shodan-mcp
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@shodan-mcpsearch for cameras in the United States"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
shodan-mcp
Serwer MCP udostepniajacy API Shodan.IO, oparty o FastMCP i oficjalna biblioteke shodan-python.
Wymagania
Python 3.13+
Klucz API Shodan
Related MCP server: Shodan MCP Server
Instalacja
uv syncKonfiguracja klucza API
Klucz pobierany jest wylacznie ze zmiennej srodowiskowej SHODAN_API_KEY.
Nie zapisuj klucza w repozytorium. Do lokalnych testow skopiuj .env.example do .env.
Uruchomienie
Transport: stdio (domyslny dla lokalnego Claude Code / Claude Desktop).
SHODAN_API_KEY=... uv run server.pyKonfiguracja klienta MCP
Przyklad wpisu (.mcp.json lub claude mcp add):
{
"mcpServers": {
"shodan": {
"command": "uv",
"args": ["run", "--directory", "/home/ra/secra/shodan-mcp", "server.py"]
}
}
}Tool: search
Generalne wyszukiwanie przez API Shodan. Laczy wolny tekst (query) z opcjonalnymi
filtrami-dorkami, ktore tool sklada w finalne zapytanie Shodan.
Obslugiwane filtry: org, hostname, net, ip, port, country, city,
product, version, os, asn, isp, title (http.title), http_status
(http.status), ssl, vuln, tag, after, before, has_screenshot.
Dodatkowe parametry: page (strona wynikow), facets (agregacje, np. port:10,org:5),
raw (gdy true, zwraca pelny surowy JSON zamiast przycietego zestawu pol).
Przyklad: query="nginx", country="PL", port=443 -> zapytanie nginx country:PL port:443.
Tool: host
Lookup po adresie IP. Zwraca szczegoly hosta (org, isp, asn, lokalizacja, porty, tagi, podatnosci) oraz liste wykrytych uslug.
Parametry: ip (wymagany), history (pelna historia banerow), minify (okrojony
zestaw pol), raw (pelny surowy JSON zamiast przycietego).
Roadmap
Kolejne toole: count (sam licznik), search_cursor (paginacja kursorowa),
scan / alerts.
Available Tools
2 toolshostA
Zwraca szczegolowe informacje o adresie IP z bazy Shodan.
Parametry: ip: adres IP do sprawdzenia. history: gdy True zwraca pelna historie banerow (a nie tylko ostatnie). minify: gdy True prosi Shodan o okrojony zestaw danych (szybciej, mniej pol). raw: gdy True zwraca pelny surowy JSON z Shodan zamiast przycietego.
Zwraca slownik z danymi hosta (org, isp, asn, lokalizacja, porty, tagi, podatnosci) oraz lista wykrytych uslug (services).
| Name | Required | Description | Default |
|---|---|---|---|
| ip | Yes | ||
| raw | No | ||
| minify | No | ||
| history | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description fully bears the burden of behavioral disclosure. It explains the effect of each parameter (history, minify, raw) and describes the return format (dict with fields like org, isp, asn, etc.). It does not mention rate limits or error conditions, but overall provides good transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is reasonably concise, consisting of two paragraphs: a clear purpose statement followed by a parameter list. It is front-loaded with the main purpose, but could be slightly tighter by removing redundant phrasing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that an output schema exists (context signal), the description does not need to fully detail return values, but it still lists key fields. Parameters are explained completely. Missing error handling or example calls, but overall complete for a simple lookup tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description is the sole source of parameter meaning. It explains all four parameters: ip (address to check), history (full history), minify (truncated data), and raw (full JSON). This adds significant value beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it returns detailed information about an IP address from the Shodan database ('Zwraca szczegółowe informacje o adresie IP z bazy Shodan'). This distinguishes it from the sibling 'search' tool, which likely returns a list of IPs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for looking up a specific IP, but does not explicitly state when to use this tool versus the sibling 'search' tool or provide exclusions. Context is clear but lacks explicit guidance on alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
searchA
Wyszukiwanie w Shodan. Laczy wolny 'query' z opcjonalnymi filtrami-dorkami.
