then configure your model route. In the Web UI, open Settings → Models: the built-in DeepSeek card accepts a DeepSeek API key, and the same page supports Anthropic, OpenAI, and custom OpenAI-compatible endpoints. Full first-run details are in the DeepSeek Harness docs.

Option 1: Composio CLI (recommended)

DeepSeek Harness runs shell commands as a first-class tool through its dsh-base bundle, so the Composio Universal CLI fits well. There is no MCP server to configure, and multi-step tool chaining is reliable. Install and authenticate:

bash

# Install the Composio CLI
curl -fsSL https://composio.dev/install | bash

# Log in to Composio
composio login

Connect to Virustotal

Ask DeepSeek Harness to connect to Virustotal, or just request any Virustotal-related task. Under the hood the agent calls Composio commands like any other shell tool:

bash

composio search "what can I do with Virustotal?"
composio link virustotal

On the first Virustotal call, composio link virustotal opens an OAuth prompt so you can authorize access. After that, every Virustotal command works with your stored credentials automatically, so you just talk to the agent and it will search, execute, and chain Virustotal tools as needed.

Option 2: Composio MCP

DeepSeek Harness bridges MCP through its built-in @deepseek-ai/dsh-mcp-client plugin. You register one server as a plugin row, and its tools appear under server-qualified names (mcp__<serverName>__<rawName>), the same shape Claude Code and Codex use.

MCP requires the source build. The built-in client depends on the harness's own internal packages (cordis, dsh-llm, dsh-tools, dsh-invariants, dsh-subprocess), which resolve from the git checkout you built in the prerequisites. Run everything below from that checkout with pnpm dsh. For a route that avoids editing config files, see the community plugin at the end of this section.

Auth note: The built-in client passes static headers only and has no OAuth flow, so authenticate to Composio Connect with the x-consumer-api-key header. For Composio's OAuth flow, use the community plugin below.

1. Register the Composio server

The web profile's user patch layer is $DSH_HOME/profiles/web/cordis.patch.yml ($DSH_HOME defaults to ~/.dsh). This is a patch file, so a new plugin goes under an insert: entry. A bare - id: row instead targets an existing entry and fails to boot with patch: entry "…" not found. Add:

bash

- insert:
    - id: mcp-composio
      name: '@deepseek-ai/dsh-mcp-client'
      config:
        serverName: composio
        transport: streamable-http
        url: https://connect.composio.dev/mcp
        headers:
          x-consumer-api-key: !!js process.env.COMPOSIO_API_KEY

2. Set the API key and launch

The header value must resolve to a string at load time. Export your Composio consumer API key (ck_...), which is on the Connect → Settings → Sessions page of the Composio dashboard, in the shell you launch from. If it is unset, process.env.COMPOSIO_API_KEY is undefined and the config fails validation:

bash

export COMPOSIO_API_KEY=ck_your_key
pnpm dsh web

3. Done!

Open http://127.0.0.1:3080 and start a session on Standard or Code mode. (Minimal mode exposes only bash and str_replace_editor, so it hides MCP tools.) Composio's tools register as mcp__composio__*. Ask DeepSeek Harness to connect to Virustotal or request any Virustotal-related task, and Composio authorizes Virustotal on demand on the first call.

The dsh-mcp-client config schema (transport, serverName, url, headers, plus reconnect.* and toolCallTimeoutMs) is the current developer-preview interface and may change between releases.

Alternative: OAuth via the community plugin

To use Composio Connect's OAuth flow instead of a static key, or to skip editing cordis.patch.yml by hand, use the community dsh-mcp-manager plugin. It installs as a self-contained external plugin, ships a bundle patch so it auto-mounts, and adds a Settings → MCP page plus OAuth (authorization code + PKCE, RFC 7591 dynamic client registration, and refresh-token rotation). It needs the web profile and Node.js ^22.19 or >=24, with pnpm on your PATH.

Install it from your source checkout, then restart pnpm dsh web and refresh:

bash

pnpm dsh plugin --profile web add github:hyqhyq3/dsh-mcp-manager

Open Settings → MCP → ＋ Add MCP server, choose HTTP, set the name to composio, the URL to https://connect.composio.dev/mcp, and the auth mode to OAuth. Click Authenticate, and Composio's login and consent screen opens in the browser, then redirects back and registers the tools as mcp__composio__*. The row should read connected (N tools).

