# Shodan Internetdb [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/pipeworx-io/mcp-shodan-internetdb  
**GitHub Stars:** 0  
**npm Downloads (last month):** 466  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/shodan-internetdb

## Description
Shodan InternetDB MCP — wraps Shodan InternetDB (internetdb.shodan.io)

## Tools
Capabilities this server exposes over MCP:

- **lookup_ip** — Look up an IP address in the Shodan InternetDB. Returns open ports, hostnames, known vulnerabilities (CVEs), CPEs (software identifiers), and tags. Free, no API key needed. Example: lookup_ip("8.8.8.8").

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "shodan-internetdb": {
    "command": "npx",
    "args": ["-y","@pipeworx/mcp-shodan-internetdb"]
  }
}
```

## Documentation

## What Shodan Internetdb does

Shodan Internetdb exposes Shodan InternetDB data to MCP-compatible clients and HTTP callers. Its primary capability is looking up an IP address and returning InternetDB observations such as detected open ports, hostnames, vulnerability flags, category tags, and, in some responses, CPE software fingerprints. The service is intended for defensive reconnaissance, reviewing an organization's externally visible attack surface, and adding infrastructure context to threat-hunting workflows.

InternetDB is a free, lightweight subset of Shodan's broader service. It does not provide the full Shodan feature set, such as historical searches, advanced search, or real-time alerts. Those capabilities require the commercial Shodan API.

## How it works

The hosted pack endpoint is an MCP connection at `https://gateway.pipeworx.io/shodan-internetdb/mcp`. Its pack-specific lookup tool is `shodan_internetdb_lookup_ip`. A direct HTTP request can call that tool at `https://gateway.pipeworx.io/v1/tools/shodan_internetdb_lookup_ip` with a JSON body containing an `ip` value.

Pack connections also expose shared Pipeworx meta-tools, including `ask_pipeworx`, `discover_tools`, `search_within`, `remember`, and `recall`. The pack endpoint lists the Shodan InternetDB tools alongside those gateway tools. `ask_pipeworx` can route a natural-language question across the wider Pipeworx catalog, including from this scoped connection.

The returned data reflects Shodan's internet scanning and should be read as a snapshot rather than a live probe. Ports may have changed since the scan, and vulnerability entries are heuristic matches based on service banners. A reported software version can remain visible after an instance is patched, so findings require direct verification.

## Setup and configuration

Add the hosted endpoint to an MCP client such as Claude Desktop, Cursor, or Windsurf:

```json
{
  "mcpServers": {
    "shodan-internetdb": {
      "url": "https://gateway.pipeworx.io/shodan-internetdb/mcp"
    }
  }
}
```

For all Pipeworx packs, use `https://gateway.pipeworx.io/mcp` instead. Both endpoints use the same gateway; the pack URL lists this pack's tools directly, while the full URL lists the broader catalog.

A local stdio option is available through `@pipeworx/mcp-shodan-internetdb`:

```json
{
  "mcpServers": {
    "shodan-internetdb": {
      "command": "npx",
      "args": ["-y", "@pipeworx/mcp-shodan-internetdb"]
    }
  }
}
```

The npm bridge requires network access and has no offline mode. Anonymous use is capped at 50 calls per day. Setting `PIPEWORX_API_KEY` with a key from Pipeworx raises the allowance to 200 calls per day. Set `PIPEWORX_META_TOOLS=1` if the local bridge should also list the shared gateway tools. When using an HTTPS proxy, newer Node releases can honor the proxy after enabling `NODE_USE_ENV_PROXY=1`.

## Tools and capabilities

- Look up an IP with `shodan_internetdb_lookup_ip`.
- Retrieve detected open ports and service information.
- Inspect hostnames associated with an address.
- Review Shodan vulnerability flags and categorical tags such as cloud, CDN, ICS, VPN, or Tor.
- Receive CPE software fingerprints when present in the response.
- Ask Pipeworx to route broader questions with `ask_pipeworx` when meta-tools are enabled or when using the hosted pack connection.

## Limitations and notes

InternetDB coverage is incomplete. Some addresses, including systems behind NAT, IPv6 addresses, or dynamically assigned addresses, may have no record. CDN and proxy addresses can represent shared infrastructure rather than a particular website. Tor tags identify exit nodes, which can include legitimate privacy-focused users as well as traffic that reputation systems treat cautiously.

Use the data for systems you own or are authorized to assess. Identifying and attacking third-party systems is unlawful and conflicts with Shodan's terms. InternetDB requires no Shodan authentication, signup, or key, but the optional Pipeworx API key controls the higher daily allowance for the npm bridge.

_Full upstream README: https://allmcps.com/mcp/shodan-internetdb/readme_