Use
COMPOSIOFOR YOU
Give Claude, Codex, or any harness secure access to 1700+ tools
CLI
One command to add tools and auth to your coding agent
Build
DEVELOPER PLATFORM
SDKs, tools, and auth for agents and backend apps
MCP GATEWAY
One managed MCP endpoint for all your tools and agents
ENTERPRISE
SSO, governance, and audit controls for deploying agents org-wide
Features
TRIGGERS
Start background agents from events across your connected apps
FIREWALLNEW
Blocks instructions hidden in tool results before your agent reads them
INSTANTNEW
Audio, video, search, browser and data tools, with no keys to manage
OPTIMIZATION
Lower cost per completed task with optimised tools and skills
FOR AGENTS
CLAUDE CODEX OPENCLAW CURSOR HERMES
BUILT FOR
OFFICE WORK SALES MARKETING PRODUCT & DESIGN CUSTOMER SUPPORT ENGINEERING HR & RECRUITING FINANCE & OPS E-COMMERCE CONTENT & MEDIA IT & SECURITY
ALL USE CASES
DOCS

How to integrate Virustotal MCP with LangChain

Connect LangChain to Virustotal MCP. Scan this file hash for malware, get analysis report for suspicious url, and more using natural language, with authentication handled for you.

Get started for free Get a demo

Virustotal

Api Key

Virustotal is a malware analysis service that checks files and URLs against dozens of antivirus engines. It helps individuals and organizations quickly detect and investigate potential threats.

16 Tools

Managed auth

Connect Virustotal without auth hassles

We manage OAuth, API keys, token refresh, and scopes — you just build.

Book a call

Explore the MCP Gateway

Introduction

This guide walks you through connecting Virustotal to LangChain using the Composio tool router. By the end, you'll have a working Virustotal agent that can scan URLs and upload files, fetch threat reports for domains and IPs, search VirusTotal, and add comments and votes through natural language commands.

This guide will help you understand how to give your LangChain agent real control over a Virustotal account through Composio's Virustotal MCP server.

Before we dive in, let's take a quick look at the key ideas and tools involved.

For exact tool slugs and parameter tables, see the tool catalog in the Composio docs.

TL;DR

Here's what you'll learn:

Get and set up your OpenAI and Composio API keys
Connect your Virustotal project to Composio
Create a Tool Router MCP session for Virustotal
Initialize an MCP client and retrieve Virustotal tools
Build a LangChain agent that can interact with Virustotal
Set up an interactive chat interface for testing

What is LangChain?

LangChain is a framework for developing applications powered by language models. It provides tools and abstractions for building agents that can reason, use tools, and maintain conversation context.

Key features include:

Agent Framework: Build agents that can use tools and make decisions
MCP Integration: Connect to external services through Model Context Protocol adapters
Memory Management: Maintain conversation history across interactions
Multi-Provider Support: Works with OpenAI, Anthropic, and other LLM providers

What is the Virustotal MCP server, and what's possible with it?

The Virustotal MCP server is an implementation of the Model Context Protocol that connects your AI agent and assistants like Claude, Cursor, etc directly to your Virustotal account. It provides structured and secure access to malicious file, URL, domain, and IP analysis, so your agent can perform actions like scanning files, retrieving threat reports, investigating domains, and posting comments or verdicts on your behalf.

Comprehensive threat analysis retrieval: Instantly fetch detailed reports on files, URLs, domains, or IP addresses to understand their security reputation and scan results from dozens of antivirus engines.
Relationship and metadata insights: Have your agent explore related entities—such as domains linked to a file, or files associated with an IP address—along with receiving broad metadata about available VirusTotal operations.
Automated commenting and feedback: Use your agent to post contextual comments on any analyzed resource, making collaboration and documentation of findings much easier.
Community-driven voting: Submit harmless or malicious verdicts on files and URLs after reviewing analysis, helping to crowdsource threat intelligence and improve detection accuracy.
Latest user comment retrieval: Let your agent pull up the most recent comments on a file, URL, domain, or IP address to quickly access community feedback and insights.

What is the Composio tool router, and how does it fit here?

What is Composio SDK?

Composio's Composio SDK helps agents find the right tools for a task at runtime. You can plug in multiple toolkits (like Gmail, HubSpot, and GitHub), and the agent will identify the relevant app and action to complete multi-step workflows. This can reduce token usage and improve the reliability of tool calls. Read more here: Getting started with Composio SDK

The tool router generates a secure MCP URL that your agents can access to perform actions.

How the Composio SDK works

The Composio SDK follows a three-phase workflow:

Discovery: Searches for tools matching your task and returns relevant toolkits with their details.
Authentication: Checks for active connections. If missing, creates an auth config and returns a connection URL via Auth Link.
Execution: Executes the action using the authenticated connection.

