# shodan

Gives your agent Shodan: open ports and banners, TLS certificates, DNS records, and vulnerability severity with EPSS and KEV in one call.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 178
- Author: w0h1v
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/w0h1v/mcp-shodan
- Updated: 2026-10-19
- HTML: https://affpapa.org/en/nevibecode/mcp/w0h1v-shodan

## What it does

This server wraps the Shodan API and Shodan CVEDB and exposes eleven read-only tools to an agent. `ip_lookup` takes an IPv4 or IPv6 address and returns listening ports, products with versions, TLS fingerprints such as JARM and JA3S, plus the cloud it runs in. `shodan_search` runs Shodan query syntax with paging and facet breakdowns by country, org or port; `shodan_count` returns just the match total for free.

Vulnerability work sits in three tools. `cve_lookup` pulls CVSS, EPSS, KEV status and affected CPEs for one CVE, `cpe_lookup` maps a product name to CPE 2.3 identifiers, and `cves_by_product` lists CVEs filterable by KEV or date and sortable by EPSS. CVEDB needs no key and burns no query credits. For DNS there is `domain_info` with subdomains and records, plus batched `dns_lookup` and `reverse_dns_lookup`.

You need Node.js 20 or newer and your own Shodan API key; the project is independent and not affiliated with Shodan. Tool arguments pass zod schemas before a request is built, so a malformed IP or CVE id never leaves your machine. Transports: stdio by default, HTTP streaming for a shared service. That HTTP mode ships without authentication, so bind it to localhost or put a proxy in front. Lookups go to Shodan's servers. Filtered searches need a membership or paid plan, and roughly one request per second is the ceiling.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `SHODAN_API_KEY` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add shodan -e SHODAN_API_KEY=<SHODAN_API_KEY> -- npx -y @burtthecoder/mcp-shodan
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add w0h1v-shodan --env SHODAN_API_KEY=<SHODAN_API_KEY> -- npx -y @burtthecoder/mcp-shodan
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "w0h1v-shodan": {
            "command": "npx",
            "args": [
                "-y",
                "@burtthecoder/mcp-shodan"
            ],
            "env": {
                "SHODAN_API_KEY": "<SHODAN_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "w0h1v-shodan": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@burtthecoder/mcp-shodan"
            ],
            "env": {
                "SHODAN_API_KEY": "<SHODAN_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e SHODAN_API_KEY=<SHODAN_API_KEY> w0h1v-shodan npx -y @burtthecoder/mcp-shodan
```
Replace <…> with your own values

## When to use it
- see which ports and services a given IP exposes
- judge how urgent a CVE is from its EPSS score and KEV listing
- map a domain's subdomains and DNS records
- list CVEs for a product by name or CPE
- size a search query without spending credits

## Example prompts
- Use `shodan_count` to total Apache hosts in Germany, broken down by port
- Pull subdomains for example.com and resolve them to IPs

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md