| name | virus-total |
| description | VirusTotal is a security analysis platform that aggregates antivirus engines, sandboxing, and threat intelligence to inspect files, URLs, domains, and IP addresses, allowing security teams and developers to detect malicious activity and automate reputation checks through its APIs. Read and write VirusTotal data through One: collections, graphs, files, comments, monitoritems, savedsearches and more, 160 actions with real parameter documentation. Use whenever the user asks to look something up in VirusTotal, create or update a record there, or build code against the VirusTotal API. |
VirusTotal through One
VirusTotal is a security analysis platform that aggregates antivirus engines, sandboxing, and threat intelligence to inspect files, URLs, domains, and IP addresses, allowing security teams and developers to detect malicious activity and automate reputation checks through its APIs.
One exposes VirusTotal through four MCP tools. The table below carries real action ids from One's knowledge base, so for a common operation you can skip search and go straight to reading the action's parameters.
How to run an action
- Find the action in the table below, or call
search_one_platform_actions with platform virus-total if it is not listed.
- Call
get_one_action_knowledge with the action id. Do this every time, including for actions in this table. The table gives you the id, not the parameters.
- Call
execute_one_action with parameters copied from that knowledge.
Never guess a parameter name, a body field, or an enum value. The knowledge has the real schema, and a guessed field is either a 400 or a silent write of the wrong thing.
Before you start
Call list_one_integrations once and confirm VirusTotal is connected. If it is missing, the user has not connected it: say so and point them at https://app.withone.ai rather than reaching for raw HTTP.
Each connection carries an access field. If it reports {"policy": "methods", "methods": ["GET"]} the agent is read-only here, so plan a read-only answer instead of attempting a write that will be refused.
Before a write
Creates, updates, deletes and sends land on a real VirusTotal account and cannot be recalled. State the action and the specific target in one line before the first write in a task, and let the user stop you. Reads need no confirmation.
Actions
Collections
| Action | Method | Path | Action id |
|---|
| Export Aggregations from a Collection | GET | /api/v3/collections/{{id}}/aggregations/download/{{format}} | conn_mod_def::GLV6uzmmAeg::kIuW3qdaSsS8MJMYpPNvCQ |
| Export IOCs from a Collection | GET | /api/v3/collections/{{id}}/download/{{format}} | conn_mod_def::GLV6uzUppXA::ycgv-frpRtSkE5PjU7tDpQ |
| Export IOCs from a Collection Relationship | GET | /api/v3/collections/{{id}}/{{relationship}}/download/{{format}} | conn_mod_def::GLV6uduJ2VA::-cgGJlxpTLaBiUsuXmKqYw |
| Get a Collection | GET | /api/v3/collections/{{id}} | conn_mod_def::GLV6v07UlOA::tXX8qGVOQ2agotLJcdlqUw |
| Get Comments on a Collection | GET | /api/v3/collections/{{id}}/comments | conn_mod_def::GLV6vinhxQA::7JfPw-DJSHepQN1jwfO5JA |
| Get Object Descriptors Related to a Collection | GET | /api/v3/collections/{{id}}/relationships/{{relationship}} | conn_mod_def::GLV6veyzfgg::tWLbgD2fTuObqzKYpzmAxQ |
| Get Objects Related to a Collection | GET | /api/v3/collections/{{id}}/{{relationship}} | conn_mod_def::GLV6vwou3cg::Qm0ex9vSSn2yaAzIs3QHWA |
| Get Subscription Preferences for a Collection | GET | /api/v3/collections/{{id}}/subscription_preferences | conn_mod_def::GLV6wXbBCBA::f6ZWvHCkT-2AIK31LjSsPA |
| List Collections | GET | /api/v3/collections | conn_mod_def::GLV6u0xSuTA::Op413ziUTeCWpvJNEnRGew |
| Search IoCs Inside a Collection | GET | /api/v3/collections/{{id}}/search | conn_mod_def::GLV6vTFz8gg::FZJFtpt2SWGfnwxRp0caNQ |
| Add a Comment to a Collection | POST | /api/v3/collections/{{id}}/comments |
5 more Collections actions are available through search.
