Shodan MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| SHODAN_API_KEY | No | Shodan API key used for REST/DNS/scans/alerts/exploits. Optional because InternetDB and CVEDB tools work without a key. | |
| SHODAN_BASE_URL | No | REST origin for the Shodan API. | https://api.shodan.io |
| SHODAN_TIMEOUT_MS | No | Per-request timeout in milliseconds. | 30000 |
| SHODAN_MAX_RESPONSE_BYTES | No | Maximum response size; oversized JSON is truncated. | 524288 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| prompts | {
"listChanged": true
} |
| resources | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| shodan_hostA | Look up an IPv4/IPv6 address in Shodan. Default response is a compact analyst summary (org, ports, products, vulns). Set summary=false for the raw banner record. Host lookups do not spend query credits. |
| shodan_searchA | Search Shodan's banner database with website query syntax (e.g. 'apache country:DE'). Uses 1 query credit when the query contains filters or page > 1. Prefer shodan_count to size a query first. Default response is compact match rows. |
| shodan_countA | Return how many banners match a query, plus optional facets. Does not spend query credits and does not return hosts. Use this before shodan_search. |
| shodan_search_tokensA | Break a Shodan query into filters, attributes, and leftover free-text. Useful to verify query syntax before spending credits. |
| shodan_search_facetsA | List facet names that can summarize search results. |
| shodan_search_filtersB | List filter names accepted in Shodan search queries. |
| shodan_internetdbA | Free, keyless IP enrichment from internetdb.shodan.io: ports, CPEs, hostnames, tags, and CVE ids. Weekly data, no banners. Accepts a single IP or a comma-separated list (max 25). |
| shodan_dns_domainB | Return subdomains and DNS records Shodan knows for a domain. |
| shodan_dns_resolveB | Resolve hostnames to IPs. Comma-separated list. |
| shodan_dns_reverseB | Resolve IPs to hostnames. Comma-separated list. |
| shodan_my_ipA | Return the public IP address Shodan sees for this client. |
| shodan_portsB | List ports Shodan crawlers currently scan. |
| shodan_protocolsA | List protocols available for on-demand Internet scans. |
| shodan_servicesB | Map of port to named service for Shodan crawlers. |
| shodan_honeyscoreB | Labs honeypot probability for an IP, from 0.0 (not a honeypot) to 1.0. |
| shodan_api_infoA | Show the authenticated plan, query credits remaining, and scan credits remaining. |
| shodan_profileA | Return the Shodan account profile for the configured API key. |
| shodan_orgB | Return organization membership for the API key, if any. |
| shodan_scanA | Ask Shodan to crawl IPs or CIDRs. Requires confirm=true. CIDRs wider than /24 also need confirm_large=true. Each IP spends 1 scan credit. Paid plan required. |
| shodan_scan_statusB | Get progress for an on-demand scan id. |
| shodan_scansA | List on-demand scans submitted by this account. |
| shodan_scan_internetB | Enterprise-only: crawl the Internet for one port/protocol. Requires confirm=true and confirm_internet=true. |
| shodan_alert_createB | Monitor an IP or netblock for new services and vulnerabilities. Body matches the Shodan alert API: { name, filters: { ip: [...] }, expires? }. |
| shodan_alert_listA | List network alerts on the account. |
| shodan_alert_getB | Get one network alert by id. |
| shodan_alert_updateC | Replace the name/filters on an existing alert. |
| shodan_alert_deleteB | Delete a network alert by id. |
| shodan_alert_triggersA | List trigger types that can be enabled on a network alert. |
| shodan_alert_enable_triggerC | Enable one or more comma-separated triggers on an alert. |
| shodan_alert_disable_triggerC | Disable a trigger on an alert. |
| shodan_alert_add_notifierC | Attach a notifier id to an alert (use 'default' for email). |
| shodan_alert_remove_notifierC | Remove a notifier from an alert. |
| shodan_notifiersA | List notifiers configured on the account. |
| shodan_notifier_providersA | List notifier providers and the arguments they require. |
| shodan_notifier_getC | Get one notifier by id. |
| shodan_notifier_createB | Create a notifier. Provider-specific fields go in args (e.g. to=email@domain for email). |
| shodan_notifier_deleteC | Delete a notifier by id. |
| shodan_query_listC | List shared community search queries. |
| shodan_query_searchC | Search the community query directory. |
| shodan_query_tagsB | List popular tags on the community query directory. |
| shodan_datasetsB | List bulk data filesets available to the account. |
| shodan_dataset_filesB | List files inside a named bulk dataset. |
| shodan_cveA | Look up a CVE in Shodan CVEDB (free, no API key): CVSS, EPSS, KEV, CPEs, references. |
| shodan_cvesA | Search CVEDB by product or CPE 2.3. Optional KEV filter and EPSS sort. Free, no API key. Do not pass product and cpe23 together. |
| shodan_cpesB | Look up CPE 2.3 identifiers for a product name via CVEDB. Free, no API key. |
| shodan_exploitsB | Search the Shodan Exploits archive (requires API key). Query filters include cve, type, platform, port, author. |
| shodan_exploit_countB | Count matching exploits without returning the full result set. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| recon_host | Passive recon workflow for one IP: InternetDB, full host lookup, then CVEDB for any CVE ids. |
| search_exposure | Size a Shodan query with count/facets, then fetch one page of matches. |
| domain_osint | Map a domain through Shodan DNS, then enrich resolved IPs. |
| vuln_triage | Triage a CVE with CVEDB, exploit search, and optional Shodan exposure search. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| account-profile | Shodan account profile for the configured API key. |
| api-info | Plan, query credits, and scan credits remaining. |
| search-filters | Valid Shodan search filter names. |
| search-facets | Valid Shodan search facet names. |
| crawled-ports | Ports currently crawled by Shodan. |
| scan-protocols | Protocols available for on-demand Internet scans. |
| alert-triggers | Trigger types that can be enabled on network alerts. |
TDQS
Scored across 47 tools
Most tools target distinct Shodan resources and actions, with clear separation between search, count, host lookup, DNS, scans, alerts, notifiers, datasets, CVEDB, and exploits. A few boundaries are softer—shodan_host vs. shodan_internetdb both enrich IPs, and cve/cves/cpes and exploits/exploit_count are closely related—but the descriptions generally clarify intended use.
All tools use a consistent shodan_ prefix with snake_case names and mostly predictable noun or noun_action ordering (e.g., shodan_alert_create, shodan_notifier_delete, shodan_dns_resolve). Plural forms for list endpoints are used consistently enough that the pattern remains easy to follow.
47 tools is very large for an MCP server and creates a heavy selection burden for an agent, even though Shodan's API is broad. The surface spans many subdomains, but the count is well beyond the range where tools are easy to scan and choose among.
Coverage is strong across search, host intelligence, DNS, scanning, alerts with triggers and notifiers, community queries, datasets, CVEDB, and exploits. Minor gaps may exist around streaming or other specialized Shodan APIs, but the major workflows are well covered.