# VirusTotal File Comments via Locus x402

> VirusTotal File Comments via Locus x402 is a paid API for AI agents from virustotal.x402.paywithlocus.com, paid per call via x402, $0.055/call, status unknown (last checked 2026-09-14).

Retrieve community comments posted on a file identified by its hash from VirusTotal's threat intelligence platform.

## Facts

- Endpoint: POST https://virustotal.x402.paywithlocus.com/virustotal/file-comments
- Price: $0.055/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/virustotal-file-comments-via-locus-x402-a63204e4
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Az_YU3ds85HlXSqK1EqB9

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability virustotal-file-comments-via-locus-x402-a63204e4 -d '<json body>'
```

Example prompt: Pull the top 5 community comments from VirusTotal for the file with SHA-256 hash 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f — I want to see what security researchers have written about it.

## When to prefer this

Choose this endpoint when you need crowd-sourced analyst commentary and community threat intelligence on a specific file hash, rather than raw scan verdicts from antivirus engines. Useful for incident response and threat hunting when you want human context and researcher notes alongside automated detections. Prefer this over file report endpoints when the goal is qualitative community insight rather than engine detection counts.

## Known failure modes

- Invalid or malformed hash format returns an error or empty result
- Hash not found in VirusTotal database returns empty data object
- Payment failure or insufficient USDC balance prevents the call
- Rate limiting or quota exhaustion on the underlying VirusTotal API
- Limit parameter out of range may return default or error

## How this service works

Threat intelligence platform — scan files by hash, URLs, domains, and IPs against 70+ antivirus engines and security tools.

## Output

Returns a JSON object containing community-posted comments associated with the specified file hash on VirusTotal, including analyst notes, threat labels, and contextual observations. Also includes payment confirmation details (settled USDC amount) and a request tracking ID for status lookups.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "hash": {
   "type": "string"
  },
  "limit": {
   "type": "number"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {},
  "payment": {
   "scheme": "exact",
   "settledUsdc": "0.001000",
   "authorizedMaxUsdc": "0.001000"
  },
  "request": {
   "id": "00000000-0000-4000-8000-000000000000",
   "statusUrl": "/requests/00000000-0000-4000-8000-000000000000"
  },
  "success": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/virustotal-file-comments-via-locus-x402-a63204e4/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from virustotal.x402.paywithlocus.com](https://www.zero.xyz/host/virustotal.x402.paywithlocus.com/llms.txt)