How to integrate Virustotal MCP with Grok Build

Connect Grok Build to Virustotal MCP. Scan this file hash for malware, get analysis report for suspicious url, and more from your terminal, with authentication handled for you.

Get started for freeGet a demo
Virustotal logoVirustotal
Api Key

Virustotal is a malware analysis service that checks files and URLs against dozens of antivirus engines. It helps individuals and organizations quickly detect and investigate potential threats.

16 Tools

How to integrate Virustotal MCP with Grok Build

Grok Build is xAI's terminal coding agent. It runs on Grok 4.5, plans its work before it acts, and can run multiple sub-agents in parallel. It also reads Claude Code's MCP configuration, so any server you already have in a .mcp.json is picked up with no changes.

In this guide, I will show you how to connect your Virustotal account to Grok Build through Composio, so it can scan this file hash for malware, get analysis report for suspicious URL, retrieve domain reputation details, and more without leaving the terminal. Composio holds the OAuth tokens for you, and Grok Build only calls the tools you approve.

Also integrate Virustotal with

ChatGPT WorkAntigravityOpenAI Agents SDKClaude Agent SDKClaude CodeClaude CoworkCodexOpenCodeCursorVS CodeOpenClawHermesCLIGoogle ADKLangChainVercel AI SDKMastra AILlamaIndexCrewAI

Why use Composio over a standalone MCP server?

  • Read and write access. Composio's Virustotal integration lets Grok Build take real actions like creating drafts, sending updates, and labeling records, not just reading data.
  • 1,000+ SaaS toolkits out of the box. One endpoint gives you a full catalog of pre-built connectors, from Gmail and Slack to Notion, Linear, and Salesforce.
  • One MCP server for every app. Wire up a single Composio server instead of maintaining a separate MCP entry for each app.
  • Smart, context-aware tool loading. Grok Build caps how many tools it holds in a single request. Composio loads only the tools a task needs, so you do not spend that budget on tools you are not using.
  • Cross-app automation. Chain actions across apps in one run. Pull a thread, summarize it in Notion, and post the highlights to Slack from a single prompt.

Prerequisites

  • Grok Build installed and signed in. Install with curl -fsSL https://x.ai/cli/install.sh | bash on macOS or Linux, or irm https://x.ai/cli/install.ps1 | iex on Windows PowerShell. On first launch Grok opens a browser to authenticate; for headless or CI use, set an XAI_API_KEY environment variable instead (create the key at console.x.ai).
  • Access to the Virustotal account you want to connect.
  • The Composio MCP endpoint. Composio's server is remote and hosted, so there is nothing to run locally and no tunnel to set up.

Step-by-step: Connect Virustotal to Grok Build

1. Install and verify Grok Build

Install the CLI, then restart your shell so the grok binary lands on your PATH:

bash
curl -fsSL https://x.ai/cli/install.sh | bash
which grok

On Windows, install with PowerShell instead: irm https://x.ai/cli/install.ps1 | iex. If which grok returns a path, you are set. Grok Build runs on Grok 4.5 by default; you can switch models inside the session with /model <name>.

2. Add the Composio server

Add Composio as a remote HTTP MCP server with the grok mcp add command:

bash
grok mcp add --transport http composio https://connect.composio.dev/mcp

You can also add and manage servers from inside a session. Run /mcps to open the extensions modal on the MCP tab, then add a new server and paste the Composio URL. Added this way, Grok auto-detects the name from the URL and lists the server as connect:

bash
https://connect.composio.dev/mcp
Grok Build /mcps extensions modal listing MCP servers Grok Build adding the Composio MCP server with its URL

Grok also reads Claude Code-style config, so an entry in ~/.grok/config.toml or a project .mcp.json works the same way.

3. Authenticate

Composio uses OAuth. In the /mcps modal, select the Composio server and press i to authenticate (Grok also triggers this browser flow automatically the first time it uses a Composio tool). Click Allow to authorize access. Grok stores the tokens under ~/.grok/mcp_credentials.json, and /mcps shows Composio as connected.

Grok Build prompting to authenticate the Composio MCP server Composio authorization screen with the Allow button for Grok Build

4. Start building

Ask Grok to work with your Virustotal account through Composio. On the first Virustotal action, Composio prompts you to connect the account through OAuth. Approve the scopes once, and Composio handles token refresh from there.

What you can do after connecting Virustotal

  • Scan this file hash for malware
  • Get analysis report for suspicious URL
  • Retrieve domain reputation details
  • Check comments on this IP address

Security + privacy notes (important)

  • Use least-privilege access. Grant only the Virustotal scopes you actually need.
  • Review OAuth scopes before approving. Check that the requested scopes match what you expect Composio and Grok Build to do.
  • Keep write actions human-reviewed. Grok Build proposes a plan before it acts. Leave that approval step on for actions like sending messages or editing records.
  • Keep secrets out of version control. Your XAI_API_KEY and any tokens should never be committed. Use environment variables or a secrets manager.
TOOLS

Supported Tools

Every Virustotal action and event your agent gets out of the box.

Add VirusTotal Comment

Tool to add a comment to a VirusTotal resource (file, URL, domain, or IP address).

