A command-line first-response tool that queries many threat intelligence services, sandboxes and malware repositories for hashes, URLs, IPs and domains.
4.1K+5 this week556PythonGPL-3.0Updated 2 months ago
w0h1v/mcp-shodan
MCP server that gives AI agents access to the Shodan API and CVEDB for internet device search, host recon, DNS and CVE intelligence.
Open-source alternative to:Shodan
- Stars
- 188
- Forks
- 31
- Open issues
- 3
- Last commit
- 3 days ago
What is it?
mcp-shodan is an MCP server that connects AI agents such as Claude, Codex and Gemini CLI to the Shodan API and the Shodan CVEDB. Given an IP, hostname, search query, product or CVE, the agent gets back open ports and banners, TLS certificate details, DNS records, and vulnerability severity with EPSS and KEV status.
The server exposes eleven read-only tools in three groups: network lookups (host info, device search, counts, subdomains and DNS resolution in batch), vulnerability intelligence from CVEDB (CVE details, CPE lookup, CVEs by product), and helpers that list search filters and show remaining API credits. Free tools are marked as such, and CVEDB calls need no API key.
It runs over stdio for desktop clients or as an HTTP streaming service, and requires Node.js 20 or newer and your own Shodan API key. Input is validated with zod schemas before requests are sent, and the key is sent only to api.shodan.io.
Key features
- 01Host reconnaissance on IPv4 and IPv6 addresses, including ports, products, CVEs and TLS details.
- 02Device search using Shodan query syntax, with paging and facet breakdowns.
- 03Free count-only queries to size a search before spending credits.
- 04CVE and CPE lookups with CVSS, EPSS and KEV data via CVEDB.
- 05Batch forward and reverse DNS lookups plus subdomain enumeration.
- 06Stdio or HTTP streaming transport, with Docker image support.
Use cases
- Asking an AI agent what services are exposed on a given IP during security reviews.
- Checking whether a CVE is in the KEV catalog and how likely it is to be exploited by EPSS score.
- Sizing an internet-wide search with free count queries before running paid searches.
- Enumerating subdomains and resolving DNS records for an external attack-surface inventory.
Quick start
- 1
Get a Shodan API key from your account page
- 2
Add the server to Claude Code
claude mcp add --transport stdio --env SHODAN_API_KEY=your-key shodan -- npx -y @burtthecoder/mcp-shodan
Things to know
- You need your own paid or membership Shodan API key, and search filters require a membership or paid plan.
- The HTTP transport has no authentication, so it must be kept on localhost or behind an authenticating proxy.
In collections
Topics
FAQ
- What is mcp-shodan?
- MCP server that gives AI agents access to the Shodan API and CVEDB for internet device search, host recon, DNS and CVE intelligence. mcp-shodan is an MCP server that connects AI agents such as Claude, Codex and Gemini CLI to the Shodan API and the Shodan CVEDB. Given an IP, hostname, search query, product or CVE, the agent gets back open ports and banners, TLS certificate details, DNS records, and vulnerability severity with EPSS and KEV status.
- Is mcp-shodan free to use? What license does it have?
- mcp-shodan is open source under the MIT license. Check the license terms before using it in commercial products.
- Is mcp-shodan still maintained?
- Actively maintained. The last commit to mcp-shodan was on Nov 4, 2026.
- What can I use mcp-shodan for?
- Asking an AI agent what services are exposed on a given IP during security reviews. Checking whether a CVE is in the KEV catalog and how likely it is to be exploited by EPSS score. Sizing an internet-wide search with free count queries before running paid searches. Enumerating subdomains and resolving DNS records for an external attack-surface inventory.
- How do I install mcp-shodan?
- Get a Shodan API key from your account page Add the server to Claude Code: claude mcp add --transport stdio --env SHODAN_API_KEY=your-key shodan -- npx -y @burtthecoder/mcp-shodan
- Where can I get mcp-shodan?
- The source code and installation instructions are on GitHub: https://github.com/w0h1v/mcp-shodan
Summary generated by AI from the project's README. GitHub stats refresh daily.
Related projects
Open source OSINT automation tool that gathers data on IPs, domains, emails and more from 200+ sources for threat intelligence and attack surface mapping.
24.4K+231 this week4KPythonMITUpdated 7 months ago
Open-source cyber threat intelligence platform for structuring, storing and visualizing threat knowledge and observables, built on the STIX2 standard.
10.3K+35 this week1.5KTypeScriptOtherUpdated 4 hours ago
Open-source graph-based OSINT investigation platform that links entities like domains, IPs, emails and wallets through automated enrichers.
10.1K+50 this week1.2KTypeScriptApache-2.0Well maintainedUpdated 20 days ago
A Go CLI that queries multiple internet search engines (Shodan, Censys, FOFA, ZoomEye and more) to find exposed hosts, with output designed for piping into other tools.
3.1K+3 this week282GoMITWell maintainedUpdated 3 days ago