MCP Shodan

What BurtTheCoder/mcp-shodan MCP server does

BurtTheCoder/mcp-shodan MCP server gives MCP clients access to selected Shodan network intelligence and vulnerability database operations. It can retrieve information about an IP address, search Shodan's indexed internet-connected devices, resolve DNS records, and query vulnerability data from Shodan CVEDB.

IP lookups can include organization, ISP, ASN, location, open ports, service banners, SSL certificates, hostnames, tags, and cloud provider information when available. Device searches accept Shodan search queries and can return result totals, country distributions, and device or service details. The CVE functions expose identifiers, publication data, CVSS and EPSS information, KEV status, affected CPEs, mitigations, references, and ransomware associations where provided by the source.

How it works

The BurtTheCoder/mcp-shodan MCP server runs as a local Node.js process and communicates with the MCP client over standard input/output. Requests are forwarded to Shodan using the API key supplied through the environment. Responses are formatted as structured results for analysis by the client.

The server provides separate operations for IP lookup, Shodan search, CVE lookup, DNS lookup, reverse DNS lookup, CPE lookup, and CVE searches by product. DNS lookup accepts multiple hostnames, while reverse DNS accepts multiple IP addresses. CPE and product-CVE queries support pagination through skip and limit values. Product-CVE searches can also filter by publication dates, restrict results to KEV entries, and sort by EPSS score. A CVE search must use either a product name or a CPE 2.3 identifier, not both.

Setup and configuration

The BurtTheCoder/mcp-shodan MCP server requires Node.js v20 or later and a valid Shodan API key. The documented npm command is:

npx -y @burtthecoder/mcp-shodan

Configure the process with the SHODAN_API_KEY environment variable. For Claude Desktop, the README shows a server entry using mcp-shodan as the command after a global npm installation, or node with the built source file when running from a clone. The source workflow installs dependencies with npm, builds the project, and runs build/index.js.

Shodan account credits and permissions affect which operations succeed. A missing or invalid key can produce a 401 response, exhausted query credits can produce 402, and rate limits can produce 429. The project recommends checking the Shodan account dashboard and testing a simple DNS query when troubleshooting authentication.

Tools and capabilities

• Look up IP addresses and associated services.
• Search Shodan's device database with a query and result limit.
• Retrieve detailed records for a CVE identifier.
• Resolve hostnames to IP addresses and IP addresses to hostnames.
• Search CPE entries by product with optional counts and pagination.
• Find CVEs by product or CPE, with KEV, EPSS, date, count, and pagination options.

Limitations and notes

The server depends on Shodan availability, API permissions, query credits, and rate limits. Inputs must follow the expected formats, including CVE identifiers, CPE 2.3 values, and date filters formatted as YYYY-MM-DDTHH:MM:SS. The material documents Claude Desktop, Claude Code, Codex CLI, Gemini CLI, and Smithery setup paths, but does not establish compatibility with every MCP client.