Install virustotal-cli with Homebrew, apt, winget

Project links

• Homepage
• Repository
• Upstream docs
• Package manager page

Commands and aliases

• vt

Project history

The public vt-cli repository was created in May 2018, and GitHub releases list version 0.2.0 on May 29, 2018. The project is maintained under the VirusTotal GitHub organization, uses an Apache-2.0 license, and publishes command documentation through GitHub Pages.

vt-cli belongs to the API v3 era of VirusTotal tooling: instead of being only a web interface for manual submissions, VirusTotal documents APIs and client libraries for automation. The CLI packages that automation into a single binary with global options for API key, output format, silent mode, and verbosity.

Adoption history

The CLI is mainly adopted by malware analysts, incident responders, threat hunters, and DevOps/security engineers who already use VirusTotal's web service. It has a narrower audience than VirusTotal itself, but it is valuable wherever terminal workflows and repeatable scripts are preferred over browser-driven lookups.

VirusTotal's own API documentation describes programmatic access for uploading and scanning files or URLs, retrieving reports, and building scripts without the website interface. vt-cli makes those same workflows accessible to shell users and package-manager users who want a maintained official client.

How it is used

Typical usage begins with configuring an API key, either through `vt init`, a config file, or a command-line option. Users then run commands such as `vt file`, `vt url`, `vt domain`, `vt ip`, `vt analysis`, `vt scan`, or `vt hunting`, often with JSON, YAML, or CSV output for downstream processing.

Package users tend to install vt-cli for quick hash lookups, file and URL submissions, triage scripts, and security automation. Its command surface mirrors VirusTotal object types, so it fits naturally into pipelines that already collect hashes, suspicious URLs, domains, IP addresses, or YARA/LiveHunt context.

Why package nerds care

virustotal-cli is package-nerd useful because it turns a web threat-intelligence service into a composable Unix-style command. It is not a scanner engine itself; its power comes from letting local scripts and incident-response notebooks ask VirusTotal for reputation and analysis data at the exact point where artifacts are being handled.

Timeline

• 2018-05-15: The public VirusTotal/vt-cli repository was created.
• 2018-05-29: GitHub releases list vt-cli 0.2.0.
• 2026-05-19: GitHub releases list vt-cli 1.3.1.

Related projects

• VirusTotal's API v3 is the service interface behind the CLI. The broader VirusTotal ecosystem includes the web UI, API scripts and client libraries, LiveHunt/YARA workflows, and VirusTotal Enterprise features.

Sources

• VirusTotal API scripts and client libraries documentation: https://docs.virustotal.com/docs/api-scripts-and-client-libraries
• VirusTotal API v3 overview: https://docs.virustotal.com/reference/overview
• VirusTotal files API documentation: https://docs.virustotal.com/reference/files
• VirusTotal vt-cli GitHub repository: https://github.com/VirusTotal/vt-cli
• VirusTotal vt-cli command documentation: https://virustotal.github.io/vt-cli/doc/vt.html
• VirusTotal vt-cli releases: https://github.com/VirusTotal/vt-cli/releases