id          = "virustotal-cli"
name        = "VirusTotal CLI"
homepage    = "https://github.com/VirusTotal/vt-cli"
description = "A tool designed for those who love both VirusTotal and command-line interfaces."
executables      = ["vt"]

[dotfiles]

# VirusTotal's official README documents `vt init` saving the API key in
# ~/.vt.toml; it also documents VTCLI_APIKEY as an environment alternative.
# https://github.com/VirusTotal/vt-cli/blob/master/README.md#configuring-your-api-key
paths  = []
secret = ["~/.vt.toml"]

[commands]
format = 1
label = "VirusTotal lookups"
description = "Look up files, search VirusTotal Intelligence and submit files for scanning. Requires an API key (vt init). Other subcommands and flags are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.subcommand]]
path = ["file"]
label = "Look up files"
description = "Get information about files by hash."

[[commands.subcommand.source]]
id = "readme"
kind = "readme"
url = "https://github.com/VirusTotal/vt-cli/blob/master/README.md"
revision = "master 2026-10-27"
evidence = """vt file 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85 --format json
vt search "positives:5+ type:pdf" -i sha256,last_analysis_stats.malicious,tags --format csv
You can narrow down the information shown by the vt-cli tool by using the `--include` and `--exclude` command-line options (`-i` and `-x` in short form).
vt scan file <yourfile>"""

[[commands.subcommand.field]]
id = "hash"
label = "Hash"
description = "SHA-256, SHA-1 or MD5"
type = "string"
position = 0
multiple = true
min = 1
sources = ["readme"]

[[commands.subcommand.field]]
id = "format"
label = "Output format"
description = "Default is YAML."
type = "string"
option = ["--format"]
suggestions = [{ value = "json", label = "JSON" }, { value = "csv", label = "CSV" }, { value = "yaml", label = "YAML" }]
sources = ["readme"]

[[commands.subcommand.field]]
id = "include"
label = "Include fields"
description = "Comma-separated field patterns to keep, e.g. sha256,tags."
type = "string"
option = ["--include", "-i"]
sources = ["readme"]

[[commands.subcommand.field]]
id = "exclude"
label = "Exclude fields"
type = "string"
option = ["--exclude", "-x"]
sources = ["readme"]

[[commands.subcommand.task]]
id = "run"
label = "Run"
fields = ["hash", "format", "include"]
required = ["hash"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["hash", "format", "include", "exclude"]

[[commands.subcommand]]
path = ["search"]
label = "Search files"
description = "Search for files in VirusTotal Intelligence."

[[commands.subcommand.source]]
id = "readme"
kind = "readme"
url = "https://github.com/VirusTotal/vt-cli/blob/master/README.md"
revision = "master 2026-10-27"
evidence = """vt file 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85 --format json
vt search "positives:5+ type:pdf" -i sha256,last_analysis_stats.malicious,tags --format csv
You can narrow down the information shown by the vt-cli tool by using the `--include` and `--exclude` command-line options (`-i` and `-x` in short form).
vt scan file <yourfile>"""

[[commands.subcommand.field]]
id = "query"
label = "Query"
description = "e.g. positives:5+ type:pdf"
type = "string"
position = 0
min = 1
sources = ["readme"]

[[commands.subcommand.field]]
id = "format"
label = "Output format"
description = "Default is YAML."
type = "string"
option = ["--format"]
suggestions = [{ value = "json", label = "JSON" }, { value = "csv", label = "CSV" }, { value = "yaml", label = "YAML" }]
sources = ["readme"]

[[commands.subcommand.field]]
id = "include"
label = "Include fields"
description = "Comma-separated field patterns to keep, e.g. sha256,tags."
type = "string"
option = ["--include", "-i"]
sources = ["readme"]

[[commands.subcommand.field]]
id = "exclude"
label = "Exclude fields"
type = "string"
option = ["--exclude", "-x"]
sources = ["readme"]

[[commands.subcommand.task]]
id = "run"
label = "Run"
fields = ["query", "format", "include"]
required = ["query"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["query", "format", "include", "exclude"]

[[commands.subcommand]]
path = ["scan", "file"]
label = "Scan files"
description = "Submit files for scanning."

[[commands.subcommand.source]]
id = "readme"
kind = "readme"
url = "https://github.com/VirusTotal/vt-cli/blob/master/README.md"
revision = "master 2026-10-27"
evidence = """vt file 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85 --format json
vt search "positives:5+ type:pdf" -i sha256,last_analysis_stats.malicious,tags --format csv
You can narrow down the information shown by the vt-cli tool by using the `--include` and `--exclude` command-line options (`-i` and `-x` in short form).
vt scan file <yourfile>"""

[[commands.subcommand.field]]
id = "file"
label = "File"
description = "File to scan"
type = "string"
position = 0
multiple = true
min = 1
sources = ["readme"]

[[commands.subcommand.field]]
id = "format"
label = "Output format"
description = "Default is YAML."
type = "string"
option = ["--format"]
suggestions = [{ value = "json", label = "JSON" }, { value = "csv", label = "CSV" }, { value = "yaml", label = "YAML" }]
sources = ["readme"]

[[commands.subcommand.field]]
id = "include"
label = "Include fields"
description = "Comma-separated field patterns to keep, e.g. sha256,tags."
type = "string"
option = ["--include", "-i"]
sources = ["readme"]

[[commands.subcommand.field]]
id = "exclude"
label = "Exclude fields"
type = "string"
option = ["--exclude", "-x"]
sources = ["readme"]

[[commands.subcommand.task]]
id = "run"
label = "Run"
fields = ["file", "format", "include"]
required = ["file"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["file", "format", "include", "exclude"]