VirusTotal SDKs & Libraries: Python, Java, Go, and More (2026)

SDKs overview

VirusTotal provides a public and private API that enables developers to integrate its threat intelligence capabilities directly into their own applications, scripts, and security tools. The API facilitates automated submission of files, URLs, domains, and IP addresses for analysis, as well as the retrieval of detailed reports from its extensive database of antivirus engines, blacklisting services, and behavioral sandboxes. To simplify interaction with the API, VirusTotal offers official SDKs in several programming languages, complemented by a range of community-developed libraries for broader language support.

These SDKs and libraries abstract the underlying HTTP requests and JSON parsing, allowing developers to focus on integrating threat intelligence data rather than managing API communication specifics. They typically offer methods for common operations such as uploading files, scanning URLs, querying report results, and managing API requests according to rate limits. Developers can access the VirusTotal API reference for detailed endpoint documentation.

Official SDKs by language

VirusTotal maintains official SDKs for several popular programming languages, ensuring direct support and compatibility with the latest API versions. These libraries are designed to provide a robust and well-documented interface for programmatic interaction.

Each official SDK provides idiomatic bindings for its respective language, adhering to common programming patterns and best practices. For example, the Python library uses classes and methods that align with Python's object-oriented approach, while the Go library leverages Go's concurrency features where appropriate. Developers can find specific usage examples and detailed documentation within the VirusTotal official documentation portal.

Installation

Installation methods vary by language, typically following the standard package management practices for each ecosystem. Below are common installation steps for the officially supported SDKs.

Python

The Python SDK is distributed via PyPI and can be installed using pip:

pip install virustotal-api

Java

For Java projects, the SDK is available through Maven Central. Developers using Maven should add the following dependency to their pom.xml file:

<dependency>
    <groupId>com.virustotal</groupId>
    <artifactId>virustotal-api</artifactId>
    <version>2.0.0</version> <!-- Replace with the latest version -->
</dependency>

For Gradle projects, add the following to build.gradle:

implementation 'com.virustotal:virustotal-api:2.0.0' // Replace with the latest version

Go

The Go SDK can be installed using the go get command:

go get github.com/VirusTotal/vt-go

After running this command, the package will be downloaded and made available for import in Go projects.

Ruby

The Ruby SDK is available as a gem and can be installed using the gem command:

gem install virustotal-api

Quickstart example

This Python example demonstrates how to use the VirusTotal API to submit a file for analysis and retrieve its report. Before running, ensure you have an API key, which can be obtained from your VirusTotal account.

import virustotal_api
import time

API_KEY = "YOUR_API_KEY"  # Replace with your actual API key
FILE_PATH = "/path/to/your/test_file.exe"  # Replace with the path to the file you want to analyze

def analyze_file(file_path, api_key):
    client = virustotal_api.Client(api_key)

    try:
        # Upload the file for analysis
        print(f"Uploading file: {file_path}")
        analysis_response = client.upload_file(file_path)
        file_id = analysis_response.get('data', {}).get('id')

        if not file_id:
            print("Failed to get file ID from upload response.")
            return
        
        print(f"File uploaded. Analysis ID: {file_id}")

        # Poll for the analysis report
        report_url = analysis_response.get('data', {}).get('links', {}).get('self')
        if not report_url:
            print("Failed to get report URL.")
            return

        print("Polling for analysis report...")
        report = None
        for _ in range(10):  # Poll up to 10 times with a delay
            report = client.get_report(report_url)
            if report and report.get('data', {}).get('attributes', {}).get('status') == 'completed':
                break
            print("Analysis not complete, waiting...")
            time.sleep(10)  # Wait 10 seconds before polling again

        if report and report.get('data', {}).get('attributes', {}).get('status') == 'completed':
            attributes = report.get('data', {}).get('attributes', {})
            last_analysis_stats = attributes.get('last_analysis_stats', {})
            malicious_count = last_analysis_stats.get('malicious', 0)
            undetected_count = last_analysis_stats.get('undetected', 0)
            
            print(f"Analysis complete for {file_path}:")
            print(f"  Malicious detections: {malicious_count}")
            print(f"  Undetected: {undetected_count}")
            print(f"  First Submission Date: {time.ctime(attributes.get('first_submission_date'))}")
            
            # Example of accessing individual engine results
            # last_analysis_results = attributes.get('last_analysis_results', {})
            # for engine, result in last_analysis_results.items():
            #     if result.get('category') == 'malicious':
            #         print(f"    Engine '{engine}': {result.get('result')}")
        else:
            print("Analysis did not complete in time or failed.")
            if report:
                print(f"Current status: {report.get('data', {}).get('attributes', {}).get('status')}")

    except virustotal_api.APIError as e:
        print(f"API Error: {e}")
    except Exception as e:
        print(f"An unexpected error occurred: {e}")

if __name__ == "__main__":
    analyze_file(FILE_PATH, API_KEY)

This script first uploads a specified file and then continuously polls the API for the analysis report until it is completed or a timeout is reached. It then prints a summary of the analysis results, including the number of malicious detections. Developers should handle API keys securely, for example, by using environment variables rather than hardcoding them in production applications, as recommended by security best practices for API key management.

Community libraries

Beyond the officially supported SDKs, the VirusTotal developer community has created libraries and wrappers in various other programming languages. These community-driven projects extend the reach of the VirusTotal API to more ecosystems, often providing alternative interfaces or specialized functionalities. While not officially maintained by VirusTotal, many of these libraries are actively developed and widely used.

Examples of community-contributed libraries include:

• PHP: Several PHP wrappers are available, often found on GitHub, which allow PHP applications to interact with the VirusTotal API. These typically handle authentication and request formatting.
• Node.js: Multiple npm packages offer Node.js developers the ability to integrate VirusTotal. These libraries are suitable for backend services, command-line tools, and web applications built with Node.js.
• C#: .NET developers can find C# libraries that provide a managed interface to the VirusTotal API, enabling integration into Windows applications and services.
• Rust: For developers working with Rust, there are community crates that offer bindings to the VirusTotal API, leveraging Rust's performance and safety features.

When using community libraries, it is advisable to check their documentation, recent activity, and community support to ensure they are compatible with the current VirusTotal API version and meet project requirements. The VirusTotal API documentation remains the authoritative source for API endpoint specifications, which community libraries must adhere to.