Claude MarketplacesSubmit
burtthecoder avatar

Shodan

burtthecoder/mcp-shodan

Wraps Shodan's network intelligence and vulnerability APIs to bring internet-wide device discovery into Claude conversations. You can query IP addresses for open ports and services, search for internet-connected devices with Shodan queries, perform DNS lookups, and pull vulnerability data from Shodan's CVEDB including CVE details and CPE mappings. Works across Claude Desktop, Claude Code, Codex CLI, and Gemini CLI. Requires a Shodan API key. Reach for this when you need to investigate network infrastructure, research security vulnerabilities, or analyze internet-facing assets directly from your AI assistant without jumping between tools.

GitHub stars
135
tools
7
auth
Secret needed
transport
STDIO
env var
1
last updated
Mar 3, 2026
View on GitHub

Tools

7 tools

Public tool metadata for what this MCP can expose to an agent.

ip_lookupRetrieve comprehensive information about an IP address, including geolocation, open ports, running services, SSL certificates, hostnames, and cloud provider details if available. Returns service banners and HTTP server information when present.1 params

Retrieve comprehensive information about an IP address, including geolocation, open ports, running services, SSL certificates, hostnames, and cloud provider details if available. Returns service banners and HTTP server information when present.

Parameters* required
ipstring
The IP address to query.
shodan_searchSearch Shodan's database of internet-connected devices. Returns detailed information about matching devices including services, vulnerabilities, and geographic distribution. Supports advanced search filters and returns country-based statistics.2 params

Search Shodan's database of internet-connected devices. Returns detailed information about matching devices including services, vulnerabilities, and geographic distribution. Supports advanced search filters and returns country-based statistics.

Parameters* required
max_resultsnumber
Maximum results to return.default: 10
querystring
Search query for Shodan.
cve_lookupQuery detailed vulnerability information from Shodan's CVEDB. Returns comprehensive CVE details including CVSS scores (v2/v3), EPSS probability and ranking, KEV status, proposed mitigations, ransomware associations, and affected products (CPEs).1 params

Query detailed vulnerability information from Shodan's CVEDB. Returns comprehensive CVE details including CVSS scores (v2/v3), EPSS probability and ranking, KEV status, proposed mitigations, ransomware associations, and affected products (CPEs).

Parameters* required
cvestring
The CVE identifier to query (format: CVE-YYYY-NNNNN).
dns_lookupResolve domain names to IP addresses using Shodan's DNS service. Supports batch resolution of multiple hostnames in a single query. Returns IP addresses mapped to their corresponding hostnames.1 params

Resolve domain names to IP addresses using Shodan's DNS service. Supports batch resolution of multiple hostnames in a single query. Returns IP addresses mapped to their corresponding hostnames.

Parameters* required
hostnamesarray
List of hostnames to resolve.
cpe_lookupSearch for Common Platform Enumeration (CPE) entries by product name in Shodan's CVEDB. Supports pagination and can return either full CPE details or just the total count. Useful for identifying specific versions and configurations of software and hardware.4 params

Search for Common Platform Enumeration (CPE) entries by product name in Shodan's CVEDB. Supports pagination and can return either full CPE details or just the total count. Useful for identifying specific versions and configurations of software and hardware.

Parameters* required
countboolean
If true, returns only the count of matching CPEs.default: false
limitnumber
Maximum number of CPEs to return (max 1000).default: 1000
productstring
The name of the product to search for CPEs.
skipnumber
Number of CPEs to skip (for pagination).default: 0
cves_by_productSearch for vulnerabilities affecting specific products or CPEs. Supports filtering by KEV status, sorting by EPSS score, date ranges, and pagination. Can search by product name or CPE 2.3 identifier. Returns detailed vulnerability information including severity scores and impa...9 params

Search for vulnerabilities affecting specific products or CPEs. Supports filtering by KEV status, sorting by EPSS score, date ranges, and pagination. Can search by product name or CPE 2.3 identifier. Returns detailed vulnerability information including severity scores and impa...

Parameters* required
countboolean
If true, returns only the count of matching CVEs.default: false
cpe23string
The CPE version 2.3 identifier (format: cpe:2.3:part:vendor:product:version).
end_datestring
End date for filtering CVEs (format: YYYY-MM-DDTHH:MM:SS).
is_kevboolean
If true, returns only CVEs with the KEV flag set.default: false
limitnumber
Maximum number of CVEs to return (max 1000).default: 1000
productstring
The name of the product to search for CVEs.
skipnumber
Number of CVEs to skip (for pagination).default: 0
sort_by_epssboolean
If true, sorts CVEs by EPSS score in descending order.default: false
start_datestring
Start date for filtering CVEs (format: YYYY-MM-DDTHH:MM:SS).
reverse_dns_lookupPerform reverse DNS lookups to find hostnames associated with IP addresses. Supports batch lookups of multiple IP addresses in a single query. Returns all known hostnames for each IP address, with clear indication when no hostnames are found.1 params

Perform reverse DNS lookups to find hostnames associated with IP addresses. Supports batch lookups of multiple IP addresses in a single query. Returns all known hostnames for each IP address, with clear indication when no hostnames are found.

Parameters* required
ipsarray
List of IP addresses to perform reverse DNS lookup on.

Sponsors

Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthlyAgent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any language

Configuration

SHODAN_API_KEY*secret

Your Shodan API key

Readme

MCP Shodan: network intelligence for AI agents. Internet reconnaissance, DNS intelligence and CVE analysis over the Model Context Protocol.

npm version CI License: MIT Node 20 or newer MCP Registry

Quickstart · Tools · HTTP · Security · Troubleshooting · Docs

View the full README on GitHub

Details

Repository
github.com/burtthecoder/mcp-shodan
Categories
Search & Web Crawling, Security & Pentesting
Package
@burtthecoder/mcp-shodan
Transport
STDIO
Auth
Required
Registry
MCP registry, active

More from burtthecoder

Related Search & Web Crawling MCP servers

View all
1drix10 avatarAi Resourcesdrix10/ai-resourcesSearch and read daily AI news briefings: models, companies, funding, tools. CC BY 4.0.128stars
2nikolausm avatarImap Mcp Servernikolausm/imap-mcp-serverIMAP/SMTP MCP server to search, read, organize, send, reply & forward email for AI assistants122stars
3b1ff avatarAtlassian Dc Mcp Jirab1ff/atlassian-dc-mcpMCP server for Atlassian Jira Data Center - search, view, and create issues108stars
4pulsemcp avatarGoogle Flightspulsemcp/mcp-serversMCP server for searching Google Flights — flight search, date grid pricing, and airport lookup.0stars
5gtm-api avatargtm-api: LinkedIn MCP Servergtm-api/linkedin-mcpManaged LinkedIn MCP server for AI agents: search, connect, message and enrich on accounts you own.71stars
6sverklo avatarSverklosverklo/sverkloLocal-first MCP code intelligence: 37 tools — hybrid search, blast-radius, diff review, memory.71stars