mcp-shodan
MCP server for Shodan and CVEDB: IP reconnaissance, device search, DNS and vulnerability data with EPSS and KEV
- 191 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Queries spend paid Shodan credits and HTTP mode without auth exposes them to anyone
- The tool gathers information on third-party hosts: use it on your own assets or with permission
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/mcp-shodanDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Queries spend paid Shodan credits and HTTP mode without auth exposes them to anyone
- The tool gathers information on third-party hosts: use it on your own assets or with permission
This is third-party code. Review the repository files before installing.
What it does
The server gives an agent access to the Shodan API and the free CVEDB database. For an IP or host name the agent gets what an analyst looks at: open ports, products and versions, known CVEs, TLS certificate details (fingerprint, JARM, JA3S), cloud provider and banner history. Device search uses Shodan query syntax with paging and facet breakdowns by country, organization, port and vulnerability, and a count mode sizes a query for free. DNS is covered too: subdomains, records and forward and reverse lookups for batches. Eleven tools are read-only: `ip_lookup`, `shodan_search`, `shodan_count`, `domain_info`, `dns_lookup`, `reverse_dns_lookup`, `cve_lookup`, `cpe_lookup`, `cves_by_product`, `search_filters` and `api_info`. For a CVE it returns CVSS v4, v3 and v2, EPSS and the KEV flag, and a product list sorts by EPSS. Free tools are marked and `api_info` shows remaining credits. Transport is stdio or HTTP streaming.
Who it is for. Security specialists and network administrators who check their own hosts and look up vulnerability data through an agent.
Good fit when
- You need to see what is visible from outside at an organization address: ports, versions and certificate
- A new CVE is out and the agent checks it by CVSS, EPSS and the KEV flag
- A vulnerability list for a product is gathered and sorted by likelihood of exploitation
- A search query size is estimated with a free count before spending credits
- Forward and reverse DNS is run in bulk for a list of addresses
Not a fit when
- You need active scanning: the server reads data Shodan already collected and scans nothing itself
- You have no Shodan key: some tools such as CVEDB are free but search and IP details need a key
- You want data on other systems to break in: the tool is meant for defense and checking your own assets
Example request
What is exposed on 8.8.8.8 and is CVE-2021-44228 in the KEV catalogMCP
- Transport
- stdio, http
- Authentication
- API key
Environment variables
SHODAN_API_KEYrequired, secret- Shodan API key.
MCP_TRANSPORT- `stdio` or `httpStream`.
Limitations
Node.js 20 or newer and your own Shodan key are required, and the project is not affiliated with Shodan. Queries spend plan credits: a filtered search costs one query credit plus one per extra page and `domain_info` costs one per call. `shodan_count`, `ip_lookup`, DNS tools, `search_filters`, `api_info` and CVEDB tools are free. HTTP mode has no authentication: keep the port on localhost or behind an authenticating proxy, or anyone who can reach it will spend your credits.
How to disable. Remove the server in the client (`claude mcp remove shodan`) and revoke the API key in your Shodan account if needed.
FAQ
How do I connect mcp-shodan to Claude Code?
Run `claude mcp add --transport stdio --env SHODAN_API_KEY=your-key shodan -- npx -y @burtthecoder/mcp-shodan`. Codex has `codex mcp add` and Gemini CLI has `gemini mcp add`.
Do I need a paid Shodan key?
You need your own Shodan key. Some tools are free, including CVEDB, `ip_lookup` and the count, while filtered `shodan_search` and `domain_info` spend plan credits.
How much does a search cost?
A filtered search costs one query credit plus one per extra page and `domain_info` costs one per call. `api_info` shows what remains.
Does the server scan networks?
No, the tools only read data Shodan already collected and scan or change nothing themselves.
How do I run it as a shared service?
With `MCP_TRANSPORT=httpStream`, `MCP_PORT=3000` and `SHODAN_API_KEY`, or from a Docker image. HTTP mode has no authentication, so keep the port on localhost or behind a proxy.
Discussion
No questions or reviews yet.
Related
MCP serversAn MCP server that gives the agent vulnerability triage: NVD data, EPSS, the CISA KEV catalog, MITRE ATT&CK mapping and one-call CVE risk scoring
A free vulnerability MCP server that merges CVE, GHSA, OSV, CISA KEV and EPSS into one entry and checks a project lockfile.
cvENGINE finds a domain's exposed assets and the vulnerabilities being exploited, and its MCP server drives scans from Claude Code
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
Security Detections MCP: a detection rule database
Security Detections MCP
An MCP server that merges Sigma, Splunk, Elastic and KQL rules into one database for finding detections and ATT&CK gaps
A bridge between an MCP client and a Kali Linux terminal so the agent can run nmap, sqlmap, hydra and other tools for authorized pentesting and CTF
README in short
The README lists capabilities (host reconnaissance, device search, vulnerability intelligence, DNS), the flow diagram and a quick start for three clients. Then come a table of eleven tools with credit costs, HTTP mode and a security section.