# Pulsedive vs VirusTotal (slim)

> VirusTotal scores 67.5 (B) to Pulsedive's 47.9 (D) for secintel indicators. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/pulsedive-vs-virustotal.md (~4,550 tokens) · this version ~2,980 tokens · JSON https://www.anchorterminal.com/compare/pulsedive-vs-virustotal.json · canonical https://www.anchorterminal.com/compare/pulsedive-vs-virustotal
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-03
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

VirusTotal scores 67.5 (B) on agent readiness against Pulsedive's 47.9 (D), and leads in 5 of 7 scored categories. Pulsedive leads on payments & pricing. Both do secintel indicators.

- Pulsedive: D 47.9, rank #1079 of 1349 · https://www.anchorterminal.com/tools/pulsedive.min.md
- VirusTotal: B 67.5, rank #288 of 1349 · https://www.anchorterminal.com/tools/virustotal.min.md
- Pulsedive, good for An agent that needs a quick risk verdict and linked threats for a domain, IP or URL with no signup, or a passive scan of a new indicator. Ahead on Payments & pricing, 50 against 40.
- VirusTotal, good for File, URL, domain and IP reputation with multi-engine evidence, and the one listing here an agent can onboard to by a single POST. Ahead on Reliability, 55 against 31; Agent ergonomics, 83 against 64; Security & auth, 69 against 23; Maintenance & community, 88 against 40; Transparency & trust, 65 against 57. Also A hosted endpoint, with nothing to install; Runs on your own machine.

| Category | Pulsedive | VirusTotal |
| --- | --- | --- |
| Reliability (16%) | 31 | 55 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 77 | 77 |
| Agent ergonomics (13%) | 64 | 83 |
| Security & auth (14%) | 23 | 69 |
| Payments & pricing (10%) | 50 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 40 | 88 |
| Transparency & trust (7%) | 57 | 65 |

| Fact (where they differ) | Pulsedive | VirusTotal |
| --- | --- | --- |
| Vendor | Pulsedive LLC | Google LLC |
| Hosted endpoint | no (local only) | `https://ai.virustotal.com/mcp` |
| Transports |  | HTTP, Streamable HTTP, stdio |
| Auth | API key | OAuth or key |
| Licence | none | Proprietary service under the Google Cloud Terms of Service (SecOps). The official MCP server vt-mcp, vt-py and vt-go are Apache-2.0 |
| Tools exposed | 0 | 11 |
| MCP registry | not listed | `io.github.VirusTotal/virustotal-mcp` |
| Last release | 2026-10-27 | 2026-10-11 |
| Terms last updated | 2022-05-02 | no date given |
| Privacy policy last updated | 2024-08-28 | 2025-02-06 |
| Terms restrict automated access | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Popularity | none | 26 stars, 53 PyPI/wk |