Graphs
| Action | Method | Path | Action id |
|---|
| Check Editor for a Graph | GET | /api/v3/graphs/{{id}}/relationships/editors/{{userOrGroupId}} | conn_mod_def::GLV6z2C_5Xg::wWi-EwEfQ4SwsIOZmx_NvQ |
| Check Viewer for a Graph | GET | /api/v3/graphs/{{id}}/relationships/viewers/{{userOrGroupId}} | conn_mod_def::GLV60H_-t4g::L0JQX8tpQ1e71swWAsokIA |
| Get a Graph Object | GET | /api/v3/graphs/{{id}} | conn_mod_def::GLV60nkDGFA::KGMIogVvTimZ6qZ8_UZn-g |
| Get Comments on a Graph | GET | /api/v3/graphs/{{id}}/comments | conn_mod_def::GLV60hDhfKg::IDOJfXnsSAmPtxdI-zZmJQ |
| Get Editors for a Graph | GET | /api/v3/graphs/{{id}}/relationships/editors | conn_mod_def::GLV61N1lkoA::sC3B00L3R2ygwasd6VAoLQ |
| Get Objects Related to a Graph | GET | /api/v3/graphs/{{id}}/{{relationship}} | conn_mod_def::GLV60gky_sg::dimL3viOQ0iE_qRU1UGRew |
| Get Related Object Descriptors for a Graph | GET | /api/v3/graphs/{{id}}/relationships/{{relationship}} | conn_mod_def::GLV60vfsz4A::k0hfhXkEQDOQPDO5q1pDoA |
| Get Viewers for a Graph | GET | /api/v3/graphs/{{id}}/relationships/viewers | conn_mod_def::GLV61FVh1vA::v0Wl27adRsKAV-zKJBpvAg |
| Search Graphs | GET | /api/v3/graphs | conn_mod_def::GLV61bhZvfg::GV4TaCZOQIq-c0m94hBY1w |
| Add a Comment to a Graph | POST | /api/v3/graphs/{{id}}/comments | conn_mod_def::GLV60SbQhwg::LabgMkjRS72OturfUCy5PA |
| Add Editors to a Graph | POST | /api/v3/graphs/{{id}}/relationships/editors | conn_mod_def::GLV61ReQdOg::QDWL81_4Ra-pc6nEej-LBA |
|
5 more Graphs actions are available through search.
Files
| Action | Method | Path | Action id |
|---|
| Download a File | GET | /api/v3/files/{{id}}/download | conn_mod_def::GLV6yqnzPOA::qcKcRIRyQT-jOwzRO-Iwpg |
| Get a File Report | GET | /api/v3/files/{{id}} | conn_mod_def::GLV6y4V_HEg::e9Po4C5vRKikcBpbEZWkeg |
| Get Behaviour Summary for a File | GET | /api/v3/files/{{id}}/behaviour_summary | conn_mod_def::GLV6zK2pGog::_Uqv9WdXRtCgxuhBRgoEJg |
| Get Download URL for a File | GET | /api/v3/files/{{id}}/download_url | conn_mod_def::GLV6y4r8M2g::XgcX6KDxTMeFd0WRi5jftg |
| Get Objects Related to a File | GET | /api/v3/files/{{id}}/{{relationship}} | conn_mod_def::GLV6zm7o_hA::MFDZttnbR_6hxcijHkZdFQ |
| Get Related Object Descriptors for a File | GET | /api/v3/files/{{id}}/relationships/{{relationship}} | conn_mod_def::GLV6zjPfHbg::MuYP1PWwTT2hd-3Au7Ei7w |
| Get Upload URL for Large Files | GET | /api/v3/files/upload_url | conn_mod_def::GLV6y3t090A::qln5flYBTJe1IyoAab2ITg |
| Get Votes on a File | GET | /api/v3/files/{{id}}/votes | conn_mod_def::GLV6zmiy29g::CCqWtediTJaR1ZbI_JX2iA |
| Add a Comment to a File | POST | /api/v3/files/{{id}}/comments | conn_mod_def::GLV6yYNw_xg::nAaUlvgPSTCjTeeCJnrPlA |
| Add a Vote on a File | POST | /api/v3/files/{{id}}/votes | conn_mod_def::GLV6yqiFCsg::5cgRcU9VRDiS7_hD1eRzmQ |
