---
title: "Connect VirusTotal to ChatGPT: Analyze Malware and Threat Verdicts"
slug: connect-virustotal-to-chatgpt-analyze-malware-and-threat-verdicts
date: 2026-09-04
author: Nidhi KN
categories: ["AI & Agents"]
excerpt: "Learn how to connect VirusTotal to ChatGPT using Truto's managed MCP server. Automate threat intelligence, malware analysis, and IoC lookups with AI agents."
tldr: "Connect VirusTotal to ChatGPT using Truto's SuperAI MCP Server. This guide shows how to generate tools dynamically, handle JSON:API complexities, and orchestrate automated threat hunting workflows."
canonical: https://truto.one/blog/connect-virustotal-to-chatgpt-analyze-malware-and-threat-verdicts/
---

# Connect VirusTotal to ChatGPT: Analyze Malware and Threat Verdicts


If you need to connect VirusTotal to ChatGPT to automate threat intelligence gathering, analyze malware samples, or investigate suspicious IPs and domains, you need a [Model Context Protocol (MCP)](https://truto.one/blog/what-is-mcp-model-context-protocol-the-2026-guide-for-saas-pms/) server. This server acts as the translation layer between ChatGPT's function-calling capabilities and the highly structured VirusTotal v3 REST API. You can either spend weeks building and maintaining this infrastructure yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL.

If your team uses Claude, check out our guide on [connecting VirusTotal to Claude](https://truto.one/blog/connect-virustotal-to-claude-investigate-iocs-and-threat-graphs/) or explore our broader architectural overview on [connecting VirusTotal to AI Agents](https://truto.one/blog/connect-virustotal-to-ai-agents-automate-hunting-and-threat-scans/).

Giving a Large Language Model (LLM) read and write access to a threat intelligence platform like VirusTotal is a massive engineering challenge. You have to handle asynchronous analysis jobs, complex JSON:API payload structures, and composite object identifiers. Every time you need a new intelligence endpoint, your custom server code must be updated, redeployed, and tested. 

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for VirusTotal, connect it natively to ChatGPT, and execute complex security operations using natural language.

::cta{buttonText="Talk to us" buttonUrl="/book-a-demo/"}
Stop writing boilerplate API integration code. Let Truto generate secure, managed MCP servers for your [AI agents](https://truto.one/blog/connect-virustotal-to-ai-agents-automate-hunting-and-threat-scans/) in seconds.
:::

## The Engineering Reality of the VirusTotal API

A custom MCP server is a self-hosted integration layer. While the [open MCP standard](https://truto.one/blog/what-is-mcp-and-mcp-servers-and-how-do-they-work/) provides a predictable way for models to discover tools, implementing it against VirusTotal's API requires understanding its highly specific design patterns. 

If you decide to build a custom MCP server for VirusTotal, you own the entire API lifecycle. Here are the specific integration challenges that break standard CRUD assumptions when working with VirusTotal:

### The JSON:API Specification Complexities
The VirusTotal v3 API adheres strictly to the JSON:API specification. Responses do not return flat JSON objects. Instead, they return nested payloads containing `data`, `attributes`, `links`, and `meta`. Relational data is often decoupled. When an LLM asks "What are the communicating files for this IP address?", a standard GET request will return a list of related object IDs, but the LLM must know how to parse the `relationships` block and execute subsequent calls to fetch the actual file attributes. Building static MCP schemas for this requires writing a schema parser that normalizes JSON:API structures into flat tool arguments. If you skip this, your LLM will hallucinate nested attributes or fail to extract the vendor verdicts.

### Asynchronous Analysis and Polling
When you scan a URL or upload a file to VirusTotal, the API does not return the results immediately. Instead, it returns an `Analysis` object containing an ID (e.g., `MjAy...`). To get the actual vendor verdicts, the client must poll the `/analyses/{id}` endpoint until the status changes from `queued` to `completed`. LLMs are stateless by default and struggle with asynchronous polling loops. Your MCP server must either wrap this polling logic into a single synchronous tool execution (which risks timeouts) or explicitly expose both the "scan" and "get analysis" tools, providing the LLM with strict system prompts on how to chain them together.

