Shodan MCP Server
Query Shodan's API for IP reconnaissance, vulnerability tracking, and device discovery.
Data last scanned today · Reviewed today
Overview
This server integrates Shodan's network intelligence directly into your AI assistant, providing structured data for IP address details, DNS lookups, and vulnerability tracking via Shodan CVEDB. It allows users to perform reconnaissance and device discovery by leveraging advanced filters against Shodan's global database of internet-connected assets. Designed for ease of analysis, the server delivers formatted outputs for various security tasks. Installation options are flexible, supporting direct execution via npx or manual configuration in standard AI client environments like Claude Desktop.
Our verdict
With a security score of 37/100, this tool is categorized as high risk. The rating reflects that it is a community-maintained project rather than an official Shodan release, and its authentication and read-only mode implementations have not been subject to professional editorial review. Users should exercise caution when inputting their Shodan API keys into this third-party wrapper and ensure they operate within secure environments.
- Supports comprehensive querying of Shodan CVEDB and network services
- Contains only four direct dependencies for reduced supply-chain surface
- Provides clear documentation for multiple installation methods
- Licensed under MIT for permissive use
- Security score of 37/100 indicates significant unverified risks
- Lacks editorial review of authentication and read-only mode safety
- Maintenance status is community-led with no official vendor affiliation
Setup
{
"mcpServers": {
"mcp-shodan": {
"args": [
"-y",
"@burtthecoder/mcp-shodan"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| ip_lookup | Retrieve comprehensive information about an IP address, including geolocation, open ports, running services, SSL certificates, hostnames, and cloud provider details if available | low |
| shodan_search | Search Shodan's database of internet-connected devices | low |
| cve_lookup | Query detailed vulnerability information from Shodan's CVEDB | low |
| dns_lookup | Resolve domain names to IP addresses using Shodan's DNS service | low |
| reverse_dns_lookup | Perform reverse DNS lookups to find hostnames associated with IP addresses | low |
| cpe_lookup | Search for Common Platform Enumeration (CPE) entries by product name | low |
| cves_by_product | Search for vulnerabilities affecting specific products or CPEs | low |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf | ||||
| ChatGPT |
Frequently asked questions
›What is required to use the Shodan MCP server?
You must provide a valid Shodan API key via the SHODAN_API_KEY environment variable in your configuration.
›Does this server support running from source?
Yes, you can clone the repository, build it using 'npm install' followed by 'npm run build', and point the MCP server command to the resulting 'index.js' file.
›How can I install this server automatically?
You can use the Smithery CLI to install the server directly into Claude Desktop with the command 'npx -y @smithery/cli install @burtthecoder/mcp-shodan --client claude'.
›What tools are included for vulnerability intelligence?
The server includes specific tools for querying CVE details by ID, searching for CVEs by product, and looking up Common Platform Enumeration (CPE) entries.
›Where should I add the configuration for Claude Desktop?
You should add the server configuration to the 'claude_desktop_config.json' file located in your user's Library or Application Support folder on macOS, or the APPDATA folder on Windows.
Badge
Maintain this server? Add the live badge to your README.