The plugin catches the OAuth code on a loopback redirect (http://127.0.0.1:<port>/mcp-manager/callback/<id>), so Composio's OAuth provider must allow that loopback URL. Server configs and tokens persist at ~/.dsh/mcp-manager.json, so treat that file as a secret. Being a community plugin on a preview harness, its commands may change, so check the plugin repo if a step drifts.

What is the Virustotal MCP server, and what's possible with it?

The Virustotal MCP server is an implementation of the Model Context Protocol that connects your AI agent and assistants like Claude, Cursor, etc directly to your Virustotal account. It provides structured and secure access to malicious file, URL, domain, and IP analysis, so your agent can perform actions like scanning files, retrieving threat reports, investigating domains, and posting comments or verdicts on your behalf.

Comprehensive threat analysis retrieval: Instantly fetch detailed reports on files, URLs, domains, or IP addresses to understand their security reputation and scan results from dozens of antivirus engines.
Relationship and metadata insights: Have your agent explore related entities—such as domains linked to a file, or files associated with an IP address—along with receiving broad metadata about available VirusTotal operations.
Automated commenting and feedback: Use your agent to post contextual comments on any analyzed resource, making collaboration and documentation of findings much easier.
Community-driven voting: Submit harmless or malicious verdicts on files and URLs after reviewing analysis, helping to crowdsource threat intelligence and improve detection accuracy.
Latest user comment retrieval: Let your agent pull up the most recent comments on a file, URL, domain, or IP address to quickly access community feedback and insights.

Way Forward

With Virustotal connected, DeepSeek Harness can now act on your behalf whenever you ask it to.

From here, you can extend the harness further:

Connect more apps: Calendar, Slack, Notion, Linear, and hundreds of others are available through the same Composio Connect setup, and each new integration adds to what your agent can do for you.
Build workflows across tools: Once multiple apps are connected, DeepSeek Harness can chain actions together, so it can turn an email into a calendar invite, a Slack message into a Linear ticket, or a meeting note into a follow-up draft.
Use the plugin system: Wrap common Virustotal flows as dsh plugins or prompt templates so recurring tasks become one-line commands, and bundle your most-used Virustotal tools into a named profile you can boot on demand.

If you run into trouble or want to share what you've built, join the community or check out the Docs for more configuration options.

TOOLS

Supported Tools

Every Virustotal action and event your agent gets out of the box.

Add VirusTotal Comment

Tool to add a comment to a VirusTotal resource (file, URL, domain, or IP address).

Add Vote

Tool to add a vote (harmless/malicious) to a VirusTotal resource.

Get Analysis Report

Tool to retrieve the analysis report of a file or URL submission.

Get comments

Tool to retrieve the latest comments on a VirusTotal resource.

Get Domain Relationships

Tool to retrieve relationship objects for a given domain.

Get Domain Report

Tool to retrieve the analysis report of a domain.

Get File Report

Tool to retrieve the analysis report of a file.

Get IP Address Relationships

Tool to retrieve objects related to a specific IP address by relationship type.

Get IP Address Report

Tool to retrieve the analysis report of an IP address.

Get VirusTotal Metadata

Tool to retrieve VirusTotal metadata.

Get URL Report

Tool to retrieve the analysis report of a URL.

Get Votes

Tool to retrieve votes on files, URLs, domains, or IP addresses.

Rescan File

Tool to re-analyze a previously submitted file.

Scan URL

Tool to submit a URL for scanning.

Search VirusTotal

Tool to search for objects in the VirusTotal database.

Upload File

Tool to upload a file for scanning.

