VirusTotal Lookup

Lets an agent check a hash, a domain or an IP against VirusTotal during triage, without giving it an API key and without uploading anything.

What you get

• vt.file.report — a file's reputation record by MD5, SHA-1 or SHA-256.
• vt.domain.report — reputation, categories and recent resolutions.
• vt.ip.report — reputation and network ownership for an IPv4 address.

What you need

• VirusTotal API key — from your profile page. A public key allows four lookups a minute, which suits triage and does not suit a scan loop.
• JWKS endpoint — the host where your identity provider publishes its signing keys, without a scheme.
• Token audience — the aud claim your callers' tokens carry.

How it works

Every argument here is validated by a pattern before a request is made. A hash must be 32, 40 or 64 hex characters; a domain must look like a domain; an IP must be four octets in range. That is not politeness — the argument is interpolated into the request path, and a schema that accepts anything is a schema that lets a caller reshape the URL.

Nothing uploads. These three bindings ask VirusTotal what it already knows; a file the service has never seen comes back as a 404, which the gateway surfaces as a tool error rather than as an empty result.

Audit runs fail_closed. What an agent looked up during an incident is part of the incident record.

Notes

VirusTotal's last_analysis_stats is a count of engines, not a verdict. One detection out of seventy is usually noise, and treating any non-zero count as malicious is how a triage agent starts crying wolf.

Rate limiting arrives as HTTP 429. There is no retry here on purpose: a model in a loop that gets quietly retried burns the quota for everyone sharing the key.