Shodan

burtthecoder/mcp-shodan

Wraps Shodan's network intelligence and vulnerability APIs to bring internet-wide device discovery into Claude conversations. You can query IP addresses for open ports and services, search for internet-connected devices with Shodan queries, perform DNS lookups, and pull vulnerability data from Shodan's CVEDB including CVE details and CPE mappings. Works across Claude Desktop, Claude Code, Codex CLI, and Gemini CLI. Requires a Shodan API key. Reach for this when you need to investigate network infrastructure, research security vulnerabilities, or analyze internet-facing assets directly from your AI assistant without jumping between tools.

GitHub stars: 135
tools: 7
auth: Secret needed
transport: STDIO
env var: 1
last updated: Mar 3, 2026

View on GitHub

Tools

7 tools

Public tool metadata for what this MCP can expose to an agent.

ip_lookupRetrieve comprehensive information about an IP address, including geolocation, open ports, running services, SSL certificates, hostnames, and cloud provider details if available. Returns service banners and HTTP server information when present.1 params

Retrieve comprehensive information about an IP address, including geolocation, open ports, running services, SSL certificates, hostnames, and cloud provider details if available. Returns service banners and HTTP server information when present.

Parameters* required

ipstring

The IP address to query.

shodan_searchSearch Shodan's database of internet-connected devices. Returns detailed information about matching devices including services, vulnerabilities, and geographic distribution. Supports advanced search filters and returns country-based statistics.2 params

Search Shodan's database of internet-connected devices. Returns detailed information about matching devices including services, vulnerabilities, and geographic distribution. Supports advanced search filters and returns country-based statistics.

Parameters* required

max_resultsnumber

Maximum results to return.default: 10

querystring

Search query for Shodan.

cve_lookupQuery detailed vulnerability information from Shodan's CVEDB. Returns comprehensive CVE details including CVSS scores (v2/v3), EPSS probability and ranking, KEV status, proposed mitigations, ransomware associations, and affected products (CPEs).1 params

Query detailed vulnerability information from Shodan's CVEDB. Returns comprehensive CVE details including CVSS scores (v2/v3), EPSS probability and ranking, KEV status, proposed mitigations, ransomware associations, and affected products (CPEs).

Parameters* required

cvestring

The CVE identifier to query (format: CVE-YYYY-NNNNN).

dns_lookupResolve domain names to IP addresses using Shodan's DNS service. Supports batch resolution of multiple hostnames in a single query. Returns IP addresses mapped to their corresponding hostnames.1 params

Resolve domain names to IP addresses using Shodan's DNS service. Supports batch resolution of multiple hostnames in a single query. Returns IP addresses mapped to their corresponding hostnames.

Parameters* required

hostnamesarray

List of hostnames to resolve.

cpe_lookupSearch for Common Platform Enumeration (CPE) entries by product name in Shodan's CVEDB. Supports pagination and can return either full CPE details or just the total count. Useful for identifying specific versions and configurations of software and hardware.4 params

Search for Common Platform Enumeration (CPE) entries by product name in Shodan's CVEDB. Supports pagination and can return either full CPE details or just the total count. Useful for identifying specific versions and configurations of software and hardware.

Parameters* required

countboolean

If true, returns only the count of matching CPEs.default: false

limitnumber

Maximum number of CPEs to return (max 1000).default: 1000

productstring

The name of the product to search for CPEs.

skipnumber

Number of CPEs to skip (for pagination).default: 0

cves_by_productSearch for vulnerabilities affecting specific products or CPEs. Supports filtering by KEV status, sorting by EPSS score, date ranges, and pagination. Can search by product name or CPE 2.3 identifier. Returns detailed vulnerability information including severity scores and impa...9 params

Search for vulnerabilities affecting specific products or CPEs. Supports filtering by KEV status, sorting by EPSS score, date ranges, and pagination. Can search by product name or CPE 2.3 identifier. Returns detailed vulnerability information including severity scores and impa...

Parameters* required

countboolean

If true, returns only the count of matching CVEs.default: false

cpe23string

The CPE version 2.3 identifier (format: cpe:2.3:part:vendor:product:version).

end_datestring

End date for filtering CVEs (format: YYYY-MM-DDTHH:MM:SS).

is_kevboolean

If true, returns only CVEs with the KEV flag set.default: false

limitnumber

Maximum number of CVEs to return (max 1000).default: 1000

productstring

The name of the product to search for CVEs.

skipnumber

Number of CVEs to skip (for pagination).default: 0

sort_by_epssboolean

If true, sorts CVEs by EPSS score in descending order.default: false

start_datestring

Start date for filtering CVEs (format: YYYY-MM-DDTHH:MM:SS).

reverse_dns_lookupPerform reverse DNS lookups to find hostnames associated with IP addresses. Supports batch lookups of multiple IP addresses in a single query. Returns all known hostnames for each IP address, with clear indication when no hostnames are found.1 params

Perform reverse DNS lookups to find hostnames associated with IP addresses. Supports batch lookups of multiple IP addresses in a single query. Returns all known hostnames for each IP address, with clear indication when no hostnames are found.

Parameters* required

ipsarray

List of IP addresses to perform reverse DNS lookup on.