# IPinfo vs VirusTotal (slim)

> VirusTotal scores 67.5 (B) to IPinfo's 62.7 (B) for secintel reputation. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/ipinfo-vs-virustotal.md (~3,450 tokens) · this version ~1,930 tokens · JSON https://www.anchorterminal.com/compare/ipinfo-vs-virustotal.json · canonical https://www.anchorterminal.com/compare/ipinfo-vs-virustotal
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-03
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

VirusTotal scores 67.5 (B) on agent readiness against IPinfo's 62.7 (B), and leads in 4 of 7 scored categories. IPinfo leads on transparency & trust. Both do secintel reputation.

- IPinfo: B 62.7, rank #464 of 1349 · https://www.anchorterminal.com/tools/ipinfo.min.md
- VirusTotal: B 67.5, rank #288 of 1349 · https://www.anchorterminal.com/tools/virustotal.min.md
- IPinfo, good for An agent that needs to enrich an IP with location, network and anonymiser flags at volume, free for country and ASN, paid for city and privacy signals. Ahead on Transparency & trust, 70 against 65.
- VirusTotal, good for File, URL, domain and IP reputation with multi-engine evidence, and the one listing here an agent can onboard to by a single POST. Ahead on Reliability, 55 against 38; Security & auth, 69 against 60.

| Category | IPinfo | VirusTotal |
| --- | --- | --- |
| Reliability (16%) | 38 | 55 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 76 | 77 |
| Agent ergonomics (13%) | 84 | 83 |
| Security & auth (14%) | 60 | 69 |
| Payments & pricing (10%) | 40 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 85 | 88 |
| Transparency & trust (7%) | 70 | 65 |

| Fact (where they differ) | IPinfo | VirusTotal |
| --- | --- | --- |
| Vendor | IPinfo Inc. | Google LLC |
| Hosted endpoint | `https://mcp.ipinfo.io/` | `https://ai.virustotal.com/mcp` |
| Transports | Streamable HTTP, stdio | HTTP, Streamable HTTP, stdio |
| Licence | none | Proprietary service under the Google Cloud Terms of Service (SecOps). The official MCP server vt-mcp, vt-py and vt-go are Apache-2.0 |
| Tools exposed | 6 | 11 |
| Read-only variant documented | yes | no |
| MCP registry | `io.github.ipinfo/mcp` | `io.github.VirusTotal/virustotal-mcp` |
| Last release | 2026-10-29 | 2026-10-11 |
| Terms last updated | 2024-06-03 | no date given |
| Privacy policy last updated | 2026-10-29 | 2025-02-06 |
| Terms restrict automated access | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 2 stars | 26 stars, 53 PyPI/wk |

Why the edge:
- Reliability, VirusTotal +17: IPinfo 38 (Read with the hosted lines. No status page was found; status.ipinfo.io does not resolve and the site, docs and llms.txt link none (0). No readable history (5). Limits are published with numbers, Lite unlimited, Core 150,000 and Max 250,000 requests a month, with no per-second cap (15). A 429 is documented in the OpenAPI document and the developer page for the monthly quota, and the MCP server maps it to RATE_LIMITED, but no Retry-After or backoff guidance was found; every call is a read (8 of 15). No SLA; the terms supply the service as is and as available (0). The API and the MCP server are generally available (10). 0 + 5 + 15 + 8 + 0 + 10 = 38.); VirusTotal 55 (Read with the hosted lines, on the v3 API and VirusTotal AI together. No status page found. status.virustotal.com does not resolve and neither docs.virustotal.com nor ai.virustotal.com links one (0). No readable incident history (5). Rate limits documented with numbers, 4 requests a minute and 500 a day on a public key, and 60 queries per 60-second window and 1,000 a UTC day plus 20 uploads a minute and 500 a day on VTAI (15). 429 answers QuotaExceededError or TooManyRequestsError on v3, the quota FAQ says wait 30 to 60 seconds, VTAI says honour Retry-After, and VTAI submissions are idempotent by SHA-256 receipt or a caller-chosen request_id (15). The Google Cloud SecOps SLA page lists service level agreements for Google Threat Intelligence and VirusTotal, which cover paid licences (10). The v3 API is generally available; VTAI's OpenAPI document is version 0.10.39 and vt-mcp 0.9.9, neither marked beta, with Codex support marked staging (10). 0 + 5 + 15 + 15 + 10 + 10 = 55.)
- Security & auth, VirusTotal +9: IPinfo 60 (One access token per account, accepted as a Bearer header, HTTP Basic or a token query parameter, with no scopes found; the hosted MCP server adds OAuth with short-lived tokens (20 less 10 for the query string, plus 4 for OAuth on the MCP server, so 14). Every endpoint is a read and tools return ACCESS_DENIED outside the plan, but there is no read-only or restricted token (16 of 20). Responses are structured network data rather than third-party free text (10 of 15). The dashboard shows request graphs and lookup history per the pricing page, with no per-call log documented (8 of 15). security.txt valid until 21 August 2027 with a PGP key, a SECURITY.md with 2-day acknowledgement and a 90-day disclosure window, no bug bounty or certification found beyond a bank-grade claim (12 of 20). 14 + 16 + 10 + 8 + 12 = 60.); VirusTotal 69 (A personal v3 key carries every privilege of the account, with no scopes, sent only in an `x-apikey` header. Licensed groups get service accounts with six roles and a daily cap each. VTAI MCP uses OAuth with three scopes, vt:reports:read, vt:submissions:write and vt:network-analysis:write, and REST agent tokens are revocable with one DELETE. No documented query-string option (24 of 30). The read scope and readOnlyHint tools give a read-only mode; submission tools have no per-call confirmation of their own, so consent rests on the client and the `X-VTAI-Consent` header (15 of 20). Reports carry third-party text and `ai_insights`, and the VTAI pages say to treat report text as data, not instructions, and never to read a missing report as safety (12 of 15). Group administrators see consumption by endpoint and by user, VTAI shows OAuth connections at /oauth/connections, and no per-call log for a personal key was found (8 of 15). SECURITY.md in the MCP repository points to the Google Bug Hunters form, and the SecOps SLA and privacy notice are Google Cloud documents, but www.virustotal.com has no security.txt and whether VirusTotal is in scope of Google Cloud's SOC 2 and ISO 27001 reports could not be read (10 of 20). 24 + 15 + 12 + 8 + 10 = 69.)
- Transparency & trust, IPinfo +5: IPinfo 70 (A closed service with clear terms naming IPinfo Inc. and the governing law, with the MCP server and SDKs under Apache-2.0 (17 of 30). The privacy policy of 29 October 2026 lists processors, links a DPA and says data is kept as long as needed, with no periods (16 of 30). No deprecation policy; the legacy API is maintained for existing users with no end date (6 of 20). Processors named and hosting in the United States (16 of 20). 17 + 16 + 6 + 16 = 55.); VirusTotal 65 (Closed service under the Google Cloud Terms of Service, last modified 24 March 2026, with the public API's non-commercial rule stated in the docs, and Apache-2.0 for vt-mcp, vt-py and vt-go (18 of 30). The SecOps Privacy Notice of 6 February 2025 keeps most personal data up to 180 days, names Google Cloud EMEA Ltd as controller for EU users and links a Cloud Data Processing Addendum, and the docs and VTAI pages agree that submissions are shared with partners (24 of 30). No deprecation policy with dates. The overview says v2 "will not be deprecated" for now, and the 0.9.9 release note records removed tool names without a notice period (6 of 20). Data is processed on servers around the world; no subprocessor list specific to VirusTotal was found (8 of 20). 18 + 24 + 6 + 8 = 56.)