mcp-shodan

[](https://www.npmjs.com/package/@tocharianou/mcp-shodan) [](LICENSE) [](https://nodejs.org)

A Model Context Protocol (MCP) server that provides network intelligence and vulnerability research tools powered by the Shodan API and Shodan CVEDB. Query IP addresses, search internet-connected devices, resolve DNS, and look up CVEs directly from your AI assistant.

Add the following to your claude_desktop_config.json:

{
  "mcpServers": {
    "shodan": {
      "command": "npx",
      "args": ["-y", "@tocharianou/mcp-shodan"],
      "env": {
        "SHODAN_API_KEY": "<your-api-key>"
      }
    }
  }
}

Get your API key at account.shodan.io.

MCP_TRANSPORT=http MCP_HTTP_PORT=3001 SHODAN_API_KEY=<key> npx @tocharianou/mcp-shodan

Then point your MCP client at http://localhost:3001/mcp.

• IP reconnaissance — open ports, running services, banners, SSL certificates, cloud provider detection
• Device search — query Shodan's internet-wide scan database with advanced filters and geographic distribution
• DNS operations — forward and reverse DNS lookups for domains and IP addresses
• Vulnerability intelligence — CVE details (CVSS v2/v3, EPSS, KEV status), CPE lookups, and product-specific CVE tracking via CVEDB

| Environment variable | Required | Description | |---|---|---| | SHODAN_API_KEY | ✓\* | Shodan API key, appended as ?key= query parameter (direct mode) | | SHODAN_BASE_URL | – | Override API base URL (e.g. proxy endpoint). Default: https://api.shodan.io | | SHODAN_AUTH_TOKEN | ✓\*