sec-shodan-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| SHODAN_API_KEY | Yes | Your Shodan API key |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
| logging | {} |
| completions | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| shodan_searchA | Search Shodan for devices matching a query. Uses filters like 'port:', 'country:', 'org:', 'product:', 'os:', 'vuln:'. Returns formatted host summaries. |
| shodan_hostA | Get all information about a specific IP including open ports, services, banners, vulnerabilities, and SSL certificates. |
| shodan_countA | Count search results without consuming query credits. Useful for scoping searches. |
| shodan_dns_resolveA | Resolve hostnames to IP addresses (forward DNS lookup). |
| shodan_dns_reverseA | Look up hostnames for IP addresses (reverse DNS lookup). |
| shodan_dns_domainA | Get DNS information for a domain including subdomains. Consumes 1 query credit. |
| shodan_scanA | Request Shodan to scan specific IPs or CIDR ranges. Each IP consumes 1 scan credit. |
| shodan_scan_statusB | Check the status of a previously submitted scan. |
| shodan_list_scansB | List all active on-demand scans. |
| shodan_alert_createA | Create a network alert to monitor IP ranges for changes. |
| shodan_alert_listA | List all active network alerts. |
| shodan_alert_getB | Get details for a specific alert. |
| shodan_alert_deleteC | Delete a network alert. |
| shodan_alert_triggersA | List available alert trigger types. |
| shodan_exploits_searchA | Search the Shodan Exploits database. Covers Exploit-DB, CVE, Metasploit, and more. |
| shodan_exploits_countA | Count exploits matching a query without returning individual results. |
| shodan_cve_lookupA | Look up a specific CVE by ID. Returns CVSS, EPSS, references, and affected products. |
| shodan_cve_searchA | Search CVEs by CPE, product name, KEV status, or EPSS score. Cannot specify both cpe23 and product. |
| shodan_cpe_lookupA | Look up CPE 2.3 identifiers matching a product name. |
| shodan_cves_newestA | Get the most recently published CVEs. |
| shodan_cves_kevB | Get CISA Known Exploited Vulnerabilities (KEV) catalog entries. |
| shodan_cves_by_epssA | Get CVEs ranked by EPSS (Exploit Prediction Scoring System) score. |
| shodan_portsA | List all ports that Shodan crawls on the Internet. |
| shodan_protocolsA | List all protocols available for on-demand scanning. |
| shodan_filtersA | List all search filters available in Shodan. |
| shodan_facetsA | List all facets available for search result breakdowns. |
| shodan_api_infoA | Get API plan info including query credits, scan credits, and limits. |
| shodan_account_profileA | Get account information associated with the API key. |
| shodan_myipA | Get your current public IP address as seen by Shodan. |
| shodan_honeyscoreA | Calculate the probability that an IP is a honeypot. Returns 0.0 (not a honeypot) to 1.0 (honeypot). |
| shodan_saved_queriesB | Browse the directory of saved search queries. |
| shodan_search_queriesB | Search the directory of saved queries. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 32 tools
Most tools target distinct resources (DNS, search, host, scan, alerts, exploits, CVE, account) and descriptions clarify boundaries. However, pairs like shodan_cve_search vs. shodan_exploits_search and shodan_saved_queries vs. shodan_search_queries could cause minor misselection.
Naming follows a loose shodan_<resource>_<action> pattern, but there are deviations: shodan_list_scans uses verb-first (list_scans) while shodan_alert_list uses resource-first (alert_list), and several tools are bare nouns (ports, filters, host). Terms like myip and cves_kev also break the convention.
With 32 tools, the server feels bloated. Many are low-level utilities (shodan_myip, shodan_honeyscore, shodan_ports, shodan_protocols) that could be consolidated. The number exceeds the 25-tool threshold for 'too many' and makes the toolset harder for agents to navigate.
The toolset covers Shodan's core API well: search, host details, DNS, on-demand scans, alerts, exploits, CVEs, and account info. Minor gaps exist (e.g., no update alert, no cancel scan), but most workflows can be completed without dead ends.