Why the edge:
- Maintenance & community, VirusTotal +48: Pulsedive 40 (Read as a closed service. The site footer shows version 6.3.18 dated 27 October, seven days before the check, and the newest blog post is 29 September 2026 (30). No changelog lists releases, so three dated changes in 90 days could not be shown (0 of 20). A Discord, support@pulsedive.com, a contact form and a docs troubleshooting section; the GitHub feedback repository is archived since 2020 (10 of 15). No entry in the official MCP registry (the docs MCP server is not listed and the registry's pulsedive entries are third-party) and no official SDK (0 of 15). No official packages to assess (0 of 10). 30 + 0 + 10 + 0 + 0 = 40.); VirusTotal 88 (Read as a closed service with open agent tooling. vt-mcp 0.9.9 on PyPI on 11 October 2026 and the repository's newest tag, antigravity-plugin-v0.1.1, on 2 November 2026 (30). Nine vt-mcp releases between 20 September and 11 October 2026 and 146 commits in 90 days (20). Pull requests merged within a day by the maintainer in October, weekly blog posts, dated release notes per version, but issue replies could not be read because github.com refuses our reader (15 of 25). io.github.VirusTotal/virustotal-mcp in the official registry, latest 0.9.9, and vt-py and vt-go as official clients (15). CI, PyPI, release and registry workflows in the MCP repository and a pinned `mcp==2.1.1`, while vt-py's last release is 28 October 2025 and Google's gti-mcp still requires mcp below 2.0 (8 of 10). 30 + 20 + 15 + 15 + 8 = 88.)
- Security & auth, VirusTotal +46: Pulsedive 23 (One key per account sent only as a query parameter, with no scopes, header option or rotation documented (10 for one all-powerful key less 10 for the query string, so 0). Lookups read, submit=1 writes to the public dataset and keyless use is read-only in practice, but there is no read-only key (10 of 20). Responses include community comments, banners and DOM snippets from scans with no guidance on treating them as untrusted (3 of 15). The privacy policy says web and API logs are available from the account page (10 of 15). security.txt returns 404 and no disclosure policy, bug bounty or certification was found (0 of 20). 0 + 10 + 3 + 10 + 0 = 23.); VirusTotal 69 (A personal v3 key carries every privilege of the account, with no scopes, sent only in an `x-apikey` header. Licensed groups get service accounts with six roles and a daily cap each. VTAI MCP uses OAuth with three scopes, vt:reports:read, vt:submissions:write and vt:network-analysis:write, and REST agent tokens are revocable with one DELETE. No documented query-string option (24 of 30). The read scope and readOnlyHint tools give a read-only mode; submission tools have no per-call confirmation of their own, so consent rests on the client and the `X-VTAI-Consent` header (15 of 20). Reports carry third-party text and `ai_insights`, and the VTAI pages say to treat report text as data, not instructions, and never to read a missing report as safety (12 of 15). Group administrators see consumption by endpoint and by user, VTAI shows OAuth connections at /oauth/connections, and no per-call log for a personal key was found (8 of 15). SECURITY.md in the MCP repository points to the Google Bug Hunters form, and the SecOps SLA and privacy notice are Google Cloud documents, but www.virustotal.com has no security.txt and whether VirusTotal is in scope of Google Cloud's SOC 2 and ISO 27001 reports could not be read (10 of 20). 24 + 15 + 12 + 8 + 10 = 69.)
- Reliability, VirusTotal +24: Pulsedive 31 (Read with the hosted lines. No status page was found on the site, the docs, the support page or in search (0). No readable history (5). The limits page names Free, Pro, Commercial and Enterprise tiers and three remaining-request headers but gives no numbers, pointing to the account page; the vendor's plan post of 11 March 2024 gives 50 a day on Free and 250 on Pro (8 of 15). A 429 returns a JSON error naming the limit and the headers show what remains, with no Retry-After or backoff guidance; scans are safe to repeat and polling is free (8 of 15). No SLA; the terms supply the services as is and as available (0). The API is generally available (10). 0 + 5 + 8 + 8 + 0 + 10 = 31.); VirusTotal 55 (Read with the hosted lines, on the v3 API and VirusTotal AI together. No status page found. status.virustotal.com does not resolve and neither docs.virustotal.com nor ai.virustotal.com links one (0). No readable incident history (5). Rate limits documented with numbers, 4 requests a minute and 500 a day on a public key, and 60 queries per 60-second window and 1,000 a UTC day plus 20 uploads a minute and 500 a day on VTAI (15). 429 answers QuotaExceededError or TooManyRequestsError on v3, the quota FAQ says wait 30 to 60 seconds, VTAI says honour Retry-After, and VTAI submissions are idempotent by SHA-256 receipt or a caller-chosen request_id (15). The Google Cloud SecOps SLA page lists service level agreements for Google Threat Intelligence and VirusTotal, which cover paid licences (10). The v3 API is generally available; VTAI's OpenAPI document is version 0.10.39 and vt-mcp 0.9.9, neither marked beta, with Codex support marked staging (10). 0 + 5 + 15 + 15 + 10 + 10 = 55.)