### Composite Identifiers
VirusTotal uses complex composite identifiers for certain objects. For example, a DNS resolution ID is not a standard UUID - it is formed by concatenating the IP address and the domain it resolves to. A File Behaviour sandbox report ID combines the analysed file's SHA256 hash and the sandbox name, joined by an underscore (e.g., `[SHA256]_Tencent HABO`). If an LLM tries to query a file behaviour report using just the SHA256 hash, the API will return a 404. Your MCP server must enforce strict input validation schemas to ensure the LLM constructs these IDs correctly before execution.

### Transparent Rate Limit Handling
VirusTotal enforces strict rate limits, especially on free tier accounts (e.g., 4 requests per minute). It is critical to note that Truto does not retry, throttle, or apply backoff on rate limit errors. When the VirusTotal API returns an HTTP 429 Too Many Requests, Truto passes that error directly to the caller. Truto normalizes the upstream rate limit information into standardized headers (`ratelimit-limit`, `ratelimit-remaining`, `ratelimit-reset`) per the IETF spec. The caller (your LLM framework or ChatGPT client) is entirely responsible for reading the `ratelimit-reset` header and initiating retry/backoff logic.

## How to Create and Connect the VirusTotal MCP Server

Truto dynamically generates MCP tools from the integration's underlying resource definitions and documentation. Tools are never pre-built or cached. 

### Step 1: Create the MCP Server

You can generate an MCP server scoped specifically to an authenticated VirusTotal account using either the Truto UI or the API.

**Method A: Via the Truto UI**
1. Navigate to the **Integrated Accounts** page in your Truto dashboard and select your connected VirusTotal account.
2. Click the **MCP Servers** tab.
3. Click **Create MCP Server**.
4. Select your desired configuration (e.g., name the server "VirusTotal Analyst", filter for `read` methods, and add tags like `files` and `domains`).
5. Click **Create** and securely copy the generated MCP server URL (it will look like `https://api.truto.one/mcp/a1b2c3d4...`).

**Method B: Via the API**
Make a POST request to the Truto API to generate a secure token. This scopes the server to a specific integrated account.

```bash
curl -X POST https://api.truto.one/integrated-account/{integrated_account_id}/mcp \
  -H "Authorization: Bearer YOUR_TRUTO_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "VirusTotal ChatGPT Server",
    "config": {
      "methods": ["read", "write", "custom"],
      "tags": ["threat_intel", "malware"]
    }
  }'
```

The API validates the configuration, ensures the integration is AI-ready, and returns a payload containing the `url`. This URL contains the cryptographic token required for authentication.

### Step 2: Connect the Server to ChatGPT

Once you have your MCP server URL, you must register it with ChatGPT so the model can discover and call the tools.

**Method A: Via the ChatGPT UI**
1. Open ChatGPT and navigate to **Settings -> Apps -> Advanced settings**.
2. Enable the **Developer mode** toggle.
3. Under the MCP servers / Custom connectors section, click to add a new server.
4. Set the **Name** to "VirusTotal".
5. Paste your Truto MCP URL into the **Server URL** field.
6. Click **Save**. ChatGPT will immediately perform a handshake, call `tools/list`, and populate its context with the available VirusTotal operations.

**Method B: Via Manual Config File**
If you are using a local development environment, Claude Desktop, or a custom LangChain/LangGraph agent, you can connect using a standard JSON configuration file. Use the Server-Sent Events (SSE) transport approach:

```json
{
  "mcpServers": {
    "virustotal": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "--url",
        "https://api.truto.one/mcp/a1b2c3d4e5f6..."
      ]
    }
  }
}
```

## High-Leverage VirusTotal Hero Tools

Exposing the entire VirusTotal API to an LLM at once can overwhelm its context window. Truto allows you to filter tools by tags and methods. Here are the highest-leverage tools you should expose for security analysis.

