{"openapi":"3.1.0","info":{"title":"VirusTotal (BYOK) API","version":"0.1.0","description":"VirusTotal (BYOK) lets an AI assistant read your own VirusTotal data through the VirusTotal API with a key you supply (VirusTotal API key). Read-only: 6 tools (get_ip_report, get_domain_report, get_file_report, get_url_report, get_domain_relationship, get_ip_comments). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-virustotal.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-virustotal/docs"},"termsOfService":"https://connectorbay.com/byok-virustotal/terms"},"servers":[{"url":"https://byok-virustotal.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-virustotal/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/get_ip_report":{"post":{"operationId":"get_ip_report","summary":"Look up an IP address in VirusTotal: antivirus verdict counts, owner (AS), country, reputation, tags and community votes","description":"Look up an IP address in VirusTotal: antivirus verdict counts, owner (AS), country, reputation, tags and community votes. Only reads an existing report. Use for \"Is the IP address 8.8.8.8 flagged as malicious on VirusTotal\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"ip":{"description":"IPv4 or IPv6 address to look up, for example '8.8.8.8'.","maxLength":45,"title":"Ip","type":"string"}},"required":["ip"],"title":"get_ip_reportArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_domain_report":{"post":{"operationId":"get_domain_report","summary":"Look up a domain in VirusTotal: antivirus verdict counts, registrar, creation date, categories, reputation, tags, DNS re","description":"Look up a domain in VirusTotal: antivirus verdict counts, registrar, creation date, categories, reputation, tags, DNS records and popularity ranks. Use for \"What does VirusTotal say about the domain example.com\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"domain":{"description":"Domain name to look up, for example 'example.com'.","maxLength":253,"title":"Domain","type":"string"}},"required":["domain"],"title":"get_domain_reportArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_file_report":{"post":{"operationId":"get_file_report","summary":"Look up a file by hash in VirusTotal: antivirus verdict counts, names, size, type, reputation and tags. Use for \"Is the ","description":"Look up a file by hash in VirusTotal: antivirus verdict counts, names, size, type, reputation and tags. Use for \"Is the file with this SHA-256 hash known as malware on VirusTotal\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"hash":{"description":"SHA-256, SHA-1 or MD5 hash of the file (hex).","maxLength":64,"title":"Hash","type":"string"}},"required":["hash"],"title":"get_file_reportArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_url_report":{"post":{"operationId":"get_url_report","summary":"Look up a URL in VirusTotal by its identifier: antivirus verdict counts, title, final URL after redirects, HTTP status, ","description":"Look up a URL in VirusTotal by its identifier: antivirus verdict counts, title, final URL after redirects, HTTP status, reputation and tags. Only reads an existing report; it does not submit the URL. Use for \"What is the VirusTotal verdict for the URL http://example.com/\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"id":{"description":"URL identifier: the URL encoded as URL-safe base64 without padding, or the SHA-256 of the URL. Example: 'aHR0cDovL2V4YW1wbGUuY29tLw'.","maxLength":300,"title":"Id","type":"string"}},"required":["id"],"title":"get_url_reportArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_domain_relationship":{"post":{"operationId":"get_domain_relationship","summary":"List objects related to a domain, such as DNS resolutions, subdomains, siblings, files that communicate with it or histo","description":"List objects related to a domain, such as DNS resolutions, subdomains, siblings, files that communicate with it or historical WHOIS. Returns the related objects as VirusTotal returns them. Use for \"What subdomains of example.com does VirusTotal know about\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"domain":{"description":"Domain name, for example 'example.com'.","maxLength":253,"title":"Domain","type":"string"},"relationship":{"description":"Which related objects: resolutions, subdomains, siblings, communicating_files, referrer_files, historical_whois, historical_ssl_certificates, parent or comments.","enum":["resolutions","subdomains","siblings","communicating_files","referrer_files","historical_whois","historical_ssl_certificates","parent","comments"],"title":"Relationship","type":"string"},"limit":{"anyOf":[{"maximum":40,"minimum":1,"type":"integer"},{"type":"null"}],"default":10,"description":"How many items to return (default 10; the docs state no maximum, keep it small).","title":"Limit"},"cursor":{"anyOf":[{"maxLength":500,"type":"string"},{"type":"null"}],"default":null,"description":"Continuation cursor from the previous answer (meta.cursor) to get the next page.","title":"Cursor"}},"required":["domain","relationship"],"title":"get_domain_relationshipArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_ip_comments":{"post":{"operationId":"get_ip_comments","summary":"List community comments on an IP address in VirusTotal. Returns the comment objects as VirusTotal returns them. Use for ","description":"List community comments on an IP address in VirusTotal. Returns the comment objects as VirusTotal returns them. Use for \"What do people comment about the IP 8.8.8.8 on VirusTotal\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"ip":{"description":"IPv4 or IPv6 address, for example '8.8.8.8'.","maxLength":45,"title":"Ip","type":"string"},"limit":{"anyOf":[{"maximum":40,"minimum":1,"type":"integer"},{"type":"null"}],"default":10,"description":"How many items to return (default 10; the docs state no maximum, keep it small).","title":"Limit"},"cursor":{"anyOf":[{"maxLength":500,"type":"string"},{"type":"null"}],"default":null,"description":"Continuation cursor from the previous answer (meta.cursor) to get the next page.","title":"Cursor"}},"required":["ip"],"title":"get_ip_commentsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}