dns_lookup
Resolve hostnames to IP addresses using DNS lookup
LABSCO SUMMARY
The vulnerability half works on a free key; the exposure half does not.
CVE lookup, CVE search, CPE data, the newest records, the KEV list and EPSS ranking all run without a paid Shodan subscription — that alone is a usable vulnerability-research server. Search, network-range scanning, SSL lookup, IoT search, host counts and domain records are the paid endpoints, so plan on a Shodan membership if the question you are asking is about your own exposed surface rather than about published vulnerabilities.
What it is
An MCP server covering two Shodan surfaces at once: what is exposed on the internet (hosts, ports, certificates, DNS, IoT devices) and what is known to be broken (CVE records, CISA's Known Exploited Vulnerabilities, EPSS exploit-prediction scores). It also serves host records as an addressable resource at shodan://host/{ip}.
What you get
- Everything Shodan holds on one IP address, trimmable to the fields you name —
get_host_info - Shodan's database searched with its own query syntax, with facets, pagination and an optional summary instead of full records —
search_shodan,get_host_count - A CIDR range swept for devices, and IoT devices found by type and country —
scan_network_range,search_iot_devices - SSL certificate details for a domain, plus forward and reverse DNS and full domain records including subdomains and history —
get_ssl_info,dns_lookup,reverse_dns_lookup,get_domain_info - Shodan's own query vocabulary listed, and a query parsed to show which filters it is actually using —
list_search_facets,list_search_filters,parse_search_tokens - The ports Shodan crawls and the protocols available for on-demand scans —
list_ports,list_protocols - One CVE looked up in full, and CVEs searched by CPE, product, date range, KEV status or EPSS ranking —
get_cve_info,search_cves,get_cpes - The newest CVEs, CISA's Known Exploited Vulnerabilities, and CVEs ordered by exploit-prediction score —
get_newest_cves,get_kev_cves,get_cves_by_epss - Your Shodan plan, credits and profile, and the IP the internet sees you from —
get_api_info,get_account_profile,get_my_ip
Requirements
A Shodan API key in SHODAN_API_KEY. The npm package name is mcp-shodan-server (0.2.0) and it is marked private, so install from a clone: npm install, npm run build, then point your client at the built index.js.
Setup effort
One command plus a key — npx -y github:Cyreslab-AI/shodan-mcp-server, then supply credentials
USE CASES
01
Triaging a CVE that just landed in your inbox
Look the CVE up in full, then check whether CISA has it on the Known Exploited Vulnerabilities list and where it sits on exploit-prediction score — the two signals that separate urgent from routine. None of this needs a paid Shodan plan.
02
Finding what a product line is currently exposed to
Search CVEs by product or CPE string across a date range, sorted by EPSS, to get a ranked list rather than a chronological dump.
03
Checking what an address is showing the internet
Pull the full Shodan record for an IP, resolve the hostnames behind it, and read the certificate on the domain it serves.
04
Mapping a network range you are responsible for
Sweep the CIDR block for devices and count matches for a query before pulling records, so a broad search does not turn into thousands of results.
05
Learning Shodan's query language by using it
List the available filters and facets, then parse a query you were given to see exactly which filters it applies before you run it.
23 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
get_account_profile
Get account profile information including membership status and credits
get_api_info
Get information about your API plan including credits and limits
get_cpes
Get Common Platform Enumeration (CPE) information for products
get_cve_info
Get detailed information about a specific CVE
get_cves_by_epss
Get CVEs sorted by EPSS score (Exploit Prediction Scoring System)
get_domain_info
Get comprehensive domain information including subdomains and DNS records
get_host_count
Get the count of hosts matching a search query without consuming query credits
get_host_info
Get detailed information about a specific IP address
get_kev_cves
Get Known Exploited Vulnerabilities (KEV) from CISA
get_my_ip
Get your current IP address as seen from the Internet
get_newest_cves
Get the newest vulnerabilities from the CVE database
get_ssl_info
Get SSL certificate information for a domain
list_ports
List all ports that Shodan crawls on the Internet
list_protocols
List all protocols that can be used when performing on-demand Internet scans
list_search_facets
List all available search facets that can be used with Shodan queries
list_search_filters
List all available search filters that can be used in Shodan queries
parse_search_tokens
Parse a search query to understand which filters and parameters are being used
reverse_dns_lookup
Get hostnames for IP addresses using reverse DNS lookup
scan_network_range
Scan a network range (CIDR notation) for devices
search_cves
Search for vulnerabilities with various filters
search_iot_devices
Search for specific types of IoT devices
search_shodan
Search Shodan's database for devices and services
BEFORE YOU INSTALL
What to know first
Tools you get
23 tools when we connected. search_shodan, scan_network_range, get_ssl_info, search_iot_devices, get_host_count and get_domain_info need a paid Shodan membership; the CVE tools are free. scan_network_range looks up existing Shodan data rather than scanning.
Requires
- npx on PATH
- SHODAN_API_KEY in your environment
Where it runs
The documented client runs the server on your machine.
CONTEXT COST
Light Standing cost
Rated by the size of the 23 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
npx -y github:Cyreslab-AI/shodan-mcp-serverMCP Clients
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"shodan": {
"command": "node",
"args": [
"<YOUR_PATH_TO_SHODAN_MCP_SERVER>/build/index.js"
],
"env": {
"SHODAN_API_KEY": "<YOUR_SHODAN_API_KEY>"
}
}
}
}