### get_single_virus_total_file_by_id
Retrieves a complete VirusTotal file report by its SHA-256, SHA-1, or MD5 hash. This includes the threat reputation, context from over 70 antivirus products, and outputs from dynamic analysis sandboxes. 

*Usage Note:* The LLM must pass a valid hash. If the file has never been seen by VirusTotal, it will return a 404. 

> "Check the reputation of this file hash: 44d88612fea8a8f36de82e1278abb02f. Tell me how many vendors flagged it as malicious and what the primary threat category is."

### get_single_virus_total_ip_address_by_id
Fetches an IP address report, including its threat reputation, routing information, and historical context from security tools.

*Usage Note:* IP reputation changes rapidly. The `last_analysis_stats` attribute inside the payload provides the breakdown of harmless, malicious, and suspicious verdicts.

> "Look up the IP address 93.184.216.34 on VirusTotal. Provide a summary of its current threat verdicts and identify the autonomous system owner."

### get_single_virus_total_domain_by_id
Retrieves a domain report, including its threat reputation, Whois information, and historical analysis context.

*Usage Note:* This is critical for phishing investigations. The tool returns categorized verdicts from security vendors indicating if the domain hosts malware, phishing kits, or spam.

> "Investigate the domain secure-login-update-auth.com. Tell me its creation date, the registrar, and if any vendors consider it a phishing threat."

### create_a_virus_total_url
Submits a URL to VirusTotal for active scanning across all integrated antivirus engines. 

*Usage Note:* This tool returns an analysis descriptor ID, not the final results. The LLM must be instructed to use the `get_single_virus_total_analysis_by_id` tool with the returned ID to fetch the actual verdicts.

> "Submit this URL for a fresh scan: http://suspicious-download-site.net/payload.exe. Once the scan is initiated, retrieve the analysis results and summarize the findings."

### virus_total_files_get_behaviour_summary
Fetches a merged behavioural summary for a file, combining sandbox execution reports from all integrated VirusTotal sandboxes.

*Usage Note:* This is invaluable for dynamic analysis without running the malware yourself. It exposes registry keys modified, processes created, and HTTP requests made during execution.

> "Get the behavioural summary for the file hash 8b5c90a1... List all external IP addresses it attempted to contact and any registry keys it modified for persistence."

### virus_total_intelligence_search_search
Searches files in VirusTotal's dataset using the advanced Intelligence query syntax (same as the VT Intelligence UI). 

*Usage Note:* This tool requires a VirusTotal Enterprise license. It allows for complex threat hunting using modifiers like `type:peexe size:1MB+ positives:5+`.

> "Run an intelligence search for executable files larger than 1MB that have at least 5 positive detections and are tagged with ransomware. Return the top 3 file hashes."

To see the complete tool inventory, including endpoints for YARA rules, Livehunt notifications, and object relationships, view the [VirusTotal integration page](https://truto.one/integrations/detail/virustotal).

## Workflows in Action

Once connected, ChatGPT can orchestrate multi-step threat intelligence tasks autonomously. Here are real-world security workflows.

### Scenario 1: SOC Alert Triage and Contextualization
A Security Operations Center (SOC) analyst receives an alert regarding an endpoint beaconing to a suspicious IP. They need immediate context to determine if this is a true positive.

> "I see outbound traffic to 185.122.204.197. Check this IP on VirusTotal. If it is flagged as malicious, check its related domains. Summarize the threat level."

1. ChatGPT calls `get_single_virus_total_ip_address_by_id` passing the IP `185.122.204.197`.
2. The model parses the `last_analysis_stats` in the response and identifies 12 malicious verdicts.
3. ChatGPT calls `virus_total_ip_addresses_list_relationships` with the IP and the relationship `resolutions` to find domains mapped to this IP.
4. ChatGPT processes the relationships and outputs a summary detailing the malicious IP, the known malware command-and-control domains hosted there, and a recommendation to block the traffic.

