io.github.w0h1v由 GitHub 帳號 w0h1v 發布v1.0.37更新於 Nov 5, 2026
MCP server for Shodan API — device search, IP and domain recon, DNS, and CVE/CPE queries.
Shodan MCP 伺服器，讓助理查詢主機資訊、搜尋連網裝置、解析 DNS，並檢索 CVE/CPE 漏洞資料。
Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。
參照 儲存庫 中的啟動說明。
[npm version] [CI] [License: MIT] [Node 20 or newer] [MCP Registry]
Quickstart · Tools · HTTP · Security · Troubleshooting · Docs
mcp-shodan is an MCP server that gives AI agents access to the Shodan API and Shodan CVEDB. Hand your agent an IP, hostname, search query, product or CVE and get back what an analyst would look at: open ports and banners, TLS certificates, DNS, and vulnerability severity with EPSS and KEV status.
[!NOTE] Independent project, not affiliated with Shodan. You need your own Shodan API key.
api_info shows the credits left on your plan.Requirements: Node.js 20 or newer and a Shodan API key.
For Claude Desktop, VS Code and running from source, see Connect a client.
Then ask your agent: "What is exposed on 8.8.8.8, and is CVE-2021-44228 in the KEV catalog?" More prompts are in example workflows.
Eleven read-only tools. Full parameters are in the tool reference.
[!TIP] Credits: filtered
shodan_searchqueries cost one query credit (plus one per extra page) anddomain_infocosts one per call.shodan_count,ip_lookup,dns_lookup,reverse_dns_lookup,search_filters,api_infoand the CVEDB tools are free.
stdio is the default. Set MCP_TRANSPORT=httpStream to run a standalone HTTP service:
A health check is served at /health.
[!WARNING] The HTTP transport has no authentication. Keep the port on localhost or behind an authenticating reverse proxy, or anyone who can reach it can spend your query credits.
name[:count] lists, and CVE IDs must match CVE-YYYY-NNNN.api.shodan.io. CVEDB calls carry no key.Report vulnerabilities privately; see SECURITY.md.
curl "https://api.shodan.io/api-info?key=$SHODAN_API_KEY" shows your plan and credits.shodan_search: search filters need a membership or paid API plan. Run api_info to see your plan and credits.More in the troubleshooting guide.
See CONTRIBUTING.md and the changelog.
MIT. See LICENSE.
來源：README.md，提交 422483a
Retrieve comprehensive information about an IP address, including geolocation, operating system, open ports, running services (product, version, CPE), known vulnerabilities (CVEs), SSL certificates, hostnames, and cloud provider details if available. Returns service banners and HTTP server information when present. Optional history returns historical banners; minify omits banners.
ip必填minifyhistorySearch Shodan's database of internet-connected devices. Returns detailed information about matching devices including services, vulnerabilities, and geographic distribution. Supports advanced search filters and returns facet statistics (default: by country). Costs 1 query credit when the query uses filters, plus 1 per page beyond the first. Use shodan_count (free) to get totals and facets without results.
pagequery必填facetsmax_resultsQuery detailed vulnerability information from Shodan's CVEDB. Returns comprehensive CVE details including CVSS scores (v4/v3/v2), EPSS probability and ranking, KEV status, proposed mitigations, ransomware associations, and affected products (CPEs).
cve必填Resolve domain names to IP addresses using Shodan's DNS service. Supports batch resolution of multiple hostnames in a single query. Returns IP addresses mapped to their corresponding hostnames.
hostnames必填Perform reverse DNS lookups to find hostnames associated with IP addresses. Supports batch lookups of multiple IP addresses in a single query. Returns all known hostnames for each IP address, with clear indication when no hostnames are found.
ips必填Search for Common Platform Enumeration (CPE) entries by product name in Shodan's CVEDB. Supports pagination and can return either full CPE details or just the total count. Useful for identifying specific versions and configurations of software and hardware.
skipcountlimitproduct必填Search for vulnerabilities affecting specific products or CPEs. Supports filtering by KEV status, sorting by EPSS score, date ranges, and pagination. Can search by product name or CPE 2.3 identifier. Returns detailed vulnerability information including severity scores and impact assessments.
skipcountcpe23limitis_kevproductend_datestart_datesort_by_epssGet the total number of Shodan results for a query, with optional facet breakdowns (e.g. by country, org, port). Free: does not consume query credits. Use search_filters to list valid filters and facets.
query必填facetsGet subdomains and DNS records for a domain from Shodan. Costs 1 query credit per lookup.
pagetypedomain必填historyShow the Shodan API plan, remaining query and scan credits, monitored IPs, and usage limits for the configured API key. Free: does not consume credits.
無需輸入參數。
List the search filters and facets Shodan supports. Use this to build valid shodan_search and shodan_count queries and facets. Free: does not consume credits.
無需輸入參數。
已滿足適用檢查項的 90%
該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。
請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。
flowchart LR A["AI agent<br/>(Claude, Codex, Gemini, VS Code)"] -->|"MCP over stdio or HTTP"| S["mcp-shodan"] S -->|"validate input,<br/>HTTPS + API key"| SH["Shodan REST API"] S -->|"HTTPS, no key"| C["Shodan CVEDB"] SH -->|"JSON"| S C -->|"JSON"| S S -->|"structured JSON text"| A# Claude Codeclaude mcp add --transport stdio --env SHODAN_API_KEY=your-key shodan -- npx -y @burtthecoder/mcp-shodan
# Codex CLIcodex mcp add shodan --env SHODAN_API_KEY=your-key -- npx -y @burtthecoder/mcp-shodan
# Gemini CLIgemini mcp add -e SHODAN_API_KEY=your-key shodan npx -y @burtthecoder/mcp-shodanMCP_TRANSPORT=httpStream MCP_PORT=3000 SHODAN_API_KEY=your-key node build/index.jsdocker build -t mcp-shodan .docker run -p 127.0.0.1:3000:3000 -e SHODAN_API_KEY=your-key -e MCP_TRANSPORT=httpStream mcp-shodangit clone https://github.com/w0h1v/mcp-shodan && cd mcp-shodannpm cinpm test # build + unit tests, no key or networknpx fastmcp dev build/index.js # try tools interactively (needs SHODAN_API_KEY)