FRAMEWORKS

How to build Virustotal MCP Agent with another framework

ChatGPT Work

Use Virustotal MCP with ChatGPT Work

Antigravity

Use Virustotal MCP with Antigravity

OpenAI Agents SDK

Use Virustotal MCP with OpenAI Agents SDK

Claude Agent SDK

Use Virustotal MCP with Claude Agent SDK

Claude Code

Use Virustotal MCP with Claude Code

Claude Cowork

Use Virustotal MCP with Claude Cowork

Codex

Use Virustotal MCP with Codex

Grok Build

Use Virustotal MCP with Grok Build

Cursor

Use Virustotal MCP with Cursor

VS Code

Use Virustotal MCP with VS Code

OpenCode

Use Virustotal MCP with OpenCode

OpenClaw

Use Virustotal MCP with OpenClaw

Hermes

Use Virustotal MCP with Hermes

Pi

Use Virustotal MCP with Pi

Google ADK

Use Virustotal MCP with Google ADK

LangChain

Use Virustotal MCP with LangChain

Vercel AI SDK

Use Virustotal MCP with Vercel AI SDK

Mastra AI

Use Virustotal MCP with Mastra AI

LlamaIndex

Use Virustotal MCP with LlamaIndex

CrewAI

Use Virustotal MCP with CrewAI

Pydantic AI

Use Virustotal MCP with Pydantic AI

AutoGen

Use Virustotal MCP with AutoGen

MORE TOOLKITS

Explore Other Toolkits

Toolkit marketplace

Excel

Oauth2S2s Oauth2

Microsoft Excel is a robust spreadsheet application for organizing, analyzing, and visualizing data. It's the go-to tool for calculations, reporting, and flexible data management.

21risk

Api Key

21RISK is a web app built for easy checklist, audit, and compliance management. It streamlines risk processes so teams can focus on what matters.

Abstract

Api Key

Abstract provides a suite of APIs for automating data validation and enrichment tasks. It helps developers streamline workflows and ensure data quality with minimal effort.

Adafruit IO

Api Key

Adafruit IO is Adafruit's cloud platform for connected device and IoT project data. It helps you store, visualize, and act on sensor feeds without running your own backend.

FAQ

Frequently asked questions

With a standalone Virustotal MCP server, the agents and LLMs can only access a fixed set of Virustotal tools tied to that server. However, with the Composio Tool Router, agents can dynamically load tools from Virustotal and many other apps based on the task at hand, all through a single MCP endpoint.

Yes, you can. DeepSeek Harness fully supports MCP integration. You get structured tool calling, message history handling, and model orchestration while Tool Router takes care of discovering and serving the right Virustotal tools.

Yes, absolutely. You can configure which Virustotal scopes and actions are allowed when connecting your account to Composio. You can also bring your own OAuth credentials or API configuration so you keep full control over what the agent can do.

All sensitive data such as tokens, keys, and configuration is fully encrypted at rest and in transit. Composio is SOC 2 Type 2 compliant and follows strict security practices so your Virustotal data and credentials are handled as safely as possible.

Start with Virustotal.It takes 30 seconds.

Managed auth, hosted MCP servers, and every Virustotal tool your agent needs.Free to start.

Start building

How to integrate Virustotal MCP with DeepSeek Harness

Connect Virustotal without auth hassles

Introduction

Also integrate Virustotal with

What is Composio Connect?

Connect Virustotal to DeepSeek Harness with Composio

Prerequisites: Install DeepSeek Harness

Option 1: Composio CLI (recommended)

Connect to Virustotal

Option 2: Composio MCP

1. Register the Composio server

2. Set the API key and launch

3. Done!

Alternative: OAuth via the community plugin

What is the Virustotal MCP server, and what's possible with it?

Way Forward

Supported Tools

How to build Virustotal MCP Agent with another framework

ChatGPT Work

Antigravity

OpenAI Agents SDK

Claude Agent SDK

Claude Code

Claude Cowork

Codex

Grok Build

Cursor

VS Code

OpenCode

OpenClaw

Hermes

Pi

Google ADK

LangChain

Vercel AI SDK

Mastra AI

LlamaIndex

CrewAI

Pydantic AI

AutoGen

Explore Other Toolkits

Excel

21risk

Abstract

Adafruit IO

Frequently asked questions

What are the differences in Tool Router MCP and Virustotal MCP?+

Can I use Tool Router MCP with DeepSeek Harness?+

Can I manage the permissions and scopes for Virustotal while using Tool Router?+

How safe is my data with Composio Tool Router?+

Start with Virustotal.It takes 30 seconds.