### Scenario 2: Phishing URL Analysis
An IT admin receives an employee report of a suspicious email containing a link. They need to analyze the link safely without clicking it.

> "Scan this link on VirusTotal: http://update-portal-auth-365.com/login. Wait for the scan to finish and tell me the vendor verdicts."

```mermaid
sequenceDiagram
  participant User as User
  participant ChatGPT as ChatGPT
  participant Truto as Truto MCP
  participant VT as "VirusTotal API"
  User->>ChatGPT: "Scan this link..."
  ChatGPT->>Truto: Call create_a_virus_total_url
  Truto->>VT: POST /urls
  VT-->>Truto: Analysis ID (async)
  Truto-->>ChatGPT: Return Analysis ID (e.g. u-12345)
  ChatGPT->>Truto: Call get_single_virus_total_analysis_by_id(u-12345)
  Truto->>VT: GET /analyses/u-12345
  VT-->>Truto: Status: completed, Stats: 8 malicious
  Truto-->>ChatGPT: Return Analysis Result
  ChatGPT-->>User: "Scan complete. 8 vendors flag this as phishing."
```

1. ChatGPT calls `create_a_virus_total_url` with the URL.
2. The Truto proxy executes the POST request and returns the resulting `id` and `type` (analysis).
3. ChatGPT reads the analysis ID and immediately calls `get_single_virus_total_analysis_by_id` using the ID.
4. The model parses the analysis `status`. If it is `completed`, it reads the stats. If it is `queued`, it waits a few seconds and retries the call. 
5. ChatGPT returns a detailed breakdown of the phishing verdicts to the admin.

### Scenario 3: Malware Behaviour Analysis
A malware researcher has a hash of a dropped payload and wants to understand what the file does upon execution, without detonating it in their own sandbox.

> "Get the behaviour summary for hash 5e52bfc4... What processes does it spawn, and what files does it drop?"

1. ChatGPT calls `virus_total_files_get_behaviour_summary` using the provided hash.
2. The Truto proxy fetches the merged sandbox data.
3. ChatGPT analyzes the JSON response, specifically extracting data from the `processes_created` and `files_dropped` attribute arrays.
4. The model outputs a clean, bulleted list of the exact executable paths spawned by the malware and the specific directories where it dropped secondary payloads, providing immediate indicators of compromise (IoCs) for the researcher.

## Security and Access Control

Exposing an enterprise VirusTotal account to an LLM requires strict boundary management. Truto enforces security at the infrastructure layer through configuration options on the MCP token.

*   **Method Filtering:** Restrict the LLM's capabilities by defining allowed operations. Set `config.methods` to `["read"]` to allow ChatGPT to lookup hashes and domains, while preventing it from submitting new files or casting votes via `create` methods.
*   **Tag Filtering:** Limit the surface area of the MCP server. Set `config.tags` to `["ip_addresses", "domains"]` so the server only exposes tools related to network infrastructure, completely hiding user management or Livehunt ruleset tools.
*   **Extra Authentication (`require_api_token_auth`):** By default, possessing the MCP URL grants access to the tools. By setting this flag to `true`, callers must also pass a valid Truto API token in the Authorization header. This ensures that even if the MCP URL leaks in a log file, unauthorized users cannot execute VirusTotal queries.
*   **Time-to-Live (`expires_at`):** Generate ephemeral MCP servers for specific incident response tasks. Setting an expiration date ensures the server and its corresponding Cloudflare KV entries are automatically destroyed by a scheduled durable object alarm once the incident is resolved.

## Wrap Up

Connecting VirusTotal to ChatGPT transforms an LLM from a generic chatbot into a highly capable SOC assistant. Standardizing the complex JSON:API structures and managing the underlying protocol translation through a managed MCP server removes weeks of custom integration work.

By leveraging Truto, engineering and security teams can dynamically generate secure, scoped tools that allow AI agents to safely hunt for threats, analyze behaviors, and triage alerts at machine speed—all while relying on a production-ready proxy architecture.