Summary

Reconnaissance queries, in the order you actually run them.

The tool set maps onto a real investigation: resolve the name, look up the host, list its vulnerabilities, then read the CVE that matters. Search is the wide end of that — Shodan's syntax passes through untouched, so an existing query works as written. Everything here counts against your Shodan plan's query allowance, and the results describe internet-exposed infrastructure, so scope what you point it at.

What it is

An MCP server over the Shodan API covering five queries: what Shodan knows about an IP, which vulnerabilities are associated with it, what a specific CVE is, what a hostname resolves to, and a full search across Shodan's database using its own query syntax.

What you get

`get_ip_info` — everything Shodan holds about a given `ip`
`get_vulnerabilities` — the vulnerabilities associated with an IP address
`cve_info` — details for a specific CVE id
`dns_lookup` — resolve a `hostname` to its address
`search` — Shodan's database with a `query` in its own search syntax, returning matching devices

Requirements

A Shodan API key from your Shodan account, supplied as `SHODAN_API_KEY` in the server's env block. Node.js — installation is a clone plus `npm install` and `npm run build`, then pointing the client at `build/index.js`. The package is `shodan-mcp-server` (0.1.0 in package.json). MIT licensed.