Step-by-step Guide

Step by step10 STEPS

Prerequisites

Before starting this tutorial, make sure you have:

Python 3.10 or higher installed on your system
A Composio account with an API key
An OpenAI API key
Basic familiarity with Python and async programming

Getting API Keys for OpenAI and Composio

OpenAI API Key

Go to the OpenAI dashboard and create an API key. You'll need credits to use the models, or you can connect to another model provider.
Keep the API key safe.

Composio API Key

Log in to the Composio dashboard.
Navigate to your API settings and generate a new API key.
Store this key securely as you'll need it for authentication.

Install dependencies

npm install @composio/langchain @langchain/core @langchain/openai @langchain/mcp-adapters dotenv

Install the required packages for LangChain with MCP support.

What's happening:

@composio/langchain provides Composio integration for LangChain
@langchain/mcp-adapters enables MCP client connections
@langchain/core is the core agent framework
dotenv/config loads environment variables

Set up environment variables

bash

COMPOSIO_API_KEY=your_composio_api_key_here
COMPOSIO_USER_ID=your_composio_user_id_here
OPENAI_API_KEY=your_openai_api_key_here

Create a .env file in your project root.

What's happening:

COMPOSIO_API_KEY authenticates your requests to Composio's API
COMPOSIO_USER_ID identifies the user for session management
OPENAI_API_KEY enables access to OpenAI's language models

Import dependencies

import { Composio } from '@composio/core';
import { LangchainProvider } from '@composio/langchain';
import { MultiServerMCPClient } from "@langchain/mcp-adapters";
import { createAgent } from "langchain";
import * as readline from 'readline';
import 'dotenv/config';

dotenv.config();

What's happening:

We're importing LangChain's MCP adapter and Composio SDK
The dotenv/config import loads environment variables from your .env file
This setup prepares the foundation for connecting LangChain with Virustotal functionality through MCP

Initialize Composio client

const composioApiKey = process.env.COMPOSIO_API_KEY;
const userId = process.env.COMPOSIO_USER_ID;

if (!composioApiKey) throw new Error('COMPOSIO_API_KEY is not set');
if (!userId) throw new Error('COMPOSIO_USER_ID is not set');

async function main() {
    const composio = new Composio({
        apiKey: composioApiKey as string,
        provider: new LangchainProvider()
    });

What's happening:

We're loading the COMPOSIO_API_KEY from environment variables and validating it exists
Creating a Composio instance that will manage our connection to Virustotal tools
Validating that COMPOSIO_USER_ID is also set before proceeding

Create a Tool Router session

const session = await composio.create(
    userId as string,
    {
        toolkits: ['virustotal']
    }
);

const url = session.mcp.url;

What's happening:

We're creating a Tool Router session that gives your agent access to Virustotal tools
The create method takes the user ID and specifies which toolkits should be available
The returned session.mcp.url is the MCP server URL that your agent will use
This approach allows the agent to dynamically load and use Virustotal tools as needed

Configure the agent with the MCP URL

const client = new MultiServerMCPClient({
    "virustotal-agent": {
        transport: "http",
        url: url,
        headers: {
            "x-api-key": process.env.COMPOSIO_API_KEY
        }
    }
});

const tools = await client.getTools();

const agent = createAgent({ model: "gpt-5", tools });

What's happening:

We're creating a MultiServerMCPClient that connects to our Virustotal MCP server via HTTP
The client is configured with a name and the URL from our Tool Router session
getTools() retrieves all available Virustotal tools that the agent can use
We're creating a LangChain agent using the GPT-5 model

Set up interactive chat interface

let conversationHistory: any[] = [];

console.log("Chat started! Type 'exit' or 'quit' to end the conversation.\n");
console.log("Ask any Virustotal related question or task to the agent.\n");

const rl = readline.createInterface({
    input: process.stdin,
    output: process.stdout,
    prompt: 'You: '
});

rl.prompt();

rl.on('line', async (userInput: string) => {
    const trimmedInput = userInput.trim();

    if (['exit', 'quit', 'bye'].includes(trimmedInput.toLowerCase())) {
        console.log("\nGoodbye!");
        rl.close();
        process.exit(0);
    }

    if (!trimmedInput) {
        rl.prompt();
        return;
    }

    conversationHistory.push({ role: "user", content: trimmedInput });
    console.log("\nAgent is thinking...\n");

    const response = await agent.invoke({ messages: conversationHistory });
    conversationHistory = response.messages;

    const finalResponse = response.messages[response.messages.length - 1]?.content;
    console.log(`Agent: ${finalResponse}\n`);
        
        rl.prompt();
    });

    rl.on('close', () => {
        console.log('\n👋 Session ended.');
        process.exit(0);
    });

