MCP Shodan vs MANDA
A side-by-side look at the MCP Shodan and MANDA MCP servers: transport, auth, tools, quality signals, and the config to install either one in Claude, Cursor, Windsurf or VS Code.
Verdict: choose MCP Shodan for security work as a local process; choose MANDA for security. You can also run both side by side in one mcpServers block.
Which MCP server should you choose?
Choose MCP Shodan when
- You need dedicated capabilities in the Security domain.
- You prefer a local stdio subprocess transport.
- Its auth model fits you: API key required.
- You have the keys it needs:
SHODAN_API_KEY. - You want tools like
ip_lookup, ip, shodan_search.
Feature & specification comparison
Rows where the two servers differ are marked.
| Spec | M MANDA | |
|---|---|---|
| Category | Security | Security |
| Quality signal | 68/100 · Great | 37/100 · Fair |
| Install command | Confirmed | Not confirmed yet |
| Transport | Local subprocess (stdio) | — |
| Auth | API key required | Not declared |
| Pricing | BYOK (pay the provider) | Not declared |
| Required env vars | SHODAN_API_KEY | None listed |
| Verified owner | Community listing | Community listing |
| GitHub stars | 179 | — |
| Directory activity | 4 views 0 installs 0 upvotes | 0 views 0 installs 0 upvotes |
| Tools | 22 | Not listed |
| Full listing | View MCP Shodan | View MANDA |
Tools & capabilities
MCP Shodan tools 22
ip_lookupipshodan_searchquerymax_resultscve_lookupcvedns_lookuphostnamesreverse_dns_lookupipscpe_lookup- +10 more on the listing page
MANDA tools
No tool names declared yet. Check the project README from the listing page.
Ready-to-paste client configs
Paste either block (or both) into your client config, e.g. claude_desktop_config.json or ~/.cursor/mcp.json. We only show a config when the install command is confirmed.
MCP Shodan
{
"mcpServers": {
"burtthecoder-mcp-shodan": {
"command": "npx",
"args": [
"-y",
"@burtthecoder/mcp-shodan"
],
"env": {
"SHODAN_API_KEY": "YOUR_SHODAN_API_KEY_HERE"
}
}
}
}
MANDA
No confirmed install command for MANDA yet — follow the setup steps linked from its listing page rather than a guessed package name.