How to integrate Virustotal MCP with Hermes

Virustotal logo
Hermes logo
divider

Introduction

Hermes is a 24/7 autonomous agent that lives on your computer or server — it remembers what it learns and evolves as your usage grows.

This guide explains the easiest and most robust way to connect your Virustotal account to Hermes. You can do this through either Composio Connect CLI or Composio Connect MCP. For personal use we recommend the CLI, but you won't go wrong with MCP either.

Also integrate Virustotal with

What is Composio Connect?

Composio Connect is a consumer offering that lets anyone plug 1,000+ applications directly into their agent harness — including Hermes. It can:

  • Search and load tools from relevant toolkits on-demand, reducing context usage.
  • Chain multiple tools to accomplish complex workflows via a remote workbench, without excessive back-and-forth with the LLM.
  • Manage app authentication end-to-end with zero manual overhead.

Integrating Virustotal with Hermes

Using Composio Connect CLI

1. Install the Composio CLI

Run the install script directly, or paste https://composio.dev/hermes into your Hermes chat box to have it installed for you.

bash
curl -fsSL https://composio.dev/install | bash
Hermes authenticating with Composio

2. Authenticate

Once the CLI is installed, ask Hermes to authenticate with Composio.

3. Connect to Virustotal

Ask your agent to connect to Virustotal, or simply request any Virustotal-related task. Hermes will prompt you to authenticate and authorize access.

4. Done. You're all set with a new Virustotal connection.


Using Composio Connect MCP

1. Get your MCP URL and API Key

Go to dashboard.composio.dev and copy your Connect MCP URL and API key.

Copy MCP URL and API key from Composio dashboard

What is the Virustotal MCP server, and what's possible with it?

The Virustotal MCP server is an implementation of the Model Context Protocol that connects your AI agent and assistants like Claude, Cursor, etc directly to your Virustotal account. It provides structured and secure access to malicious file, URL, domain, and IP analysis, so your agent can perform actions like scanning files, retrieving threat reports, investigating domains, and posting comments or verdicts on your behalf.

  • Comprehensive threat analysis retrieval: Instantly fetch detailed reports on files, URLs, domains, or IP addresses to understand their security reputation and scan results from dozens of antivirus engines.
  • Relationship and metadata insights: Have your agent explore related entities—such as domains linked to a file, or files associated with an IP address—along with receiving broad metadata about available VirusTotal operations.
  • Automated commenting and feedback: Use your agent to post contextual comments on any analyzed resource, making collaboration and documentation of findings much easier.
  • Community-driven voting: Submit harmless or malicious verdicts on files and URLs after reviewing analysis, helping to crowdsource threat intelligence and improve detection accuracy.
  • Latest user comment retrieval: Let your agent pull up the most recent comments on a file, URL, domain, or IP address to quickly access community feedback and insights.

Supported Tools & Triggers

Tools
Add VirusTotal CommentTool to add a comment to a virustotal resource (file, url, domain, or ip address).
Add VoteTool to add a vote (harmless/malicious) to a virustotal resource.
Get Analysis ReportTool to retrieve the analysis report of a file or url submission.
Get commentsTool to retrieve the latest comments on a virustotal resource.
Get Domain RelationshipsTool to retrieve relationship objects for a given domain.
Get Domain ReportTool to retrieve the analysis report of a domain.
Get File ReportTool to retrieve the analysis report of a file.
Get IP Address RelationshipsTool to retrieve objects related to a specific ip address by relationship type.
Get IP Address ReportTool to retrieve the analysis report of an ip address.
Get VirusTotal MetadataTool to retrieve virustotal metadata.
Get URL ReportTool to retrieve the analysis report of a url.
Get VotesTool to retrieve votes on files, urls, domains, or ip addresses.
Rescan FileTool to re-analyze a previously submitted file.
Scan URLTool to submit a url for scanning.
Search VirusTotalTool to search for objects in the virustotal database.
Upload FileTool to upload a file for scanning.

Way Forward

With Virustotal connected, Hermes can now act on your behalf whenever it detects a relevant task or you ask it to.

From here, you can extend Hermes further:

  • Connect more apps: Calendar, Slack, Notion, Linear, and hundreds of others are available through the same Composio Connect setup. Each new integration compounds what Hermes can do for you.
  • Build workflows across tools: Once multiple apps are connected, Hermes can chain actions together — turn an email into a calendar invite, a Slack message into a Linear ticket, or a meeting note into a follow-up draft.
  • Let it learn your patterns: The more you use Hermes, the better it gets at anticipating how you'd handle recurring tasks. Give it feedback on drafts and decisions, and it will adapt.

If you run into trouble or want to share what you've built, join the community or check out the Docs for deeper configuration options.

How to build Virustotal MCP Agent with another framework

FAQ

What are the differences in Tool Router MCP and Virustotal MCP?

With a standalone Virustotal MCP server, the agents and LLMs can only access a fixed set of Virustotal tools tied to that server. However, with the Composio Tool Router, agents can dynamically load tools from Virustotal and many other apps based on the task at hand, all through a single MCP endpoint.

Can I use Tool Router MCP with Hermes?

Yes, you can. Hermes fully supports MCP integration. You get structured tool calling, message history handling, and model orchestration while Tool Router takes care of discovering and serving the right Virustotal tools.

Can I manage the permissions and scopes for Virustotal while using Tool Router?

Yes, absolutely. You can configure which Virustotal scopes and actions are allowed when connecting your account to Composio. You can also bring your own OAuth credentials or API configuration so you keep full control over what the agent can do.

How safe is my data with Composio Tool Router?

All sensitive data such as tokens, keys, and configuration is fully encrypted at rest and in transit. Composio is SOC 2 Type 2 compliant and follows strict security practices so your Virustotal data and credentials are handled as safely as possible.

Used by agents from

Context
Letta
glean
HubSpot
Agent.ai
Altera
DataStax
Entelligence
Rolai
Context
Letta
glean
HubSpot
Agent.ai
Altera
DataStax
Entelligence
Rolai
Context
Letta
glean
HubSpot
Agent.ai
Altera
DataStax
Entelligence
Rolai

Never worry about agent reliability

We handle tool reliability, observability, and security so you never have to second-guess an agent action.