Parametry: query: wolny tekst zapytania (np. "nginx"). Moze byc pusty, jesli podano filtry. org: filtr org: (organizacja / wlasciciel). hostname: filtr hostname:. net: filtr net: (zakres CIDR, np. 1.2.3.0/24). ip: filtr ip:. port: filtr port:. country: filtr country: (kod ISO, np. PL). city: filtr city:. product: filtr product: (np. nginx). version: filtr version:. os: filtr os:. asn: filtr asn: (np. AS12345). isp: filtr isp:. title: filtr http.title:. http_status: filtr http.status:. ssl: filtr ssl:. vuln: filtr vuln: (wymaga odpowiedniego planu Shodan). tag: filtr tag:. after: filtr after: (data dd/mm/yyyy). before: filtr before: (data dd/mm/yyyy). has_screenshot: filtr has_screenshot:. page: numer strony wynikow (100 wynikow na strone). facets: agregacje, np. "port:10,org:5". raw: gdy True zwraca pelny surowy JSON z Shodan zamiast przycietego.
Zwraca slownik z liczba wynikow (total), lista dopasowan (matches) oraz facets.
| Name | Required | Description | Default |
|---|---|---|---|
| ip | No | ||
| os | No | ||
| asn | No | ||
| isp | No | ||
| net | No | ||
| org | No | ||
| raw | No | ||
| ssl | No | ||
| tag | No | ||
| city | No | ||
| page | No | ||
| port | No | ||
| vuln | No | ||
| after | No | ||
| query | No | ||
| title | No | ||
| before | No | ||
| facets | No | ||
| country | No | ||
| product | No | ||
| version | No | ||
| hostname | No | ||
| http_status | No | ||
| has_screenshot | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that the 'raw' parameter returns full raw JSON instead of a pruned response, and specifies the return structure (total, matches, facets). No annotations exist, but the description adequately covers key behavioral aspects for a search tool (likely read-only).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear opening and a parameter list. It is lengthy due to the number of parameters, but each sentence serves a purpose. Could be slightly more concise by grouping similar parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the high parameter count (24) and lack of annotations, the description covers all parameters and includes return format details. It lacks examples or edge cases but is sufficient for basic usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning to each parameter by explaining its filter role and expected format (e.g., 'country: kod ISO'). With 0% schema coverage, this is essential. While terse, it covers all 24 parameters and clarifies usage beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool searches Shodan and combines a free query with optional dork filters. It indicates the tool's purpose as a search interface. However, it does not explicitly differentiate from the sibling tool 'host', which likely serves a different purpose (e.g., host details).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use the 'query' parameter (can be empty if filters provided) and lists all optional filters. It implies usage for searching Shodan but does not provide explicit guidance on when to prefer this tool over 'host' or what scenarios to avoid.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
2 tool updates
v0.1.0- First observed
host - First observed
search
TDQS
The 'host' and 'search' tools have clearly distinct purposes: one retrieves details for a specific IP, the other performs general queries with filters. No overlap.
Both tool names are single lowercase verbs ('host', 'search') following a consistent simple pattern. No mixing of styles.
With only 2 tools, the set feels thin for a comprehensive Shodan interface. While it covers basic operations, more tools (e.g., count, DNS) would improve scope.
The tools cover core Shodan functionality (IP lookup and search), but missing common operations like count or streaming. A minor gap for a minimal server.
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Shodan MCP — wraps the full Shodan REST API (api.shodan.io)
Defensive Shodan search and host intelligence MCP using customer-provided SHODAN_API_KEY for
Shodan InternetDB MCP — wraps Shodan InternetDB (internetdb.shodan.io)
Interact with the Stitch API using natural language commands.
Related MCP Servers
- AlicenseBqualityDmaintenanceProvides access to Shodan API functionality, enabling AI assistants to query information about internet-connected devices for cybersecurity research and threat intelligence.2347MIT
- AlicenseAqualityDmaintenanceEnables comprehensive security reconnaissance, vulnerability assessment, and threat intelligence gathering by integrating Shodan's API. It provides tools for searching internet-connected devices, performing DNS operations, and querying the Shodan exploit database.11Apache 2.0
- AlicenseBqualityFmaintenanceProvides access to Shodan's IoT search engine API for device search, host intelligence, exploit database, network scanning, and security analysis through natural language.32MIT
- AlicenseNot gradedqualityAmaintenanceEnables to search and analyze internet-connected devices using the Shodan API, with tools for host search, DNS, scanning, exploits, alerts, and more.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/radeksh/shodan-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server