What's happening:

We initialize an empty conversationHistory list to maintain context across interactions
A readline interface is used to continuously accept user input from the command line
When a user types a message, it's added to the conversation history and sent to the agent
The agent processes the request using the invoke() method with the full conversation history
Users can type 'exit', 'quit', or 'bye' to end the chat session gracefully

Run the application

main().catch((err) => {
    console.error('Fatal error:', err);
    process.exit(1);
});

What's happening:

We call the main() function to start the application

Complete Code

Here's the complete code to get you started with Virustotal and LangChain:

import { Composio } from '@composio/core';
import { LangchainProvider } from '@composio/langchain';
import { MultiServerMCPClient } from "@langchain/mcp-adapters";  
import { createAgent } from "langchain";
import * as readline from 'readline';
import 'dotenv/config';

const composioApiKey = process.env.COMPOSIO_API_KEY;
const userId = process.env.COMPOSIO_USER_ID;

if (!composioApiKey) throw new Error('COMPOSIO_API_KEY is not set');
if (!userId) throw new Error('COMPOSIO_USER_ID is not set');

async function main() {
    const composio = new Composio({
        apiKey: composioApiKey as string,
        provider: new LangchainProvider()
    });

    const session = await composio.create(
        userId as string,
        {
            toolkits: ['virustotal']
        }
    );

    const url = session.mcp.url;
    
    const client = new MultiServerMCPClient({
        "virustotal-agent": {
            transport: "http",
            url: url,
            headers: {
                "x-api-key": process.env.COMPOSIO_API_KEY
            }
        }
    });
    
    const tools = await client.getTools();
  
    const agent = createAgent({ model: "gpt-5", tools });
    
    let conversationHistory: any[] = [];
    
    console.log("Chat started! Type 'exit' or 'quit' to end the conversation.\n");
    console.log("Ask any Virustotal related question or task to the agent.\n");
    
    const rl = readline.createInterface({
        input: process.stdin,
        output: process.stdout,
        prompt: 'You: '
    });

    rl.prompt();

    rl.on('line', async (userInput: string) => {
        const trimmedInput = userInput.trim();
        
        if (['exit', 'quit', 'bye'].includes(trimmedInput.toLowerCase())) {
            console.log("\nGoodbye!");
            rl.close();
            process.exit(0);
        }
        
        if (!trimmedInput) {
            rl.prompt();
            return;
        }
        
        conversationHistory.push({ role: "user", content: trimmedInput });
        console.log("\nAgent is thinking...\n");
        
        const response = await agent.invoke({ messages: conversationHistory });
        conversationHistory = response.messages;
        
        const finalResponse = response.messages[response.messages.length - 1]?.content;
        console.log(`Agent: ${finalResponse}\n`);
        
        rl.prompt();
    });

    rl.on('close', () => {
        console.log('\nSession ended.');
        process.exit(0);
    });
}

main().catch((err) => {
    console.error('Fatal error:', err);
    process.exit(1);
});

Conclusion

You've successfully built a LangChain agent that can interact with Virustotal through Composio's Tool Router.

Key features of this implementation:

Dynamic tool loading through Composio's Tool Router
Conversation history maintenance for context-aware responses
Async Python provides clean, efficient execution of agent workflows

You can extend this further by adding error handling, implementing specific business logic, or integrating additional Composio toolkits to create multi-app workflows.

TOOLS

Supported Tools

Every Virustotal action and event your agent gets out of the box.

Add VirusTotal Comment

Tool to add a comment to a VirusTotal resource (file, URL, domain, or IP address).

Add Vote

Submit a harmless or malicious vote on a VirusTotal resource.

Get Analysis Report

Tool to retrieve the analysis report of a file or URL submission.

Get comments

Tool to retrieve the latest comments on a VirusTotal resource.

Get Domain Relationships

Tool to retrieve relationship objects for a given domain.

Get Domain Report

Tool to retrieve the analysis report of a domain.

Get File Report

Tool to retrieve the analysis report of a file.

Get IP Address Relationships

Retrieve objects related to an IP address by relationship type, including communicating or downloaded files and communicating URLs.

Get IP Address Report

Tool to retrieve the analysis report of an IP address.

Get VirusTotal Metadata

Tool to retrieve VirusTotal metadata.

Get URL Report

Tool to retrieve the analysis report of a URL.

Get Votes

Tool to retrieve votes on files, URLs, domains, or IP addresses.

Rescan File

Tool to re-analyze a previously submitted file.

Scan URL

Tool to submit a URL for scanning.

Search VirusTotal

Tool to search for objects in the VirusTotal database.

Upload File

Upload binary file content to VirusTotal for scanning.

