How to connect Virustotal to Claude Cowork

Cowork is Anthropic's AI agent for knowledge work. Think of it as Claude Code for everything else. It works autonomously with your computer, local files, and applications to accomplish complex tasks.

This guide walks you through the easiest and most secure way to connect your Virustotal account to Cowork via Composio Connect, enabling it to scan this file hash for malware, get analysis report for suspicious URL, retrieve domain reputation details, and more such actions on your behalf without compromising your account security.

Connecting Virustotal to Claude Cowork

1. Open Customize

In Claude Desktop, click Customize in the left sidebar, then select Connectors and click the + icon at the top.

2. Add the Composio MCP server

Click Add custom connector and paste in the Composio MCP server URL:

Claude Cowork is Anthropic's agent for general knowledge work. It can use your computer, files, and connected applications to complete longer-running tasks across your work tools.

With Composio Connect, Cowork can securely access apps like Virustotal through MCP without you sharing account credentials directly with the agent.

The Virustotal MCP server is an implementation of the Model Context Protocol that connects your AI agent and assistants like Claude, Cursor, etc directly to your Virustotal account. It provides structured and secure access to malicious file, URL, domain, and IP analysis, so your agent can perform actions like scanning files, retrieving threat reports, investigating domains, and posting comments or verdicts on your behalf.

• Comprehensive threat analysis retrieval: Instantly fetch detailed reports on files, URLs, domains, or IP addresses to understand their security reputation and scan results from dozens of antivirus engines.
• Relationship and metadata insights: Have your agent explore related entities—such as domains linked to a file, or files associated with an IP address—along with receiving broad metadata about available VirusTotal operations.
• Automated commenting and feedback: Use your agent to post contextual comments on any analyzed resource, making collaboration and documentation of findings much easier.
• Community-driven voting: Submit harmless or malicious verdicts on files and URLs after reviewing analysis, helping to crowdsource threat intelligence and improve detection accuracy.
• Latest user comment retrieval: Let your agent pull up the most recent comments on a file, URL, domain, or IP address to quickly access community feedback and insights.