shodan-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| SHODAN_API_KEY | Yes | Your Shodan API key. Required to authenticate with the Shodan API. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| shodan_my_ipA | Returns the public IP address Shodan sees this API key's requests coming from. Use this as the starting point for scanning your own infrastructure. |
| shodan_host_lookupA | Look up everything Shodan knows about a single IP address: open ports, banners, detected products/versions, and known vulnerabilities. Use this to check what your own infrastructure exposes. |
| shodan_searchA | Search Shodan's database of internet-connected devices using Shodan search syntax (e.g. 'apache country:DE', 'net:203.0.113.0/24', 'vuln:CVE-2021-44228'). Use this for general reconnaissance and world-scale intelligence gathering. |
| shodan_cve_lookupA | Fetch details for a specific CVE from Shodan's CVEDB, including CVSS score, affected CPEs, and how many internet-facing hosts Shodan currently sees running vulnerable versions. |
| shodan_cves_by_productA | List recent/known CVEs affecting a given CPE (product+version), e.g. 'cpe:2.3:a:apache:log4j'. Useful for tracking what's currently going on for a specific technology. |
| shodan_host_countA | Count how many hosts match a Shodan search query without spending query credits. Use this for quick world-scale stats (e.g. how many hosts expose a given CVE) before running a full search. |
| shodan_search_filtersA | List the search filters Shodan supports (e.g. country, port, net, vuln, product). Use this before writing a shodan_search query to confirm the right filter name. |
| shodan_dns_domainA | Look up subdomains and DNS entries Shodan has seen for a domain. Use this to map out your own domain's exposed surface. |
| shodan_dns_resolveB | Resolve one or more hostnames to their IP addresses. |
| shodan_dns_reverseB | Look up the hostnames associated with one or more IP addresses. |
| shodan_account_infoA | Show this API key's plan and remaining query/scan credits. Check this before running credit-consuming operations. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 11 tools
Each tool targets a distinct Shodan resource and action: CVE lookup, CVE-by-product, host count, DNS resolve/reverse/domain, host lookup, search, filters, account info, and my IP. There is no functional overlap; even similar tools like host_count and search are clearly differentiated by purpose.
All tools share the 'shodan_' prefix and mostly follow a descriptive pattern of resource-action or resource-attribute (e.g., cve_lookup, dns_resolve, host_count). Minor exceptions like 'my_ip' and 'cves_by_product' are still predictable and readable.
11 tools is a well-scoped count for a Shodan MCP server. It covers the major Shodan API surfaces (CVE, DNS, host, search, account) without unnecessary bloat or missing essentials.
The set covers the core Shodan workflows: search, host details, DNS reconnaissance, CVE intelligence, and credit management. Some advanced features like alerts or exploit lookups are absent, but the surface is complete enough for typical threat intelligence and infrastructure assessment tasks.