Shodan MCP server

Shodan MCP Server

A Model Context Protocol (MCP) server for querying the Shodan API and Shodan CVEDB. This server provides comprehensive access to Shodan's network intelligence and security services, including IP reconnaissance, DNS operations, vulnerability tracking, and device discovery. All tools provide structured, formatted output for easy analysis and integration.

Quick Start (Recommended)

Installing via Claude Code

claude mcp add --transport stdio --env SHODAN_API_KEY=your-shodan-api-key shodan -- npx -y @burtthecoder/mcp-shodan

Installing via Codex CLI

codex mcp add shodan --env SHODAN_API_KEY=your-shodan-api-key -- npx -y @burtthecoder/mcp-shodan

Installing via Gemini CLI

gemini mcp add -e SHODAN_API_KEY=your-shodan-api-key shodan npx -y @burtthecoder/mcp-shodan

Installing via Smithery

To install Shodan Server for Claude Desktop automatically via Smithery:

npx -y @smithery/cli install @burtthecoder/mcp-shodan --client claude

Installing Manually

1. Install the server globally via npm:

npm install -g @burtthecoder/mcp-shodan

1. Add to your Claude Desktop configuration file:

{
  "mcpServers": {
    "shodan": {
      "command": "mcp-shodan",
      "env": {
        "SHODAN_API_KEY": "your-shodan-api-key"
      }
    }
  }
}

Configuration file location:

• macOS: ~/Library/Application Support/Claude/claudedesktopconfig.json
• Windows: %APPDATA%\Claude\claudedesktopconfig.json

1. Restart Claude Desktop

Alternative Setup (From Source)

If you prefer to run from source or need to modify the code:

1. Clone and build:

git clone https://github.com/w0h1v/mcp-shodan.git
cd mcp-shodan
npm install
npm run build

1. Add to your Claude Desktop configuration:

{
  "mcpServers": {
    "shodan": {
      "command": "node",
      "args": ["/absolute/path/to/mcp-shodan/build/index.js"],
      "env": {
        "SHODAN_API_KEY": "your-shodan-api-key"
      }
    }
  }
}

Features

• Network Reconnaissance: Query detailed information about IP addresses, including open ports, services, and vulnerabilities
• DNS Operations: Forward and reverse DNS lookups for domains and IP addresses
• Vulnerability Intelligence: Access to Shodan's CVEDB for detailed vulnerability information, CPE lookups, and product-specific CVE tracking
• Device Discovery: Search Shodan's database of internet-connected devices with advanced filtering

Tools

1. IP Lookup Tool

• Name: ip_lookup
• Description: Retrieve comprehensive information about an IP address, including geolocation, open ports, running services, SSL certificates, hostnames, and cloud provider details if available
• Parameters:
• ip (required): IP address to lookup
• Returns:
• IP Information (address, organization, ISP, ASN)
• Location (country, city, coordinates)
• Services (ports, protocols, banners)
• SSL/TLS details per service (certificate subject/issuer CN, serial, SHA-256 fingerprint, validity, TLS versions, cipher, JARM, JA3S) — certificate SAN hostnames appear in the top-level Hostnames/Domains
• Cloud Provider details (if available)
• Associated hostnames and domains
• Tags

Shortened. The full README is on GitHub.