shodan_exploits
Search Shodan's exploit database for public exploits matching a query, such as a CVE ID or keyword. Filter results by exploit type.
Instructions
Search Shodan's exploit database for public exploits matching a query. Requires SHODAN_API_KEY.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Exploit search query (e.g. 'apache 2.4' or CVE ID) | |
| type | No | Filter by exploit type (e.g. 'exploit', 'metasploit') |
Implementation Reference
- src/shodan/index.ts:136-156 (handler)Core handler function: calls Shodan exploit search API (https://exploits.shodan.io/api/search) with query, apiKey, and optional type filter. Returns total count and matching exploits (title, source, type, author, date, CVE).
export async function shodanExploits(query: string, apiKey: string, type?: string): Promise<ShodanExploitResult> { await limiter.acquire(); const params = new URLSearchParams({ query, key: apiKey }); if (type) params.set("type", type); const res = await fetch(`https://exploits.shodan.io/api/search?${params}`); if (!res.ok) throw new Error(`Shodan exploit search failed: ${res.status}`); const data = await res.json(); return { total: data.total ?? 0, matches: (data.matches ?? []).map((m: any) => ({ title: m.description ?? m.title ?? "", source: m.source ?? "", type: m.type, author: m.author, date: m.date, cve: m.cve, })), }; } - src/shodan/index.ts:51-54 (schema)Type definition for the Shodan exploit search result: total count and matches array with title, source, type, author, date, and CVE fields.
interface ShodanExploitResult { total: number; matches: { title: string; source: string; type?: string; author?: string; date?: string; cve?: string[] }[]; } - src/protocol/tools.ts:168-171 (schema)Zod schema for shodan_exploits tool: requires 'query' (string) and optional 'type' (string) filter.
schema: { query: z.string().describe("Exploit search query (e.g. 'apache 2.4' or CVE ID)"), type: z.string().optional().describe("Filter by exploit type (e.g. 'exploit', 'metasploit')"), }, - src/protocol/tools.ts:165-176 (registration)ToolDef registration for shodan_exploits: defines name, description, schema, and execute handler that calls shodanExploits().
const shodanExploitsTool: ToolDef = { name: "shodan_exploits", description: "Search Shodan's exploit database for public exploits matching a query. Requires SHODAN_API_KEY.", schema: { query: z.string().describe("Exploit search query (e.g. 'apache 2.4' or CVE ID)"), type: z.string().optional().describe("Filter by exploit type (e.g. 'exploit', 'metasploit')"), }, execute: async (args, ctx) => { const key = requireApiKey(ctx.config.shodanApiKey, "Shodan", "SHODAN_API_KEY"); return json(await shodanExploits(args.query as string, key, args.type as string | undefined)); }, }; - src/protocol/tools.ts:498-498 (registration)shodanExploitsTool is included in the exported tools array at line 498.
shodanExploitsTool,