Labsco
MCP SERVER

Shodan MCP Server

by Cyreslab-AI ↗

Query Shodan and the CVE database from a conversation — host and certificate lookups, network-range scans, and vulnerability search by product, KEV status or EPSS score.

Vulnerability Scanning & Application Security✓ Verified
Summary
The vulnerability half works on a free key; the exposure half does not.

CVE lookup, CVE search, CPE data, the newest records, the KEV list and EPSS ranking all run without a paid Shodan subscription — that alone is a usable vulnerability-research server. Search, network-range scanning, SSL lookup, IoT search, host counts and domain records are the paid endpoints, so plan on a Shodan membership if the question you are asking is about your own exposed surface rather than about published vulnerabilities.

What it is

An MCP server covering two Shodan surfaces at once: what is exposed on the internet (hosts, ports, certificates, DNS, IoT devices) and what is known to be broken (CVE records, CISA's Known Exploited Vulnerabilities, EPSS exploit-prediction scores). It also serves host records as an addressable resource at `shodan://host/{ip}`.

What you get
  • Everything Shodan holds on one IP address, trimmable to the fields you name — `get_host_info`
  • Shodan's database searched with its own query syntax, with facets, pagination and an optional summary instead of full records — `search_shodan`, `get_host_count`
  • A CIDR range swept for devices, and IoT devices found by type and country — `scan_network_range`, `search_iot_devices`
  • SSL certificate details for a domain, plus forward and reverse DNS and full domain records including subdomains and history — `get_ssl_info`, `dns_lookup`, `reverse_dns_lookup`, `get_domain_info`
  • Shodan's own query vocabulary listed, and a query parsed to show which filters it is actually using — `list_search_facets`, `list_search_filters`, `parse_search_tokens`
  • The ports Shodan crawls and the protocols available for on-demand scans — `list_ports`, `list_protocols`
  • One CVE looked up in full, and CVEs searched by CPE, product, date range, KEV status or EPSS ranking — `get_cve_info`, `search_cves`, `get_cpes`
  • The newest CVEs, CISA's Known Exploited Vulnerabilities, and CVEs ordered by exploit-prediction score — `get_newest_cves`, `get_kev_cves`, `get_cves_by_epss`
  • Your Shodan plan, credits and profile, and the IP the internet sees you from — `get_api_info`, `get_account_profile`, `get_my_ip`
Requirements

A Shodan API key in `SHODAN_API_KEY`. The npm package name is `mcp-shodan-server` (0.2.0) and it is marked private, so install from a clone: `npm install`, `npm run build`, then point your client at the built `index.js`.

Setup effort

One command plus a key — npx -y github:Cyreslab-AI/shodan-mcp-server, then supply credentials