Log inSubmit server
MCP Shodan logo

MCP Shodan

by BurtTheCoder

Queries Shodan for IP, DNS, device, CPE, and vulnerability intelligence through MCP tools.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install MCP Shodan

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "burtthecoder-mcp-shodan": {
      "command": "npx",
      "args": [
        "-y",
        "@burtthecoder/mcp-shodan"
      ],
      "env": {
        "SHODAN_API_KEY": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y @burtthecoder/mcp-shodan

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 1mo ago.

Overview

BurtTheCoder/mcp-shodan MCP server exposes Shodan API and Shodan CVEDB queries as MCP tools. It supports IP reconnaissance, device searches, forward and reverse DNS, CVE lookups, CPE searches, and product vulnerability queries. The server runs locally through Node.js and authenticates with a SHODAN_API_KEY. Use it when an MCP-compatible client needs structured Shodan data for security research or network analysis.

Use cases

  • Investigate IP addresses and exposed services
  • Search internet-connected devices with Shodan queries
  • Resolve hostnames and reverse DNS records
  • Review CVEs affecting a product or CPE
  • Filter vulnerabilities by KEV status or EPSS

Key features

  • IP reconnaissance with service and location details
  • Shodan device search
  • Forward and reverse DNS lookups
  • CVE and CVEDB queries
  • CPE search with pagination
  • Product vulnerability filtering

Tools22

What MCP Shodan lets your agent do. Expand a tool for its parameters.

Self-reported~45 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

9/9 checks healthy over the last 78d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 9d ago via OSV.dev · @burtthecoder/mcp-shodan (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars179Stargazers on the source repository.
npm downloads1.8kPackage downloads in the last 30 days.
Last commit2d agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Tools exposed22Callable tools this server registers over MCP.
Directory activity4 viewsConfig copies, upvotes, and views on AllMCPs.

How MCP Shodan works

What BurtTheCoder/mcp-shodan MCP server does

BurtTheCoder/mcp-shodan MCP server gives MCP clients access to selected Shodan network intelligence and vulnerability database operations. It can retrieve information about an IP address, search Shodan's indexed internet-connected devices, resolve DNS records, and query vulnerability data from Shodan CVEDB.

IP lookups can include organization, ISP, ASN, location, open ports, service banners, SSL certificates, hostnames, tags, and cloud provider information when available. Device searches accept Shodan search queries and can return result totals, country distributions, and device or service details. The CVE functions expose identifiers, publication data, CVSS and EPSS information, KEV status, affected CPEs, mitigations, references, and ransomware associations where provided by the source.

How it works

The BurtTheCoder/mcp-shodan MCP server runs as a local Node.js process and communicates with the MCP client over standard input/output. Requests are forwarded to Shodan using the API key supplied through the environment. Responses are formatted as structured results for analysis by the client.

The server provides separate operations for IP lookup, Shodan search, CVE lookup, DNS lookup, reverse DNS lookup, CPE lookup, and CVE searches by product. DNS lookup accepts multiple hostnames, while reverse DNS accepts multiple IP addresses. CPE and product-CVE queries support pagination through skip and limit values. Product-CVE searches can also filter by publication dates, restrict results to KEV entries, and sort by EPSS score. A CVE search must use either a product name or a CPE 2.3 identifier, not both.

Setup and configuration

The BurtTheCoder/mcp-shodan MCP server requires Node.js v20 or later and a valid Shodan API key. The documented npm command is:

Terminal
npx -y @burtthecoder/mcp-shodan

Configure the process with the SHODAN_API_KEY environment variable. The source workflow installs dependencies with npm, builds the project, and runs build/index.js.

Shodan account credits and permissions affect which operations succeed. A missing or invalid key can produce a 401 response, exhausted query credits can produce 402, and rate limits can produce 429. The project recommends checking the Shodan account dashboard and testing a simple DNS query when troubleshooting authentication.

Tools and capabilities

  • Look up IP addresses and associated services.
  • Search Shodan's device database with a query and result limit.
  • Retrieve detailed records for a CVE identifier.
  • Resolve hostnames to IP addresses and IP addresses to hostnames.
  • Search CPE entries by product with optional counts and pagination.
  • Find CVEs by product or CPE, with KEV, EPSS, date, count, and pagination options.

Limitations and notes

The server depends on Shodan availability, API permissions, query credits, and rate limits. Inputs must follow the expected formats, including CVE identifiers, CPE 2.3 values, and date filters formatted as YYYY-MM-DDTHH:MM:SS. The material documents Claude Desktop, Claude Code, Codex CLI, Gemini CLI, and Smithery setup paths, but does not establish compatibility with every MCP client.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about MCP Shodan

Install it with Node.js and run `npx -y @burtthecoder/mcp-shodan`, or install the npm package globally and configure the resulting `mcp-shodan` command.

It requires a valid Shodan API key set in the `SHODAN_API_KEY` environment variable.

Yes. The README provides manual Claude Desktop configuration and installation instructions.

Yes. Its CVEs by Product tool accepts either a product name or a CPE 2.3 identifier and supports KEV, EPSS, date, count, and pagination options.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewMCP Shodan AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/burtthecoder-mcp-shodan?style=directory)](https://allmcps.com/mcp/burtthecoder-mcp-shodan)
HTML Embed
<a href="https://allmcps.com/mcp/burtthecoder-mcp-shodan"><img src="https://allmcps.com/api/badge/burtthecoder-mcp-shodan?style=directory" alt="MCP Shodan on AllMCPs" /></a>