Skip to content
VirusTotal AI

Your client. VirusTotal evidence.

Connect ChatGPT to VirusTotal

Connect with browser sign-in. No VirusTotal API key or Agent Token needed.

The published plugin does not require Developer mode. Installation and use depend on your ChatGPT account and workspace policies.

Add VirusTotal

Add VirusTotal to ChatGPT

  1. Open the published VirusTotal plugin using the installation link and select Install plugin.
  2. Connect VirusTotal when prompted. Continue with Google on VTAI, review the permissions and select Allow access. If needed, open the plugin's linked application and choose Connect under Connected accounts.
  3. Start a new chat, type @ and select VirusTotal. Ask for the domain report below and check the tool activity and returned report.

4. Make your first query

@VirusTotal Get the domain report for virustotal.com. Show the source, analysis date, coverage and report link.

Check the tool activity and returned source, analysis date, coverage and report link. This uses one query. A missing report or zero detections does not establish safety.

Analyze a ChatGPT attachment

When ChatGPT supplies an attachment file object and the user explicitly requests its upload, submit_attachment can fetch and hash those original bytes, subject to permissions and the sharing guidance. The tool accepts a public HTTPS download_url; file_id, file_name and mime_type are optional. Never invent a download URL or treat an arbitrary URL as a ChatGPT attachment. Installing the plugin does not prove this attachment workflow works in your host.

Connection help

If installation is unavailable, check your ChatGPT account and workspace policies. If no login opens or no tools appear, open the plugin's linked application and check Connected accounts; choose Connect or Connect another account if needed. After connecting, refresh the application's tools if that control is available and start a new chat. A response that only browses the public VirusTotal website does not verify an MCP connection. Do not paste an API key or Agent Token into chat or OAuth client fields.

Alternative: create a custom app
  1. For a custom setup, use an account or workspace that permits Developer mode and enable it in ChatGPT settings. Create a plugin/application named VirusTotal, or reuse your existing custom application.
  2. Enter the server URL below and choose OAuth. Leave Client ID and Client Secret empty for automatic registration. Create the application, install the custom plugin if prompted, and connect your account through Google and VTAI consent.
  3. Start a new chat and select your VirusTotal entry. Keep one working VirusTotal connection; preserve existing access and any pending submissions when switching setups.
https://ai.virustotal.com/mcp

Authentication: OAuth.

Compatibility and documentation

Setup guide · Client documentation

VirusTotal is published in the ChatGPT plugin directory. Browser consent, IP reports and automatic token renewal were verified separately in ChatGPT Work on 24 September 2026. Those checks did not cover hosted revocation, incremental permissions or writes; publication does not validate every workflow.

Choose another client · Instructions for agents

Your connections: review and revoke access

Free access, shared protection

Free quota: 60 queries per 60 seconds and 1,000 per UTC day per Agent Token or OAuth account; repeats, cached reports and unknown hashes count. Uploading a new file uses no query quota and is limited to 20 per minute and 500 per day. Creating extra identities to avoid limits is not permitted.

Submissions are shared with the VirusTotal community and partners. Upload files, submit URLs or request network reanalysis only when the user explicitly requests that action.

Full access limits and sharing policy

Query limits: 60 admitted queries per fixed 60-second window and 1000 per UTC day. Agent Tokens share the agent's allowance across REST and MCP; OAuth connections share the account's allowance. Unknown reports and upstream failures after admission count. Every repeated lookup counts again, including cached reports and hashes with no report. On 429, honor Retry-After and reuse your credential. File submissions first check whether the hash exists in VirusTotal. Only confirmed unknown files are uploaded, without using query quota, even when the query allowance is exhausted. A separate file contribution limit permits 20 admitted upload attempts per fixed 60-second window and 500 per UTC day, per Agent Token identity or OAuth account across connections. Failed or uncertain admitted attempts still count; known files and receipt recovery do not. Creating multiple identities or accounts to evade limits is not permitted. If the file is known, returning its existing report costs one query and no file is uploaded. Explicit hash lookups and analysis-result reads still count. The access check costs no query quota and does not report remaining quota.

Standard VirusTotal submissions share content with the security community and partners; they are not confidential. Upload files or attachments, submit URLs, or request domain/IP reanalysis only when the user explicitly requests that action. A missing report, an unfamiliar file or a suspicious indicator is not permission to submit it. Explain the sharing and ask before submitting the user's own documents, internal code, credentials or personal data. Submission tools add no per-call confirmation; client permissions still apply.

Need a result in this session?

Use the REST quickstart with an existing Agent Token. No MCP installation is required.