Shodan MCP Server -- AI-Powered Internet Intelligence for Claude, Cursor & VS Code

shodan-mcp is a Model Context Protocol (MCP) server that gives AI agents like Claude, Cursor, and GitHub Copilot direct access to Shodan -- the world's search engine for internet-connected devices. Built by Vorota AI.

20 tools for passive reconnaissance, vulnerability intelligence, DNS analysis, and device search -- all from your IDE. No packets sent to any target.

---

Quick Start

docker build -t shodan-mcp https://github.com/vorotaai/shodan-mcp.git

Add to your MCP client (Claude Desktop, Cursor, VS Code, etc.):

{
  "mcpServers": {
    "shodan-mcp": {
      "command": "docker",
      "args": ["run", "--rm", "-i", "-e", "SHODAN_API_KEY", "shodan-mcp"],
      "env": {
        "SHODAN_API_KEY": "your-api-key-here"
      }
    }
  }
}

4 tools work immediately with no API key -- CVE lookup, CVE search, CPE search, and InternetDB. Get a Shodan API key at account.shodan.io to unlock all 20 tools.

---

Available Tools

Free Tools (No API Key Required)

Tool	Description
shodan-cve-lookup	Look up any CVE -- CVSS v3 scores, EPSS exploit prediction, references, affected CPEs
shodan-search-cves	Search CVEs with filters -- CISA KEV catalog, EPSS sorting, date ranges
shodan-search-cpes	Search CPE identifiers by product name (e.g., "apache", "nginx")
shodan-internetdb-lookup	Fast free IP intelligence -- open ports, vulns, hostnames, CPEs, tags

Reconnaissance Tools (API Key Required)

Tool	Description
shodan-ip-lookup	Full IP reconnaissance -- ports, services, banners, geolocation, vulns, ISP/org, ASN
shodan-search	Search Shodan's database of billions of devices with powerful query syntax
shodan-search-count	Count search results without consuming query credits
shodan-dns-resolve	Resolve hostnames to IP addresses
shodan-dns-reverse	Reverse DNS lookup for IP addresses
shodan-domain-info	Domain reconnaissance -- subdomains, DNS records, tags
shodan-honeypot-score	Detect if an IP is a honeypot (0.0 = real, 1.0 = honeypot)

Utility Tools (API Key Required)

Tool	Description
shodan-api-info	Check API key usage -- plan type, remaining credits
shodan-my-ip	Get your external IP address as seen by Shodan
shodan-account-profile	Account membership, credits, display name
shodan-list-facets	List available search facets for query breakdowns
shodan-list-filters	List available search filters
shodan-parse-query	Analyze and debug search queries
shodan-list-ports	List port numbers Shodan crawlers scan
shodan-list-protocols	List protocols for on-demand scanning
shodan-http-headers	Show HTTP headers your client sends

---

Features

• 20 tools covering IP recon, device search, CVE/CPE intelligence, DNS, domain analysis, and honeypot detection
• 4 free tools that work with zero configuration -- no API key, no signup
• Passive reconnaissance -- all queries hit Shodan's pre-indexed database, no packets touch any target
• Structured Pydantic output -- every tool returns ty

... View full README on GitHub