vulnerability-exposure-mcp

Overview Schema Source Related Servers Discussions Admin

Shodan host lookup

shodan_search

Read-onlyIdempotent

Look up a public IP or domain to identify open ports, services, product versions, hosting organization/ASN, and exposed CVEs for vulnerability triage.

Instructions

Shodan host lookup: open ports, services, product versions, hosting org/ASN. Accepts a public IP or a domain (its primary IP is used). Quota-limited: call once per distinct IP. Without SHODAN_API_KEY it falls back to Shodan's free InternetDB: open ports, software, OS and CVEs, but no banners or organisation.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "target": "<target>"
    },
    "name": "shodan_search"
  }
}

Input Schema

Name	Required	Description	Default
`target`	Yes	A public IP, or a domain whose primary IP is looked up.
`investigation_id`	No	The investigation_id from investigate_target. Pass it so the result counts toward that investigation's evidence, budget and key facts; without it the lookup runs on its own.

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedv1.0.1Oct 29, 2026

addedInput schema / properties / investigation_id / description

Added value: +"The investigation_id from investigate_target. Pass it so the result counts toward that investigation's evidence, budget and key facts; without it the lookup runs on its own."

addedInput schema / properties / target / description

Added value: +"A public IP, or a domain whose primary IP is looked up."

First observedv0.1.0Oct 25, 2026

TDQS

A3.8/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only, idempotent, non-destructive and open-world, so safety is covered. The description adds two genuinely useful behavioral facts the annotations cannot: the per-IP quota limit and the degraded free-tier fallback (InternetDB gives ports/software/OS/CVEs but no banners or organisation). It stops short of saying what happens when the quota is exhausted or the lookup fails.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight clauses, front-loaded with capability, then input forms, then cost/fallback. Every sentence carries information an agent needs before calling.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, but the description enumerates the returned fields and the degraded-mode output, which is the right compensation. Only error/quota-exhaustion behavior and any result-size limits are left unstated for an open-world network call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema description coverage, the baseline is 3. The description restates the same target semantics ("public IP or domain, its primary IP is used") already present in the schema and adds nothing about investigation_id, so it does not exceed the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific resource (Shodan host lookup) and enumerates what it returns: open ports, services, product versions, hosting org/ASN. That field list distinguishes it functionally from siblings like ip_owner or abuseipdb_check, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the input acceptance (public IP or domain whose primary IP is used) and a hard usage constraint ("call once per distinct IP"), which implies when the tool applies. But it gives no guidance on when to prefer virustotal_check, abuseipdb_check, or ip_owner instead, nor any exclusion conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.