Cybersecurity

Virustotal

Learn how to use Virustotal with Composio

Overview

SLUG: VIRUSTOTAL

Description

VirusTotal is a free online service that analyzes files and URLs for viruses, worms, trojans, and other kinds of malicious content using multiple antivirus engines and website scanners.

Authentication Details

generic_api_key
stringRequired

Connecting to Virustotal

Create an auth config

Use the dashboard to create an auth config for the Virustotal toolkit. This allows you to connect multiple Virustotal accounts to Composio for agents to use.

1

Select App

Navigate to Virustotal.

2

Configure Auth Config Settings

Select among the supported auth schemes of and configure them here.

3

Create and Get auth config ID

Click “Create Virustotal Auth Config”. After creation, copy the displayed ID starting with ac_. This is your auth config ID. This is not a sensitive ID — you can save it in environment variables or a database. This ID will be used to create connections to the toolkit for a given user.

Connect Your Account

Using API Key

1from composio import Composio
2
3# Replace these with your actual values
4virustotal_auth_config_id = "ac_YOUR_VIRUSTOTAL_CONFIG_ID" # Auth config ID created above
5user_id = "0000-0000-0000"  # UUID from database/app
6
7composio = Composio()
8
9def authenticate_toolkit(user_id: str, auth_config_id: str):
10    # Replace this with a method to retrieve an API key from the user.
11    # Or supply your own.
12    user_api_key = input("[!] Enter API key")
13
14    connection_request = composio.connected_accounts.initiate(
15        user_id=user_id,
16        auth_config_id=auth_config_id,
17        config={"auth_scheme": "API_KEY", "val": {"generic_api_key": user_api_key}}
18    )
19
20    # API Key authentication is immediate - no redirect needed
21    print(f"Successfully connected Virustotal for user {user_id}")
22    print(f"Connection status: {connection_request.status}")
23    
24    return connection_request.id
25
26
27connection_id = authenticate_toolkit(user_id, virustotal_auth_config_id)
28
29# You can verify the connection using:
30connected_account = composio.connected_accounts.get(connection_id)
31print(f"Connected account: {connected_account}")

Tools

Executing tools

To prototype you can execute some tools to see the responses and working on the Virustotal toolkit’s playground

Python
1from composio import Composio
2from openai import OpenAI
3import json
4
5openai = OpenAI()
6composio = Composio()
7
8# User ID must be a valid UUID format
9user_id = "0000-0000-0000"  # Replace with actual user UUID from your database
10
11tools = composio.tools.get(user_id=user_id, toolkits=["VIRUSTOTAL"])
12
13print("[!] Tools:")
14print(json.dumps(tools))
15
16def invoke_llm(task = "What can you do?"):
17    completion = openai.chat.completions.create(
18        model="gpt-4o",
19        messages=[
20            {
21                "role": "user",
22                "content": task,  # Your task here!
23            },
24        ],
25        tools=tools,
26    )
27
28    # Handle Result from tool call
29    result = composio.provider.handle_tool_calls(user_id=user_id, response=completion)
30    print(f"[!] Completion: {completion}")
31    print(f"[!] Tool call result: {result}")
32
33invoke_llm()

Tool List

Tool Name: Add VirusTotal Comment

Description

Tool to add a comment to a virustotal resource (file, url, domain, or ip address). use after analyzing a resource to leave contextual feedback. provide exactly one identifier per call.

Action Parameters

domain
string
file
string
ip_address
string
text
stringRequired
url
string

Action Response

data
objectRequired
error
string
successful
booleanRequired

Tool Name: Add Vote

Description

Tool to add a vote (harmless/malicious) to a virustotal resource. use after reviewing analysis results to submit your verdict.

Action Parameters

data
objectRequired

Action Response

data
objectRequired
error
string
successful
booleanRequired

Tool Name: Get Analysis Report

Description

Tool to retrieve the analysis report of a file or url submission. use after obtaining an analysis id to fetch its detailed report.

Action Parameters

id
stringRequired

Action Response

data
objectRequired
error
string
meta
object
successful
booleanRequired

Tool Name: Get comments

Description

Tool to retrieve the latest comments on a virustotal resource. use when you need to review user-generated comments for a file, url, domain, or ip after obtaining its identifier.

Action Parameters

cursor
string
filter[resource]
stringRequired
limit
integer
sort
string

Action Response

data
arrayRequired
error
string
meta
objectRequired
successful
booleanRequired

Tool Name: Get Domain Relationships

Description

Tool to retrieve relationship objects for a given domain. use when you have a domain and need to explore its related entities.

Action Parameters

cursor
string
domain
stringRequired
limit
integer
relationship
stringRequired

Action Response

data
arrayRequired
error
string
links
objectRequired
meta
objectRequired
successful
booleanRequired

Tool Name: Get Domain Report

Description

Tool to retrieve the analysis report of a domain. use when you need detailed insight on a domain's reputation and analysis stats.

Action Parameters

domain
stringRequired

Action Response

data
objectRequired
error
string
successful
booleanRequired

Tool Name: Get File Report

Description

Tool to retrieve the analysis report of a file. use when you have a file's hash and need detailed scan metadata.

Action Parameters

id
stringRequired

Action Response

data
objectRequired
error
string
successful
booleanRequired

Tool Name: Get IP Address Relationships

Description

Tool to retrieve objects related to a specific ip address by relationship type. use when you have an ip and need to explore connected files, urls, or other entities.

Action Parameters

cursor
string
ip
stringRequired
limit
integer
relationship
stringRequired

Action Response

data
arrayRequired
error
string
links
objectRequired
meta
objectRequired
successful
booleanRequired

Tool Name: Get IP Address Report

Description

Tool to retrieve the analysis report of an ip address. use when you need detailed insight on an ip's reputation, asn, country, and analysis stats.

Action Parameters

ip
stringRequired

Action Response

data
objectRequired
error
string
successful
booleanRequired

Tool Name: Get VirusTotal Metadata

Description

Tool to retrieve virustotal metadata. use when you need to list all available api endpoints with methods, summaries, and urls.

Action Parameters

Action Response

data
objectRequired
error
string
successful
booleanRequired

Tool Name: Get URL Report

Description

Tool to retrieve the analysis report of a url. use when you have a url identifier (base64-url without padding) and need detailed scan results, reputation, and metadata.

Action Parameters

id
stringRequired

Action Response

data
objectRequired
error
string
successful
booleanRequired

Tool Name: Get Votes

Description

Tool to retrieve votes on files, urls, domains, or ip addresses. use when you need to view community votes for a given object.

Action Parameters

cursor
string
limit
integer
object_id
stringRequired
object_type
stringRequired

Action Response

data
arrayRequired
error
string
meta
object
successful
booleanRequired

Tool Name: Rescan File

Description

Tool to re-analyze a previously submitted file. use when you need updated analysis results after an initial scan.

Action Parameters

id
stringRequired

Action Response

data
objectRequired
error
string
successful
booleanRequired

Tool Name: Scan URL

Description

Tool to submit a url for scanning. use when you have a url and need to submit it to virustotal to obtain an analysis id for later retrieval.

Action Parameters

url
stringRequired

Action Response

data
objectRequired
error
string
meta
objectRequired
successful
booleanRequired

Tool Name: Upload File

Description

Tool to upload a file for scanning. use when you have binary file content ready to submit for virustotal analysis.

Action Parameters

file
Required
filename
string

Action Response

data
objectRequired
error
string
successful
booleanRequired