{
  "id": "virustotal-cli",
  "name": "VirusTotal CLI",
  "homepage": "https://github.com/VirusTotal/vt-cli",
  "description": "A tool designed for those who love both VirusTotal and command-line interfaces.",
  "executables": [
    "vt"
  ],
  "dotfiles": {
    "paths": [],
    "secret": [
      "~/.vt.toml"
    ]
  },
  "commands": {
    "format": 1,
    "label": "VirusTotal lookups",
    "description": "Look up files, search VirusTotal Intelligence and submit files for scanning. Requires an API key (vt init). Other subcommands and flags are left out.",
    "quality": "ai-draft",
    "parser": {
      "end_of_options": "--",
      "interleave": "permute",
      "long_equals": true,
      "short_attached": true,
      "short_bundles": false
    },
    "subcommand": [
      {
        "path": [
          "file"
        ],
        "label": "Look up files",
        "description": "Get information about files by hash.",
        "source": [
          {
            "id": "readme",
            "kind": "readme",
            "url": "https://github.com/VirusTotal/vt-cli/blob/master/README.md",
            "revision": "master 2026-10-27",
            "evidence": "vt file 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85 --format json\nvt search \"positives:5+ type:pdf\" -i sha256,last_analysis_stats.malicious,tags --format csv\nYou can narrow down the information shown by the vt-cli tool by using the `--include` and `--exclude` command-line options (`-i` and `-x` in short form).\nvt scan file <yourfile>"
          }
        ],
        "field": [
          {
            "id": "hash",
            "label": "Hash",
            "description": "SHA-256, SHA-1 or MD5",
            "type": "string",
            "position": 0,
            "multiple": true,
            "min": 1,
            "sources": [
              "readme"
            ]
          },
          {
            "id": "format",
            "label": "Output format",
            "description": "Default is YAML.",
            "type": "string",
            "option": [
              "--format"
            ],
            "suggestions": [
              {
                "value": "json",
                "label": "JSON"
              },
              {
                "value": "csv",
                "label": "CSV"
              },
              {
                "value": "yaml",
                "label": "YAML"
              }
            ],
            "sources": [
              "readme"
            ]
          },
          {
            "id": "include",
            "label": "Include fields",
            "description": "Comma-separated field patterns to keep, e.g. sha256,tags.",
            "type": "string",
            "option": [
              "--include",
              "-i"
            ],
            "sources": [
              "readme"
            ]
          },
          {
            "id": "exclude",
            "label": "Exclude fields",
            "type": "string",
            "option": [
              "--exclude",
              "-x"
            ],
            "sources": [
              "readme"
            ]
          }
        ],
        "task": [
          {
            "id": "run",
            "label": "Run",
            "fields": [
              "hash",
              "format",
              "include"
            ],
            "required": [
              "hash"
            ]
          }
        ],
        "group": [
          {
            "id": "basic",
            "label": "Basic",
            "fields": [
              "hash",
              "format",
              "include",
              "exclude"
            ]
          }
        ]
      },
      {
        "path": [
          "search"
        ],
        "label": "Search files",
        "description": "Search for files in VirusTotal Intelligence.",
        "source": [
          {
            "id": "readme",
            "kind": "readme",
            "url": "https://github.com/VirusTotal/vt-cli/blob/master/README.md",
            "revision": "master 2026-10-27",
            "evidence": "vt file 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85 --format json\nvt search \"positives:5+ type:pdf\" -i sha256,last_analysis_stats.malicious,tags --format csv\nYou can narrow down the information shown by the vt-cli tool by using the `--include` and `--exclude` command-line options (`-i` and `-x` in short form).\nvt scan file <yourfile>"
          }
        ],
        "field": [
          {
            "id": "query",
            "label": "Query",
            "description": "e.g. positives:5+ type:pdf",
            "type": "string",
            "position": 0,
            "min": 1,
            "sources": [
              "readme"
            ]
          },
          {
            "id": "format",
            "label": "Output format",
            "description": "Default is YAML.",
            "type": "string",
            "option": [
              "--format"
            ],
            "suggestions": [
              {
                "value": "json",
                "label": "JSON"
              },
              {
                "value": "csv",
                "label": "CSV"
              },
              {
                "value": "yaml",
                "label": "YAML"
              }
            ],
            "sources": [
              "readme"
            ]
          },
          {
            "id": "include",
            "label": "Include fields",
            "description": "Comma-separated field patterns to keep, e.g. sha256,tags.",
            "type": "string",
            "option": [
              "--include",
              "-i"
            ],
            "sources": [
              "readme"
            ]
          },
          {
            "id": "exclude",
            "label": "Exclude fields",
            "type": "string",
            "option": [
              "--exclude",
              "-x"
            ],
            "sources": [
              "readme"
            ]
          }
        ],
        "task": [
          {
            "id": "run",
            "label": "Run",
            "fields": [
              "query",
              "format",
              "include"
            ],
            "required": [
              "query"
            ]
          }
        ],
        "group": [
          {
            "id": "basic",
            "label": "Basic",
            "fields": [
              "query",
              "format",
              "include",
              "exclude"
            ]
          }
        ]
      },
      {
        "path": [
          "scan",
          "file"
        ],
        "label": "Scan files",
        "description": "Submit files for scanning.",
        "source": [
          {
            "id": "readme",
            "kind": "readme",
            "url": "https://github.com/VirusTotal/vt-cli/blob/master/README.md",
            "revision": "master 2026-10-27",
            "evidence": "vt file 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85 --format json\nvt search \"positives:5+ type:pdf\" -i sha256,last_analysis_stats.malicious,tags --format csv\nYou can narrow down the information shown by the vt-cli tool by using the `--include` and `--exclude` command-line options (`-i` and `-x` in short form).\nvt scan file <yourfile>"
          }
        ],
        "field": [
          {
            "id": "file",
            "label": "File",
            "description": "File to scan",
            "type": "string",
            "position": 0,
            "multiple": true,
            "min": 1,
            "sources": [
              "readme"
            ]
          },
          {
            "id": "format",
            "label": "Output format",
            "description": "Default is YAML.",
            "type": "string",
            "option": [
              "--format"
            ],
            "suggestions": [
              {
                "value": "json",
                "label": "JSON"
              },
              {
                "value": "csv",
                "label": "CSV"
              },
              {
                "value": "yaml",
                "label": "YAML"
              }
            ],
            "sources": [
              "readme"
            ]
          },
          {
            "id": "include",
            "label": "Include fields",
            "description": "Comma-separated field patterns to keep, e.g. sha256,tags.",
            "type": "string",
            "option": [
              "--include",
              "-i"
            ],
            "sources": [
              "readme"
            ]
          },
          {
            "id": "exclude",
            "label": "Exclude fields",
            "type": "string",
            "option": [
              "--exclude",
              "-x"
            ],
            "sources": [
              "readme"
            ]
          }
        ],
        "task": [
          {
            "id": "run",
            "label": "Run",
            "fields": [
              "file",
              "format",
              "include"
            ],
            "required": [
              "file"
            ]
          }
        ],
        "group": [
          {
            "id": "basic",
            "label": "Basic",
            "fields": [
              "file",
              "format",
              "include",
              "exclude"
            ]
          }
        ]
      }
    ]
  }
}