Log inSubmit server
Shodan logo

Shodan

Connects AI agents to Shodan for host reconnaissance, device search, DNS lookups, and CVE intelligence.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Shodan

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "shodan-2": {
      "command": "npx",
      "args": [
        "-y",
        "@burtthecoder/mcp-shodan"
      ],
      "env": {
        "SHODAN_API_KEY": "YOUR_VALUE_HERE",
        "MCP_TRANSPORT": "YOUR_VALUE_HERE",
        "MCP_HOST": "YOUR_VALUE_HERE",
        "MCP_PORT": "YOUR_VALUE_HERE",
        "MCP_ENDPOINT": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

Install not yet sandbox-tested— the server itself is confirmed live (we called its tools/list endpoint). The stdio install command is a separate, ongoing check.

Overview

The shodan MCP server exposes Shodan API and Shodan CVEDB data through read-only MCP tools. Agents can inspect IPs, search internet-connected devices, resolve DNS, examine domains, and query CVE, CPE, EPSS, and KEV information. It supports stdio for desktop clients and HTTP streaming for standalone services. Reach for it when an agent needs structured network intelligence or vulnerability research, while keeping in mind that some operations consume Shodan query credits.

Use cases

  • Inspect an IP address for exposed services and known vulnerabilities
  • Search internet-connected devices with Shodan query filters
  • Map a domain’s subdomains and DNS records
  • Check products or CPEs for CVEs, EPSS scores, and KEV status
  • Review remaining Shodan credits and account limits

Key features

  • IP reconnaissance with ports, banners, TLS, cloud, and CVE data
  • Shodan device search with pagination and facets
  • Forward, reverse, and domain DNS intelligence
  • CVE and CPE analysis through Shodan CVEDB
  • Free count, filter, account, and CVEDB helper tools
  • stdio and HTTP streaming transports

Tools11

What Shodan lets your agent do. Expand a tool for its parameters.

Verified live~2.0k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

15/15 checks healthy over the last 44d

What it can do

From the 11 tools this server returned when we ran it; 11 declare their own safety hints.

Handles credentials · 1Makes network requests · 11Read-only tools · 11
Network at startup3 connections
Files written at startupNone
Install scriptsNone
npm provenanceSigned build
Package age677 days
Maintainers1

Observed 2026-10-21 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 13d ago via OSV.dev · @burtthecoder/mcp-shodan (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars189Stargazers on the source repository.
npm downloads4.4kPackage downloads in the last 30 days.
Last commit3d agoMost recent push to the default branch.
Tools exposed11Callable tools this server registers over MCP.
Directory activity3 viewsConfig copies, upvotes, and views on AllMCPs.

How Shodan works

What shodan does

The shodan MCP server gives MCP-compatible AI clients access to Shodan’s internet intelligence and CVEDB services. Its read-only tools cover host reconnaissance, device discovery, DNS analysis, domain information, and vulnerability research.

An IP lookup can return open ports, detected products and versions, service banners, operating system data, geolocation, hostnames, TLS certificate details, cloud provider information, and associated CVEs. Historical banners can be requested, while a compact mode omits banner data. Device searches use Shodan query syntax and can return matching services, vulnerabilities, geographic facets, and pagination results.

The CVEDB tools provide CVSS v2, v3, and v4 scores, EPSS data, KEV status, affected CPEs, mitigations, references, and ransomware associations. Product and CPE searches can be filtered by KEV status or date and sorted by EPSS. DNS tools support forward and reverse lookups in batches, while domain information includes subdomains and DNS records.

How it works

The server validates tool arguments before sending HTTPS requests to Shodan. Requests to the Shodan API use the configured API key; CVEDB requests do not require that key. Results are returned to the agent as structured JSON text.

stdio is the default transport and suits local desktop or command-line clients. Setting MCP_TRANSPORT=httpStream starts an HTTP streaming service instead. The HTTP service exposes a health endpoint at /health and uses /mcp as its default MCP path.

Most reconnaissance and CVEDB operations are free under the server’s credit accounting. Filtered shodan_search requests use one query credit, with an additional credit for each page after the first. domain_info uses one query credit per call. shodan_count, ip_lookup, DNS lookups, helper tools, and CVEDB queries do not consume query credits.

Setup and configuration

Node.js 20 or newer and a Shodan API key are required. For a local stdio installation, run the package through npx and provide SHODAN_API_KEY in the MCP client configuration. Claude Code, Codex CLI, and Gemini CLI can register it with their respective MCP commands; Claude Desktop and VS Code can also connect through client configuration.

HTTP mode can be started with:

sh
MCP_TRANSPORT=httpStream MCP_PORT=3000 SHODAN_API_KEY=your-key node build/index.js

MCP_HOST controls the HTTP bind address, MCP_PORT selects the listening port, and MCP_ENDPOINT changes the MCP path. The default host is localhost, the default port is 3000, and the default endpoint is /mcp.

The HTTP transport has no built-in authentication. Keep it bound to localhost or place it behind an authenticating reverse proxy, particularly because reachable users could spend the configured Shodan account’s credits. The API key is sent only to api.shodan.io; lookup values are sent to Shodan.

Tools and capabilities

  • ip_lookup: Inspect ports, services, banners, TLS data, location, cloud details, and vulnerabilities for an IPv4 or IPv6 address.
  • shodan_search: Search devices with Shodan filters, paging, and facet breakdowns.
  • shodan_count: Get query totals and facets without retrieving result records.
  • domain_info: Retrieve subdomains and DNS records for a domain.
  • dns_lookup and reverse_dns_lookup: Resolve hostnames or find hostnames for IP addresses, including batch requests.
  • cve_lookup: Retrieve detailed information for one CVE.
  • cpe_lookup: Find CPE entries for a product, with pagination or count-only output.
  • cves_by_product: Find vulnerabilities by product name or CPE with filtering and EPSS sorting.
  • search_filters: List valid Shodan filters and facets.
  • api_info: Show plan details and remaining query and scan credits.

Limitations and notes

Shodan search filters may require a membership or paid API plan. Shodan also permits roughly one request per second, so clients may need to retry after rate-limit responses. Invalid API keys produce authorization errors. This is an independent project and is not affiliated with Shodan.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Shodan

shodan is an MCP server that connects AI agents to the Shodan API and Shodan CVEDB. Its main tools perform IP lookups, device searches, DNS and domain queries, and CVE, CPE, EPSS, and KEV analysis. It returns structured results through stdio or HTTP streaming.

Install it by running the npm package with Node.js 20 or newer and setting `SHODAN_API_KEY`. For example, MCP clients can launch `npx -y @burtthecoder/mcp-shodan` over stdio with the key supplied as an environment variable.

Yes, shodan supports Claude Desktop through its standard stdio transport. Add the server to the client configuration, provide `SHODAN_API_KEY`, and launch the npm package with `npx`.

Yes, shodan can run over HTTP streaming by setting `MCP_TRANSPORT=httpStream`. Configure `MCP_HOST`, `MCP_PORT`, and `MCP_ENDPOINT` as needed. The transport has no authentication, so keep it local or protect it with an authenticating reverse proxy.

The free tools are `shodan_count`, `ip_lookup`, forward and reverse DNS lookups, `search_filters`, `api_info`, and the CVEDB tools. Filtered `shodan_search` calls consume query credits, and `domain_info` costs one query credit per lookup.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewShodan AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/shodan-2?style=directory)](https://allmcps.com/mcp/shodan-2)
HTML Embed
<a href="https://allmcps.com/mcp/shodan-2"><img src="https://allmcps.com/api/badge/shodan-2?style=directory" alt="Shodan on AllMCPs" /></a>