mcp-shodan
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| SHODAN_API_KEY | Yes | A valid Shodan API key from your account settings |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
| logging | {} |
| completions | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| ip_lookupA | Retrieve comprehensive information about an IP address, including geolocation, open ports, running services, SSL certificates, hostnames, and cloud provider details if available. Returns service banners and HTTP server information when present. |
| shodan_searchB | Search Shodan's database of internet-connected devices. Returns detailed information about matching devices including services, vulnerabilities, and geographic distribution. Supports advanced search filters and returns country-based statistics. |
| cve_lookupA | Query detailed vulnerability information from Shodan's CVEDB. Returns comprehensive CVE details including CVSS scores (v2/v3), EPSS probability and ranking, KEV status, proposed mitigations, ransomware associations, and affected products (CPEs). |
| dns_lookupA | Resolve domain names to IP addresses using Shodan's DNS service. Supports batch resolution of multiple hostnames in a single query. Returns IP addresses mapped to their corresponding hostnames. |
| reverse_dns_lookupA | Perform reverse DNS lookups to find hostnames associated with IP addresses. Supports batch lookups of multiple IP addresses in a single query. Returns all known hostnames for each IP address, with clear indication when no hostnames are found. |
| cpe_lookupA | Search for Common Platform Enumeration (CPE) entries by product name in Shodan's CVEDB. Supports pagination and can return either full CPE details or just the total count. Useful for identifying specific versions and configurations of software and hardware. |
| cves_by_productA | Search for vulnerabilities affecting specific products or CPEs. Supports filtering by KEV status, sorting by EPSS score, date ranges, and pagination. Can search by product name or CPE 2.3 identifier. Returns detailed vulnerability information including severity scores and impact assessments. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Most tools are clearly distinct: ip_lookup, shodan_search, dns_lookup, and reverse_dns_lookup each target a different resource. However, cve_lookup and cves_by_product both return vulnerability information, which could cause some confusion despite their different query approaches.
Tool names mostly follow a consistent noun-based pattern (ip_lookup, dns_lookup, cve_lookup, cpe_lookup) with descriptive compound names for searches. The mix of 'lookup' and 'search' verbs is a minor inconsistency, but the pattern is still predictable and readable.
Seven tools is well-scoped for a Shodan-focused server, covering IP intelligence, device search, DNS, and vulnerability data without unnecessary bloat. Each tool serves a distinct purpose within the security research domain.
The tool set covers core Shodan functionality: IP lookup, device search, DNS resolution, and CVE/CPE vulnerability research. Minor gaps exist such as account/API info or network/port-specific queries, but the primary workflows for security research are well covered.