| Analyse a File | POST | /api/v3/files/{{id}}/analyse | conn_mod_def::GLV60HgMyAg::yQHHVGvWRQiqEdFoTFMyig |
Comments
| Action | Method | Path | Action id |
|---|
| Get a Comment | GET | /api/v3/comments/{{id}} | conn_mod_def::GLV6wufobyg::7Tw_ShJdQY2ewwA1xt0U4A |
| Get Comments on a File | GET | /api/v3/files/{{id}}/comments | conn_mod_def::GLV6zsJK8JA::0bQv2qdHTcqpoRX6bTzOaQ |
| Get Comments on a URL | GET | /api/v3/urls/{{id}}/comments | conn_mod_def::GLV67xlqiWA::sF5m5WzzSMmb2H0JJcDJGw |
| Get Latest Comments | GET | /api/v3/comments | conn_mod_def::GLV6w3tUQbA::aFqBr886RR-h0-h2h8fb2g |
| Get Object Descriptors Related to a Comment | GET | /api/v3/comments/{{id}}/relationships/{{relationship}} | conn_mod_def::GLV6w0gOKHA::V_-bADrBQGW8MLT69jHMSw |
| Get Objects Related to a Comment | GET | /api/v3/comments/{{id}}/{{relationship}} | conn_mod_def::GLV6whF9JzA::6sniLcs_TOqsv2jrs5Iwow |
| Create a Comment Over a Hash | POST | /api/v3/monitor_partner/hashes/{{sha256}}/comments | conn_mod_def::GLV64aBtfyA::OGPZjWsrQIuRr8o0jUYAtA |
| Delete a Comment | DELETE | /api/v3/comments/{{id}} | conn_mod_def::GLV6wPdc_Hg::BLXZREIlSwecjDsX98tlWQ |
| Remove a Comment Detection for a Hash | DELETE | /api/v3/monitor_partner/comments/{{id}} | conn_mod_def::GLV65pjY5Eg::9bs6ICCST8Cmtg1LkWrs-Q |
| Vote a Comment | POST | /api/v3/comments/{{id}}/vote | conn_mod_def::GLV6v_doQHA::zLIQ5RxcQtOiDapIO1tl6w |
MonitorItems
| Action | Method | Path | Action id |
|---|
| Download a Monitor Item File | GET | /api/v3/monitor/items/{{id}}/download | conn_mod_def::GLV63zN-9Gg::pCAmcKKMRAqlJ2HVXRsZVA |
| Download URL for a Monitor Item | GET | /api/v3/monitor/items/{{id}}/download_url | conn_mod_def::GLV63fzuDoA::uN3mAPMIRUSiKlraklFIlA |
| Get a Monitor Item | GET | /api/v3/monitor/items/{{id}} | conn_mod_def::GLV64PvyvwA::_Dxjjv0IQO-uN5lnCU4WIQ |
| Get Owner of a Monitor Item | GET | /api/v3/monitor/items/{{id}}/owner | conn_mod_def::GLV64J19_ZA::RLruFIMRSmqDHOu2pz2fmw |
| Get Upload URL for Monitor Items | GET | /api/v3/monitor/items/upload_url | conn_mod_def::GLV63ffc7Bg::OnqVqdTKTSyj8EYTbAG-sQ |
| List Monitor Items | GET | /api/v3/monitor/items | conn_mod_def::GLV63ynsYMA::RPYVNBcETgSi3abGSSAFXw |
| Configure a Monitor Item | PATCH | /api/v3/monitor/items/{{id}}/config | conn_mod_def::GLV63WvX5-A::glzEkOZHSWa5eXpZyyn1eQ |
| Delete a VirusTotal Monitor Item | DELETE | /api/v3/monitor/items/{{id}} | conn_mod_def::GLV63z6WMCg::lLN9kxWpTEyIeHJs5xFiZw |
| Upload a File or Create a New Folder | POST | /api/v3/monitor/items | conn_mod_def::GLV64Zs1oqg::uxhjqDKsQWSmRQlQWK9kpQ |
SavedSearches
| Action | Method | Path | Action id |
|---|
| Get a Saved Search | GET | /api/v3/saved_searches/{{id}} | conn_mod_def::GLV66nKGkig::zjw6vgJmQMKZ_pK2NfDlpA |
| Get Object Descriptors Related to a Saved Search | GET | /api/v3/saved_searches/{{id}}/relationship/{{relationship}} | conn_mod_def::GLV67DeObng::NtkMgh-jStWSVyU1ticKEQ |
