Shodan Internetdb

What Shodan Internetdb does

Shodan Internetdb exposes Shodan InternetDB data to MCP-compatible clients and HTTP callers. Its primary capability is looking up an IP address and returning InternetDB observations such as detected open ports, hostnames, vulnerability flags, category tags, and, in some responses, CPE software fingerprints. The service is intended for defensive reconnaissance, reviewing an organization's externally visible attack surface, and adding infrastructure context to threat-hunting workflows.

InternetDB is a free, lightweight subset of Shodan's broader service. It does not provide the full Shodan feature set, such as historical searches, advanced search, or real-time alerts. Those capabilities require the commercial Shodan API.

How it works

The hosted pack endpoint is an MCP connection at https://gateway.pipeworx.io/shodan-internetdb/mcp. Its pack-specific lookup tool is shodan_internetdb_lookup_ip. A direct HTTP request can call that tool at https://gateway.pipeworx.io/v1/tools/shodan_internetdb_lookup_ip with a JSON body containing an ip value.

Pack connections also expose shared Pipeworx meta-tools, including ask_pipeworx, discover_tools, search_within, remember, and recall. The pack endpoint lists the Shodan InternetDB tools alongside those gateway tools. ask_pipeworx can route a natural-language question across the wider Pipeworx catalog, including from this scoped connection.

The returned data reflects Shodan's internet scanning and should be read as a snapshot rather than a live probe. Ports may have changed since the scan, and vulnerability entries are heuristic matches based on service banners. A reported software version can remain visible after an instance is patched, so findings require direct verification.

Setup and configuration

Add the hosted endpoint to an MCP client such as Claude Desktop, Cursor, or Windsurf:

{
  "mcpServers": {
    "shodan-internetdb": {
      "url": "https://gateway.pipeworx.io/shodan-internetdb/mcp"
    }
  }
}

For all Pipeworx packs, use https://gateway.pipeworx.io/mcp instead. Both endpoints use the same gateway; the pack URL lists this pack's tools directly, while the full URL lists the broader catalog.

A local stdio option is available through @pipeworx/mcp-shodan-internetdb:

{
  "mcpServers": {
    "shodan-internetdb": {
      "command": "npx",
      "args": ["-y", "@pipeworx/mcp-shodan-internetdb"]
    }
  }
}

The npm bridge requires network access and has no offline mode. Anonymous use is capped at 50 calls per day. Setting PIPEWORX_API_KEY with a key from Pipeworx raises the allowance to 200 calls per day. Set PIPEWORX_META_TOOLS=1 if the local bridge should also list the shared gateway tools. When using an HTTPS proxy, newer Node releases can honor the proxy after enabling NODE_USE_ENV_PROXY=1.

Tools and capabilities

• Look up an IP with shodan_internetdb_lookup_ip.
• Retrieve detected open ports and service information.
• Inspect hostnames associated with an address.
• Review Shodan vulnerability flags and categorical tags such as cloud, CDN, ICS, VPN, or Tor.
• Receive CPE software fingerprints when present in the response.
• Ask Pipeworx to route broader questions with ask_pipeworx when meta-tools are enabled or when using the hosted pack connection.

Limitations and notes

InternetDB coverage is incomplete. Some addresses, including systems behind NAT, IPv6 addresses, or dynamically assigned addresses, may have no record. CDN and proxy addresses can represent shared infrastructure rather than a particular website. Tor tags identify exit nodes, which can include legitimate privacy-focused users as well as traffic that reputation systems treat cautiously.

Use the data for systems you own or are authorized to assess. Identifying and attacking third-party systems is unlawful and conflicts with Shodan's terms. InternetDB requires no Shodan authentication, signup, or key, but the optional Pipeworx API key controls the higher daily allowance for the npm bridge.