vt-py

What it is and what it does

vt-py is the official Python wrapper around VirusTotal's REST API v3, a cloud-based malware and security threat detection service. It abstracts HTTP communication and authentication, letting you submit files and URLs for scanning, retrieve threat analysis results, search threat intelligence databases, manage LiveHunt detection rules, and run retroactive hunts across VirusTotal's file corpus—all from Python code.

The library uses async I/O (aiohttp, aiofiles) to handle concurrent requests efficiently. It targets Python 3.7 and later, installs with minimal friction, and is maintained by VirusTotal itself, though recent releases have slowed. It's suitable for security teams, malware researchers, and developers integrating threat detection into larger workflows.

Use it for:

• Automate malware scanning of files and URLs in security pipelines or incident response workflows.
• Query VirusTotal Intelligence to research file hashes, domains, or IPs for threat analysis.
• Build custom detection rules with LiveHunt and retrieve matches programmatically.
• Integrate threat detection into CI/CD or endpoint protection systems.
• Run retroactive hunts across VirusTotal's file corpus to find samples matching custom criteria.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Official Python client for the VirusTotal REST API v3, enabling file and URL scanning, threat intelligence queries, and security workflow automation.

Yes, if you need to integrate VirusTotal scanning into Python workflows. The library is official, has low install friction, carries a permissive license, and has no known vulnerabilities. The aging maintenance status (290 days since last release) is a minor concern but does not block adoption for stable API use; monitor the repository for any breaking changes to the VirusTotal REST API v3.

Install

vt-py on PyPI

pip install vt-py

uv add vt-py

poetry add vt-py

Installing vt-py

Before you install

Low install friction with only two async runtime dependencies (aiohttp, aiofiles). Maintenance status is aging—last commit was 2025-10-28 and the package has not seen a release in 290 days, though the repository remains active and not archived.

License in practice

Licensed under Apache 2 (permissive), allowing use in most commercial and open-source projects without significant restriction.

Quickstart

pip install vt-py

import vt

async with vt.Client(api_key='your-api-key') as client:
    file = await client.get_object('/files/{file_hash}')

Requires a valid VirusTotal API key; async/await syntax requires Python 3.7+.

Verify before relying

• Whether the 290-day release gap signals maintenance concerns or reflects API stability.
• Real-world performance characteristics with large-scale file or URL submissions.
• Scope and completeness of VirusTotal Intelligence and Retrohunt features relative to the REST API v3.

Package facts

Evidence: vt_py-0.22.0-py3-none-any.whl

Tags

More Security packages