mcp-shodan
mcp-shodan is an MCP server, listed under security. It reaches shodan. It needs SHODAN_API_KEY to authenticate. Its repository has 178 GitHub stars and is licensed under MIT; we last read it on 2026-10-25.
mcp-shodan is a server that connects to Shodan to search for internet-connected devices, perform IP reconnaissance, DNS lookups, and provide CVE/CPE vulnerability intelligence. It requires no specific credentials and integrates with Claude Code, Codex, Gemini CLI, and Claude Desktop.
Install
Read from mcp-shodan’s own README, close to verbatim -- not written by us, and not guessed.
npx -y @burtthecoder/mcp-shodan
What it reaches, and what it needs
What it connects to
Unverified means a mention in the server’s own description, not a citation. A wrong claim here costs nothing to correct and nothing to trust yet.
Maintenance
MCP server for Shodan — search internet-connected devices, IP reconnaissance, DNS lookups, and CVE/CPE vulnerability intelligence. Works with Claude Code, Codex, Gemini CLI, and Claude Desktop.
What mcp-shodan can do
11 tools documented in its README. An AI client calls these by name.
ip_lookup- Ports, products, CVEs, TLS, location and cloud for one IP, optionally with banner history
shodan_search- Search devices with Shodan query syntax, with paging and facet breakdowns
shodan_count- Total matches and facet breakdowns for a query, without results (free)
domain_info- Subdomains and DNS records for a domain
dns_lookup- Resolve hostnames to IPs, in batch
reverse_dns_lookup- Hostnames for IPs, in batch
cve_lookup- CVSS, EPSS, KEV, references and affected CPEs for one CVE
cpe_lookup- CPE 2.3 identifiers for a product name
cves_by_product- CVEs for a product or CPE, filterable by KEV and date, sortable by EPSS
search_filters- Valid search filter and facet names
api_info- Your plan and remaining query and scan credits
Read from the README; names are kept only if the README contains them.
mcp-shodan compared with similar servers
| Server | Reaches | Needs | Stars | Last update | Licence |
|---|---|---|---|---|---|
| mcp-shodan (this page) | shodan | SHODAN_API_KEY | 178 | 2026-10-19 | MIT |
| ida-pro-mcp | — | None listed | 13,080 | 2026-09-26 | MIT |
| mcp-server-idapro | — | None listed | 103 | 2025-03-26 | MIT |
| search-solodit-mcp | — | None listed | 42 | 2025-06-30 | — |
| opencti-mcp | opencti | OPENCTI_TOKEN | 40 | 2026-08-03 | MIT |
| MalwareBazaar_MCP | malwarebazaar | MALWAREBAZAAR_API_KEY | 30 | 2025-11-26 | Apache-2.0 |
Ranked by services in common with mcp-shodan, then by stars. Figures are from each repository when we last read it.
Common questions about mcp-shodan
- What does mcp-shodan do?
- mcp-shodan is a server that connects to Shodan to search for internet-connected devices, perform IP reconnaissance, DNS lookups, and provide CVE/CPE vulnerability intelligence. It requires no specific credentials and integrates with Claude Code, Codex, Gemini CLI, and Claude Desktop.
- How do I install mcp-shodan?
- Its own README gives this command: npx -y @burtthecoder/mcp-shodan. Run it where your MCP client can launch the server, and check the README for any settings it asks for.
- What does mcp-shodan connect to, and what does it need?
- It reaches shodan. The credentials we found in its source are SHODAN_API_KEY.
- Which AI clients can use mcp-shodan?
- Its own description mentions Claude Desktop, Claude Code and Gemini CLI. That is a mention in its description, not a test we ran.
- Is mcp-shodan official and is it maintained?
- We found nothing naming it as a vendor’s official server. Its repository has 178 GitHub stars and its state in our directory is listed. Its last commit we recorded was on 2026-10-19.
- What licence does mcp-shodan use?
- The repository declares the MIT licence.
More MCP servers for security
- ida-pro-mcp13,080 stars
- mcp-server-idapro103 stars
- search-solodit-mcp42 stars
- opencti-mcp40 stars
- MalwareBazaar_MCP30 stars
- kali-mcp26 stars