`lookup_url`

Pack: virustotal · Endpoint: https://gateway.pipeworx.io/virustotal/mcp

Look up a URL’s reputation. Returns last-analysis stats across all engines, categories (per vendor), and whether the URL has been redirected. The URL is canonicalized before lookup; no submission step is required to read existing reports.

Parameters

Name	Type	Required	Description
`url`	string	yes	Full URL including scheme

Example call

Arguments

{
  "url": "https://example.com/malware"
}

curl

curl -X POST https://gateway.pipeworx.io/virustotal/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"lookup_url","arguments":{"url":"https://example.com/malware"}}}'

TypeScript (@pipeworx/sdk)

import { Pipeworx } from '@pipeworx/sdk';
const pipeworx = new Pipeworx();

const result = await pipeworx.call('lookup_url', {
  "url": "https://example.com/malware"
});

More examples

{
  "url": "http://suspicious-domain.net/phishing-page"
}

Response shape

Always returns: type, id, stats, reputation, community_votes, tags, last_analyzed_at, raw_attributes, vt_url

Field	Type	Description
`type`	string	Resource type (e.g., ‘urls’)
`id`	string \| null	VirusTotal URL identifier
`stats`	object
`reputation`	number \| null	Reputation score from community
`community_votes`	object \| null
`tags`	array	Tags assigned to the URL
`last_analyzed_at`	string \| null	ISO 8601 timestamp of last analysis
`raw_attributes`	object	Full attributes object from VirusTotal API
`vt_url`	string \| null	Direct link to VirusTotal URL report

Full JSON Schema

{
  "type": "object",
  "properties": {
    "type": {
      "type": "string",
      "description": "Resource type (e.g., 'urls')"
    },
    "id": {
      "type": [
        "string",
        "null"
      ],
      "description": "VirusTotal URL identifier"
    },
    "stats": {
      "type": "object",
      "properties": {
        "malicious": {
          "type": "integer",
          "description": "Number of engines detecting as malicious"
        },
        "suspicious": {
          "type": "integer",
          "description": "Number of engines detecting as suspicious"
        },
        "harmless": {
          "type": "integer",
          "description": "Number of engines detecting as harmless"
        },
        "undetected": {
          "type": "integer",
          "description": "Number of engines with no detection"
        },
        "total_engines": {
          "type": "integer",
          "description": "Total engines that analyzed the URL"
        },
        "malicious_pct": {
          "type": "number",
          "description": "Percentage of engines detecting as malicious"
        }
      },
      "required": [
        "malicious",
        "suspicious",
        "harmless",
        "undetected",
        "total_engines",
        "malicious_pct"
      ]
    },
    "reputation": {
      "type": [
        "number",
        "null"
      ],
      "description": "Reputation score from community"
    },
    "community_votes": {
      "type": [
        "object",
        "null"
      ],
      "properties": {
        "harmless": {
          "type": "integer",
          "description": "Community votes for harmless"
        },
        "malicious": {
          "type": "integer",
          "description": "Community votes for malicious"
        }
      }
    },
    "tags": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Tags assigned to the URL"
    },
    "last_analyzed_at": {
      "type": [
        "string",
        "null"
      ],
      "description": "ISO 8601 timestamp of last analysis"
    },
    "raw_attributes": {
      "type": "object",
      "description": "Full attributes object from VirusTotal API"
    },
    "vt_url": {
      "type": [
        "string",
        "null"
      ],
      "description": "Direct link to VirusTotal URL report"
    }
  },
  "required": [
    "type",
    "id",
    "stats",
    "reputation",
    "community_votes",
    "tags",
    "last_analyzed_at",
    "raw_attributes",
    "vt_url"
  ]
}

Connect

Add this to your MCP client config, or use one-click install buttons:

{
  "mcpServers": {
    "virustotal": {
      "url": "https://gateway.pipeworx.io/virustotal/mcp"
    }
  }
}

See Getting Started for client-specific install steps.

lookup_url