Add Vote

Tool to add a vote (harmless/malicious) to a VirusTotal resource.

Get Analysis Report

Tool to retrieve the analysis report of a file or URL submission.

Get comments

Tool to retrieve the latest comments on a VirusTotal resource.

Get Domain Relationships

Tool to retrieve relationship objects for a given domain.

Get Domain Report

Tool to retrieve the analysis report of a domain.

Get File Report

Tool to retrieve the analysis report of a file.

Get IP Address Relationships

Tool to retrieve objects related to a specific IP address by relationship type.

Get IP Address Report

Tool to retrieve the analysis report of an IP address.

Get VirusTotal Metadata

Tool to retrieve VirusTotal metadata.

Get URL Report

Tool to retrieve the analysis report of a URL.

Get Votes

Tool to retrieve votes on files, URLs, domains, or IP addresses.

Rescan File

Tool to re-analyze a previously submitted file.

Scan URL

Tool to submit a URL for scanning.

Search VirusTotal

Tool to search for objects in the VirusTotal database.

Upload File

Tool to upload a file for scanning.

FRAMEWORKS

How to build Virustotal MCP Agent with another framework

ChatGPT Work logo

ChatGPT Work

Use Virustotal MCP with ChatGPT Work

Antigravity logo

Antigravity

Use Virustotal MCP with Antigravity

OpenAI Agents SDK logo

OpenAI Agents SDK

Use Virustotal MCP with OpenAI Agents SDK

Claude Agent SDK logo

Claude Agent SDK

Use Virustotal MCP with Claude Agent SDK

Claude Code logo

Claude Code

Use Virustotal MCP with Claude Code

Claude Cowork logo

Claude Cowork

Use Virustotal MCP with Claude Cowork

Codex logo

Codex

Use Virustotal MCP with Codex

Cursor logo

Cursor

Use Virustotal MCP with Cursor

VS Code logo

VS Code

Use Virustotal MCP with VS Code

OpenCode logo

OpenCode

Use Virustotal MCP with OpenCode

OpenClaw logo

OpenClaw

Use Virustotal MCP with OpenClaw

Hermes logo

Hermes

Use Virustotal MCP with Hermes

CLI logo

CLI

Use Virustotal MCP with CLI

Google ADK logo

Google ADK

Use Virustotal MCP with Google ADK

LangChain logo

LangChain

Use Virustotal MCP with LangChain

Vercel AI SDK logo

Vercel AI SDK

Use Virustotal MCP with Vercel AI SDK

Mastra AI logo

Mastra AI

Use Virustotal MCP with Mastra AI

LlamaIndex logo

LlamaIndex

Use Virustotal MCP with LlamaIndex

CrewAI logo

CrewAI

Use Virustotal MCP with CrewAI

FAQ

Frequently asked questions

A standalone Virustotal MCP server gives Grok Build a fixed set of Virustotal tools tied to that one server. The Composio Tool Router lets Grok Build load tools from Virustotal and many other apps on demand, based on the task, all through a single endpoint.

Yes. Grok Build ships with native MCP support. Add a server with the grok mcp add command, from the in-session /mcps modal, or by editing ~/.grok/config.toml. It also reads Claude Code-style .mcp.json files, so Grok Build discovers the tools automatically.

Yes. Grok Build has zero-migration compatibility with Claude Code's configuration, so the same Composio server entry works in both without edits.

Tokens, keys, and configuration are encrypted at rest and in transit. Composio is SOC 2 Type 2 compliant, so your Virustotal data and credentials are handled to that standard.

Start with Virustotal.It takes 30 seconds.

Managed auth, hosted MCP servers, and every Virustotal tool your agent needs.Free to start.

Start building
Customer stories

Teams ship real agents on Composio

GET STARTED FOR FREEBOOK A DEMO
agent.aiZoomLettaGleanHubSpotAWSWabi

Karan skipped his own birthday party to fix our critical issue. It was 10pm and he diverted his Waymo to help us instead. This really sets the bar — it shows the commitment you need when users rely on your software.

Harsha Gaddipati
Harsha Gaddipati
Co-founder, Slashy

A lot of students tell us that the moment their connected tools start talking to each other inside Opennote feels almost magical. The agent just knows them, and it's immensely helped keep new users on the platform.

Abhi Arya
Abhi Arya
Co-founder, Opennote

We chose Composio over Pipedream because it delivered depth where it mattered — niche tools and tricky edge cases other platforms simply ignored. That gave us confidence to scale without compromising.

Nirman Dave
Nirman Dave
CEO, Zams

As a solo builder, shipping fast is life or death. The only way I can outcompete incumbents is by outmanoeuvring them. Getting bogged down managing agent auth would have been a death sentence.

Ryan Yu
Ryan Yu
Founder, Extra Thursday

Before Composio, adding tool integrations was slow and resource-intensive. Each one could take weeks of engineering time, and maintaining them meant constantly keeping up with API changes.

Tomisin Jenrola
Tomisin Jenrola
Founder & CEO, SwarmZero

With hands-on help from their founder, we integrated Gmail and Google Drive in just 30 minutes. This level of personal support and commitment is exactly what startups should strive for.

Jerome Leclanche
Jerome Leclanche
Co-Founder, Ingram Technologies