FRAMEWORKS

How to build Virustotal MCP Agent with another framework

Claude Code

Use Virustotal MCP with Claude Code

Cursor

Use Virustotal MCP with Cursor

ChatGPT

Use Virustotal MCP with ChatGPT

Claude Cowork

Use Virustotal MCP with Claude Cowork

Antigravity

Use Virustotal MCP with Antigravity

OpenAI Agents SDK

Use Virustotal MCP with OpenAI Agents SDK

Claude Agent SDK

Use Virustotal MCP with Claude Agent SDK

Codex

Use Virustotal MCP with Codex

Grok Build

Use Virustotal MCP with Grok Build

VS Code

Use Virustotal MCP with VS Code

OpenCode

Use Virustotal MCP with OpenCode

OpenClaw

Use Virustotal MCP with OpenClaw

Hermes

Use Virustotal MCP with Hermes

Atomic Agent

Use Virustotal MCP with Atomic Agent

Pi

Use Virustotal MCP with Pi

DeepSeek Harness

Use Virustotal MCP with DeepSeek Harness

Google ADK

Use Virustotal MCP with Google ADK

Vercel AI SDK

Use Virustotal MCP with Vercel AI SDK

Mastra AI

Use Virustotal MCP with Mastra AI

LlamaIndex

Use Virustotal MCP with LlamaIndex

CrewAI

Use Virustotal MCP with CrewAI

Pydantic AI

Use Virustotal MCP with Pydantic AI

AutoGen

Use Virustotal MCP with AutoGen

MORE TOOLKITS

Explore Other Toolkits

Toolkit marketplace

Firecrawl

Api Key

Firecrawl automates large-scale web crawling and data extraction. It helps organizations efficiently gather, index, and analyze content from online sources.

Tavily

Api Key

Tavily offers powerful search and data retrieval from documents, databases, and the web. It helps teams locate and filter information instantly, saving hours on research.

Exa

Api Key

Exa is a data extraction and search platform for gathering and analyzing information from websites, APIs, or databases. It helps teams quickly surface insights and automate data-driven workflows.

Serpapi

Api Key

SerpApi is a real-time API for structured search engine results. It lets you automate SERP data collection, parsing, and analysis for SEO and research.

FAQ

Frequently asked questions

With a standalone Virustotal MCP server, the agents and LLMs can only access a fixed set of Virustotal tools tied to that server. However, with the Composio Tool Router, agents can dynamically load tools from Virustotal and many other apps based on the task at hand, all through a single MCP endpoint.

Yes, you can. LangChain fully supports MCP integration. You get structured tool calling, message history handling, and model orchestration while Tool Router takes care of discovering and serving the right Virustotal tools.

Yes, absolutely. You can configure which Virustotal scopes and actions are allowed when connecting your account to Composio. You can also bring your own OAuth credentials or API configuration so you keep full control over what the agent can do.

All sensitive data such as tokens, keys, and configuration is fully encrypted at rest and in transit. Composio is SOC 2 Type 2 compliant and follows strict security practices so your Virustotal data and credentials are handled as safely as possible.

Start with Virustotal.It takes 30 seconds.

Managed auth, hosted MCP servers, and every Virustotal tool your agent needs.Free to start.

Start building

How to integrate Virustotal MCP with LangChain

Connect Virustotal without auth hassles

Introduction

Also integrate Virustotal with

TL;DR

What is LangChain?

What is the Virustotal MCP server, and what's possible with it?

What is the Composio tool router, and how does it fit here?

What is Composio SDK?

How the Composio SDK works

Step-by-step Guide

Prerequisites

Getting API Keys for OpenAI and Composio

Install dependencies

Set up environment variables

Import dependencies

Initialize Composio client

Create a Tool Router session

Configure the agent with the MCP URL

Set up interactive chat interface

Run the application

Complete Code

Conclusion

Supported Tools

How to build Virustotal MCP Agent with another framework

Claude Code

Cursor

ChatGPT

Claude Cowork

Antigravity

OpenAI Agents SDK

Claude Agent SDK

Codex

Grok Build

VS Code

OpenCode

OpenClaw

Hermes

Atomic Agent

Pi

DeepSeek Harness

Google ADK

Vercel AI SDK

Mastra AI

LlamaIndex

CrewAI

Pydantic AI

AutoGen

Explore Other Toolkits

Firecrawl

Tavily

Exa

Serpapi

Frequently asked questions

What are the differences in Tool Router MCP and Virustotal MCP?

Can I use Tool Router MCP with LangChain?

Can I manage the permissions and scopes for Virustotal while using Tool Router?

How safe is my data with Composio Tool Router?

Start with Virustotal.It takes 30 seconds.