What is VirusTotal?

VirusTotal is an online service, owned by Google, where files, URLs, domains and IPs can be checked and the combined analysis reports viewed. The vendor's pages describe AI in Code Insight, which writes natural-language summaries of what a script does, and in VirusTotal AI (VTAI), an interface that lets AI agents query VirusTotal through MCP tools, platform plugins or direct HTTP.

Who it's for

The free Community tier and Public API are for non-commercial or academic use by individuals and analysts. The paid Premium API and Intelligence services are described as meant for professionals doing SIEM, SOAR or EDR enrichment, incident response and offline file analysis.

Pros & cons

Strengths

The docs say the Public API is free to anyone who signs up for a VirusTotal Community account and gets an API key.
The docs list Premium API extras: sandbox behavior data for Windows PE, DMG, Mach-O and APK files, sample downloads, reverse searches by file or network properties, file similarity and clustering, and richer relationships such as embedded and contacted domains.
The Premium API has no request-rate or daily caps, according to the docs; limits follow the licensed service step, and the docs say it is covered by an SLA.
VTAI is offered to AI agents through MCP tools, platform plugins or direct HTTP, and its guide says free access is available with shared quotas and that uploads need explicit user approval.
The Code Insight announcement says it summarizes code using only the file content, not antivirus results or other metadata, and a news report says script types supported have since expanded beyond PowerShell (Reported).
The Private Scanning page says files and URLs uploaded through that paid offering are not shared beyond your organization and are deleted after a retention period, usually 24 hours and configurable by admins.

Limitations

The Public API is capped at 500 requests a day and 4 requests a minute, and the docs say it must not be used in commercial products or services, or in business workflows that do not contribute new files.
Standard submissions are not private: the VTAI guide says they are shared with the security community and partners. The VirusTotal terms document found (a Chronicle-hosted copy, so it may be dated, Reported) says samples are shared with partners who use the results to improve their own systems. Private files should not be uploaded.
Premium API and Intelligence pricing is not published; the docs say to contact VirusTotal, and an additional VTI subscription is needed for YARA notifications and retrohunt jobs. Private Scanning is also paid, with no price listed.
VTAI limits are 60 queries per minute and 1,000 per UTC day, and 20 upload attempts per minute and 500 per day, shared across REST and MCP for one agent token; every lookup counts, including cached and unknown results, and creating extra identities to get around limits is not permitted.
The Code Insight post says output quality may vary, including judgment errors, that an analyst should oversee it, and that very large files and files similar to ones already processed are excluded. It does not say whether submitted data is retained or used for model training, and the terms document read does not mention AI training either.

Plans and pricing

Community (free): $0. Web use for non-commercial or academic purposes under the standard Terms of Service; submissions are shared with the community.
Public API (free): $0. Needs a Community account and API key; 500 requests a day and 4 a minute; no commercial products or services; basic data and hash lookups only per the docs.
Premium API / Intelligence: Contact sales. No rate or daily caps; limits follow the licensed step; SLA, sandbox data, sample downloads, reverse search and relationships. YARA hunting needs an extra VTI subscription.
Private Scanning: Not published. Paid add-on for samples that cannot be shared; static, dynamic, network and similarity analysis without antivirus or URL-scanner verdicts; trial by request.
VirusTotal AI (VTAI) for agents: Free access stated. 60 queries a minute and 1,000 a day; 20 uploads a minute and 500 a day. No paid tiers are listed on the guide read.

No price is published for Premium API, Intelligence or Private Scanning; the Public vs Premium API page says to contact VirusTotal. The docs page on the private API (Reported as older wording) says its pricing is based on usage. The official services overview and privacy policy pages could not be fetched. Confirm on the live pricing page or with the vendor.

Details checked October 2026 against the vendor's own pages. Prices and limits change, so confirm before you buy. Official pricing page ↗

Sources

This profile was compiled from these public pages. We have not run hands-on tests.

Summary

VirusTotal — at a glance

Try VirusTotal →

We couldn't find that tool

VirusTotal

At a glance