- Agent ergonomics, VirusTotal +19: Pulsedive 64 (limit on explore, pretty, get=links or properties, historical and schema flags, and submit=0 keeps a scan out of the dataset, but an indicator record carries every property group with no field selection (16 of 25). Linked indicators page with page_current and page_next, 1 to 10 pages per request by plan, explore rows capped by tier, and CSV or STIX output (14 of 20). Errors are a single string with a status code; the 429 body names the limit (12 of 20). Every lookup is a GET, scanning an existing indicator updates it, and polling by qid is free (14 of 20). One required parameter per call and keyless defaults, but no official SDK (8 of 15). 16 + 14 + 12 + 14 + 8 = 64.); VirusTotal 83 (The hosted MCP server lists 11 compact tools, one over the ten-tool line (15), and the vt:reports:read OAuth scope gives a read-only subset (5 added back, so 20). VTAI reports are fixed in shape with `detections` as labels, category counts and `coverage` sized for a model. Pagination and field selection on v3 list endpoints were not read in this run (10 of 20). Error codes an agent can branch on, QuotaExceededError, NotFoundError, `receipt_conflict` on 409, enumerated rejection codes, and Retry-After on VTAI 429s (18 of 20). File submissions are keyed by SHA-256 with recoverable receipts, network submissions by a persisted request_id, `can_resubmit` is set on every result, and all 11 tools carry readOnlyHint and destructiveHint in the source (20). Few required parameters, official clients vt-py and vt-go, and the submit_local_file stdio tool (15). 20 + 10 + 18 + 20 + 15 = 83.)
- Payments & pricing, Pulsedive +10: Pulsedive 50 (No x402, MPP or L402 (0). Pro $29 a month is on the site menu and the Team and Business API prices are in the vendor's plan post of 11 March 2024, sold as monthly quotas rather than per call (10). A free account needs no card (20). Requests without a key are accepted, so an agent can look up an indicator with no signup at about 10 a day (20). 0 + 10 + 20 + 20 = 50.); VirusTotal 40 (No x402, MPP or L402 (0). Premium quotas and Google Threat Intelligence are sold by contacting sales, and no price was found on any page read (0). A public key gives 500 requests a day and VTAI 1,000 a day, with no card (20). An agent registers itself with `POST /api/v3/agents/register` and receives a token in the response, no browser or person involved (20). 0 + 0 + 20 + 20 = 40.)
- Transparency & trust, VirusTotal +8: Pulsedive 57 (A closed service with terms naming Pulsedive LLC and New Jersey law, with the OpenAPI files under Apache 2.0 (15 of 30). The privacy policy of 28 August 2024 lists processors and what is logged, keeps deleted-account data for compliance with no periods, and names no DPA; an enterprise privacy page exists and was not read (14 of 30). The recent field is marked deprecated in the spec with no date and there is no policy (5 of 20). DigitalOcean, Plausible, Stripe, SendGrid, Google Workspace, Monday, QuickBooks and Typeform named, storage in the United States (16 of 20). 15 + 14 + 5 + 16 = 50.); VirusTotal 65 (Closed service under the Google Cloud Terms of Service, last modified 24 March 2026, with the public API's non-commercial rule stated in the docs, and Apache-2.0 for vt-mcp, vt-py and vt-go (18 of 30). The SecOps Privacy Notice of 6 February 2025 keeps most personal data up to 180 days, names Google Cloud EMEA Ltd as controller for EU users and links a Cloud Data Processing Addendum, and the docs and VTAI pages agree that submissions are shared with partners (24 of 30). No deprecation policy with dates. The overview says v2 "will not be deprecated" for now, and the 0.9.9 release note records removed tool names without a notice period (6 of 20). Data is processed on servers around the world; no subprocessor list specific to VirusTotal was found (8 of 20). 18 + 24 + 6 + 8 = 56.)