shodan-mcp

Overview

The Shodan MCP server integrates Shodan's internet intelligence database directly into AI clients like Claude, Cursor, and VS Code. It offers both free tools that require no API key and premium tools for comprehensive reconnaissance. The server provides structured output using Pydantic models and includes input validation to ensure secure operations. All queries are passive, meaning no packets are sent directly to target systems.

Try asking AI

After installing, here are 5 things you can ask your AI assistant:

• shodan-cve-lookup

  Look up any CVE -- CVSS v3 scores, EPSS exploit prediction, references, affected CPEs

  Try:What are the details of CVE-2021-44228?Try:Show me information about CVE-2023-38408
• shodan-search-cves

  Search CVEs with filters -- CISA KEV catalog, EPSS sorting, date ranges

  Try:Search for CVEs related to Apache HTTP Server sorted by EPSS scoreTry:Find all critical CVEs from the past month
• shodan-search-cpes

  Search CPE identifiers by product name (e.g., 'apache', 'nginx')

  Try:Look up CPE identifiers for nginxTry:Find CPEs for Microsoft Windows Server
• shodan-internetdb-lookup

  Fast free IP intelligence -- open ports, vulns, hostnames, CPEs, tags

  Try:Do a quick InternetDB lookup on my server's IPTry:What vulnerabilities are associated with 8.8.8.8?
• shodan-ip-lookup

  Full IP reconnaissance -- ports, services, banners, geolocation, vulns, ISP/org, ASN

  Try:What services are running on 93.184.216.34?Try:Show me detailed information about this IP address
• shodan-search

  Search Shodan's database of billions of devices with powerful query syntax

  Try:Find all exposed webcams with default passwordsTry:Search for vulnerable IoT devices in my country
• shodan-dns-resolve

  Resolve hostnames to IP addresses

  Try:What IP address does google.com resolve to?Try:Resolve the hostname myapp.example.com to an IP address
• shodan-domain-info

  Domain reconnaissance -- subdomains, DNS records, tags

  Try:What DNS records exist for my company's domain?Try:Show me all subdomains for example.com
• shodan-honeypot-score

  Detect if an IP is a honeypot (0.0 = real, 1.0 = honeypot)

  Try:Is this IP address a honeypot?Try:Check the honeypot score for 45.33.32.156
• shodan-api-info

  Check API key usage -- plan type, remaining credits

  Try:Check my Shodan API plan and remaining query creditsTry:How many API queries do I have left?
• shodan-my-ip

  Get your external IP address as seen by Shodan

  Try:What's my external IP address?Try:Show me the IP address that Shodan sees for my connection
• shodan-list-filters

  List available search filters

  Try:What search filters are available in Shodan?Try:Show me all the filters I can use in searches

Comparable tools

Installation

docker build -t shodan-mcp https://github.com/vorotaai/shodan-mcp.git

git clone https://github.com/vorotaai/shodan-mcp.git
cd shodan-mcp
uv sync --all-groups
shodan-mcp

git clone https://github.com/vorotaai/shodan-mcp.git
cd shodan-mcp
pip install .
shodan-mcp

{
  "mcpServers": {
    "shodan-mcp": {
      "command": "docker",
      "args": ["run", "--rm", "-i", "-e", "SHODAN_API_KEY", "shodan-mcp"],
      "env": {
        "SHODAN_API_KEY": "your-api-key-here"
      }
    }
  }
}

FAQ

Do I need a Shodan API key?

Not to get started. 4 tools work immediately with no key: CVE lookup, CVE search, CPE search, and InternetDB. A free API key unlocks the remaining 16 tools.

Is it safe?

Yes. All queries are passive (no packets to targets), inputs are validated, and API keys are never exposed in error messages.

Compare shodan-mcp with