`lookup_domain`

Pack: virustotal · Endpoint: https://gateway.pipeworx.io/virustotal/mcp

Look up a domain’s reputation via VirusTotal (no scheme, e.g. “example.com”). Returns engine analysis stats (malicious/suspicious/harmless/undetected counts and percent), reputation score, community votes, tags, last-analyzed date, and a link to the VirusTotal GUI report.

Parameters

Name	Type	Required	Description
`domain`	string	yes	FQDN (no scheme)

Example call

Arguments

{
  "domain": "malicious-site.com"
}

curl

curl -X POST https://gateway.pipeworx.io/virustotal/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"lookup_domain","arguments":{"domain":"malicious-site.com"}}}'

TypeScript (@pipeworx/sdk)

import { Pipeworx } from '@pipeworx/sdk';
const pipeworx = new Pipeworx();

const result = await pipeworx.call('lookup_domain', {
  "domain": "malicious-site.com"
});

More examples

{
  "domain": "example.org"
}

Response shape

Always returns: type, id, stats, reputation, community_votes, tags, last_analyzed_at, raw_attributes, vt_url

Field	Type	Description
`type`	string	Resource type (e.g., ‘domains’)
`id`	string \| null	VirusTotal domain identifier
`stats`	object
`reputation`	number \| null	Reputation score from community
`community_votes`	object \| null
`tags`	array	Tags assigned to the domain
`last_analyzed_at`	string \| null	ISO 8601 timestamp of last analysis
`raw_attributes`	object	Full attributes object from VirusTotal API
`vt_url`	string \| null	Direct link to VirusTotal domain report

Full JSON Schema

{
  "type": "object",
  "properties": {
    "type": {
      "type": "string",
      "description": "Resource type (e.g., 'domains')"
    },
    "id": {
      "type": [
        "string",
        "null"
      ],
      "description": "VirusTotal domain identifier"
    },
    "stats": {
      "type": "object",
      "properties": {
        "malicious": {
          "type": "integer",
          "description": "Number of engines detecting as malicious"
        },
        "suspicious": {
          "type": "integer",
          "description": "Number of engines detecting as suspicious"
        },
        "harmless": {
          "type": "integer",
          "description": "Number of engines detecting as harmless"
        },
        "undetected": {
          "type": "integer",
          "description": "Number of engines with no detection"
        },
        "total_engines": {
          "type": "integer",
          "description": "Total engines that analyzed the domain"
        },
        "malicious_pct": {
          "type": "number",
          "description": "Percentage of engines detecting as malicious"
        }
      },
      "required": [
        "malicious",
        "suspicious",
        "harmless",
        "undetected",
        "total_engines",
        "malicious_pct"
      ]
    },
    "reputation": {
      "type": [
        "number",
        "null"
      ],
      "description": "Reputation score from community"
    },
    "community_votes": {
      "type": [
        "object",
        "null"
      ],
      "properties": {
        "harmless": {
          "type": "integer",
          "description": "Community votes for harmless"
        },
        "malicious": {
          "type": "integer",
          "description": "Community votes for malicious"
        }
      }
    },
    "tags": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Tags assigned to the domain"
    },
    "last_analyzed_at": {
      "type": [
        "string",
        "null"
      ],
      "description": "ISO 8601 timestamp of last analysis"
    },
    "raw_attributes": {
      "type": "object",
      "description": "Full attributes object from VirusTotal API"
    },
    "vt_url": {
      "type": [
        "string",
        "null"
      ],
      "description": "Direct link to VirusTotal domain report"
    }
  },
  "required": [
    "type",
    "id",
    "stats",
    "reputation",
    "community_votes",
    "tags",
    "last_analyzed_at",
    "raw_attributes",
    "vt_url"
  ]
}

Connect

Add this to your MCP client config, or use one-click install buttons:

{
  "mcpServers": {
    "virustotal": {
      "url": "https://gateway.pipeworx.io/virustotal/mcp"
    }
  }
}

See Getting Started for client-specific install steps.

lookup_domain