| Get Objects Related to a Saved Search | GET | /api/v3/saved_searches/{{id}}/{{relationship}} | conn_mod_def::GLV67I7IzLA::JRvj3AHHRy6sS2e4PnGegQ |
| List Saved Searches | GET | /api/v3/saved_searches | conn_mod_def::GLV66zXpXqg::7-wVZj6bSQe3mprzBHCu7Q |
| Create a Saved Search | POST | /api/v3/saved_searches | conn_mod_def::GLV66UVW22A::7ESvft0vQzKrW3Huxd3ZUA |
| Delete a Saved Search | DELETE | /api/v3/saved_searches/{{id}} | conn_mod_def::GLV66oWaHag::l2l-9SHATvynSfaKiCzDxQ |
| Revoke Access to a Saved Search | DELETE | /api/v3/saved_searches/{{id}}/relationship/{{access}} | conn_mod_def::GLV67GpKJfA::YG1w1Q-DSt6NT4d1DSt_qQ |
| Share a Saved Search | POST | /api/v3/saved_searches/{{id}}/relationship/{{access}} | conn_mod_def::GLV67FKFYrg::DHBS5eUOT6qtKs5J0jESuQ |
| Update a Saved Search | PATCH | /api/v3/saved_searches/{{id}} | conn_mod_def::GLV67dj8nTg::utQUByPVTqSdF3kS09PuKg |
Domains
| Action | Method | Path | Action id |
|---|
| Get a Domain Report | GET | /api/v3/domains/{{domain}} | conn_mod_def::GLV6xTILy5g::NXorvtQRSfyQRsD6iNHH4g |
| Get Object Descriptors Related to a Domain | GET | /api/v3/domains/{{domain}}/relationships/{{relationship}} | conn_mod_def::GLV6xVZmLTA::sNB_payRQEWhEHTKbnrHXQ |
| Get Related Objects for a Domain | GET | /api/v3/domains/{{domain}}/{{relationship}} | conn_mod_def::GLV6xDnX2Qg::tUkFLzV4RlGJ7QABi58ofg |
| Get Votes for a Domain | GET | /api/v3/domains/{{domain}}/votes | conn_mod_def::GLV6xgcEJog::NF5P2hXWQIaqTHOTJ3k9MQ |
| Add a Comment to a Domain | POST | /api/v3/domains/{{domain}}/comments | conn_mod_def::GLV6wj1rtGA::0c8-d-GgRG2IXE8e8fA7aw |
| Add a Vote to a Domain | POST | /api/v3/domains/{{domain}}/votes | conn_mod_def::GLV6xI32MgA::LRgon7piQMicodcJuQf5Yw |
| Reanalyze a Domain | POST | /api/v3/domains/{{id}}/analyse | conn_mod_def::GLV6xgbknFA::gP4K19pSSMikFQfI-FOi0w |
FileBehaviours
| Action | Method | Path | Action id |
|---|
| Get a File Behavior Report from a Sandbox | GET | /api/v3/file_behaviours/{{sandboxId}} | conn_mod_def::GLV6x88xanA::d9UUEXNkRiGbSzlLMRnyMA |
| Get EVTX File for a File Behaviour Analysis | GET | /api/v3/file_behaviours/{{sandboxId}}/evtx | conn_mod_def::GLV6yOzfIOg::cJHIQL8ZTMC21d9VYQjcsQ |
| Get Memdump for a File Behaviour Analysis | GET | /api/v3/file_behaviours/{{sandboxId}}/memdump | conn_mod_def::GLV6yr0u5eg::gmou6ELXTXypmWHHFAEniA |
| Get Object Descriptors Related to a Behaviour Report | GET | /api/v3/file_behaviours/{{sandboxId}}/relationships/{{relationship}} | conn_mod_def::GLV6x97Qqwg::N0wzVwKiR_yye-FPo_H0fg |
| Get Objects Related to a Behaviour Report | GET | /api/v3/file_behaviours/{{sandboxId}}/{{relationship}} | conn_mod_def::GLV6yHthHMg::9Ih6DOdPTY6Wnksk-y-eLQ |
| Get PCAP for a File Behavior Analysis | GET | /api/v3/file_behaviours/{{sandboxId}}/pcap | conn_mod_def::GLV6ybPPbXA::q3WADEdWQIiF-wPK-c8p8A |
