virustotal_scan_ip

What virustotal_scan_ip does on UnClick

AI agents call virustotal_scan_ip to retrieve information from UnClick without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Parameters from the server's own tool schema.

Why virustotal_scan_ip is rated Low

The tool retrieves and returns a VirusTotal report—a read-only query of an external security service. No data is created, modified, deleted, or executed. The IP address is a query parameter only. While the information returned may be sensitive (threat intelligence), the tool itself performs no side effects and presents minimal risk of misuse compared to write, execute, or destructive operations.

From the tool's definition Tool name 'virustotal_scan_ip' and description 'Get a VirusTotal report for an IP address' indicate a query/retrieval operation that fetches existing security intelligence data without modifying anything.

Risk signalsHandles credentials or secrets (api_key)

The rule that runs virustotal_scan_ip safely

PolicyLayer is an MCP gateway: it sits between your AI agents and UnClick, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For virustotal_scan_ip, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "virustotal_scan_ip": {}
  }
}

Questions about virustotal_scan_ip