| HTML Behaviour Report for a File Behaviour Sandbox | GET | /api/v3/file_behaviours/{{sandboxId}}/html | conn_mod_def::GLV6x-BpfzA::tJZB0_mJRTmGkSC4sF8nrg |
Urls
| Action | Method | Path | Action id |
|---|
| Get a URL Report | GET | /api/v3/urls/{{id}} | conn_mod_def::GLV68DNQVrA::06g2OTs9RfuvthMf3JQtww |
| Get Objects Related to a URL | GET | /api/v3/urls/{{id}}/{{relationship}} | conn_mod_def::GLV68cABykg::T3A4MdBJTaW5Mk5N2dkb9g |
| Get Related Object Descriptors for a URL | GET | /api/v3/urls/{{id}}/relationships/{{relationship}} | conn_mod_def::GLV67-Yt1Tg::qfmasK3tQh6-PdvpKdjbMg |
| Add a Comment on a URL | POST | /api/v3/urls/{{id}}/comments | conn_mod_def::GLV68FQXthg::M6W0jyfTRXCgGDakU0wnpw |
| Add a Vote on a URL | POST | /api/v3/urls/{{id}}/votes | conn_mod_def::GLV68Cn3NhA::vB-50xRxQXaCEK4K3PGoaA |
| Analyse a URL | POST | /api/v3/urls/{{id}}/analyse | conn_mod_def::GLV68QFPcjA::ZnzDa5mfTfuW8l-z8s9nfw |
Analyses
| Action | Method | Path | Action id |
|---|
| Get a URL / File Analysis | GET | /api/v3/analyses/{{id}} | conn_mod_def::GLV6tkT9wyg::aEe6bXrnQPSAlx6rPfdGpw |
| Get Object Descriptors Related to an Analysis | GET | /api/v3/analyses/{{id}}/relationships/{{relationship}} | conn_mod_def::GLV6tqceEAg::Ji1W4zzORhqS2sIApkjKtA |
| Get Objects Related to an Analysis | GET | /api/v3/analyses/{{id}}/{{relationship}} | conn_mod_def::GLV6tYiEsXA::UHsBAq7JTiWfsYNq8BxBzA |
| List Analyses for a File Hash | GET | /api/v3/monitor_partner/hashes/{{sha256}}/analyses | conn_mod_def::GLV641Zxvpg::9rKkk8UMRnm05CutTvsvYw |
IpAddresses
| Action | Method | Path | Action id |
|---|
| Get an IP Address Report | GET | /api/v3/ip_addresses/{{ip}} | conn_mod_def::GLV62qjwKbA::q1b7FmqwQhaqLqsrgHdXYg |
| Get Object Descriptors Related to an IP Address | GET | /api/v3/ip_addresses/{{ip}}/relationships/{{relationship}} | conn_mod_def::GLV62d5us6A::NRyL7gGOSh647et60N4yng |
| Add a Comment to an IP Address | POST | /api/v3/ip_addresses/{{ip}}/comments | conn_mod_def::GLV62VvcYug::ZEESZ2H_SXaVbn3idSf6HQ |
1 more IpAddresses actions are available through search.
This lists 90 of 160 actions. For anything not here, call search_one_platform_actions with platform virus-total. The full catalog is at https://www.withone.ai/knowledge/virus-total.
When a call fails
The error comes from VirusTotal, not from One. A 400 or 422 means your parameters do not match the schema, so re-read the knowledge and fix the field. A 401 or 403 means the connection needs re-authorizing, which no retry will fix. A 404 means the id is not on this account. A 429 means slow down. Never retry a write more than once: the first attempt may have landed.
Full catalog: https://www.withone.ai/knowledge/virus-total
Integration knowledge by One (withone.ai), licensed under One-Knowledge-1.0. Attribution must be preserved in derivative works.
