MCP Shodan
by w0h1vMCP server for Shodan — search internet-connected devices, IP reconnaissance, DNS lookups, and CVE/CPE vulnerability intelligence. Works with Claude Code, Codex, Gemini CLI, and Claude Desktop.
MCP Shodan is an open-source mcp server by w0h1v, written mainly in TypeScript, with 183 GitHub stars and the MIT license. Its code was last updated Oct 31, 2026.
Scan summary: scanned Nov 5, 2026 at commit 422483a. Seen able to read environment and secrets. Scan policy
What MCP Shodan can touch
- Our checks did not find this. The tool may still do it.Run shell commandsNot seen in this scan
- Our checks did not find this. The tool may still do it.Run dynamic codeNot seen in this scan
- Our checks did not find this. The tool may still do it.Read or write filesNot seen in this scan
- Seen in this scan, either in the code or while it ran.Read environment and secretsFound in the code by our scan
- Our checks did not find this. The tool may still do it.Control a web browserNot seen in this scan
- Our checks did not find this. The tool may still do it.Connect to databasesNot seen in this scan
- Our checks did not find this. The tool may still do it.Read or send messagesNot seen in this scan
- Our checks did not find this. The tool may still do it.Touch money or tradingNot seen in this scan
- Our checks did not find this. The tool may still do it.Connect to the internetNo connections seen while running
"Not seen" means our checks did not find it, and the tool may still do it. Covers commit 422483a, Nov 5, 2026. See the scan policy.
Before you install MCP Shodan
AgenticMart scanned MCP Shodan on Nov 5, 2026 with automated checks for hidden code, known-malicious packages, leaked secrets and vulnerable dependencies. The result covers one commit under our scan policy, so review what access you give it and check any advisories shown here.
What it can access
- An MCP server is a program your AI app starts and talks to. A local one runs with your user's permissions: it can see the files, environment variables and network your account can.
Before you install
- Pin the version you reviewed instead of always installing the latest release.
- Read the tool list or scripts before the first run, and keep approval prompts on for actions that write, send or delete.
- Maintained by w0h1v on GitHub, 183 stars and 30 forks. Popularity is not proof of safety.
- Last code change: Oct 31, 2026.
- Open-source license: MIT.
Tools MCP Shodan exposes (11)
Listed by the server itself during our scan of commit 422483a.
ip_lookupRetrieve comprehensive information about an IP address, including geolocation, operating system, open ports, running services (product, version, CPE), known vulnerabilities (CVEs), SSL certificates, hostnames, and cloud provider details if available. Returns service banners and HTTP server informati
shodan_searchSearch Shodan's database of internet-connected devices. Returns detailed information about matching devices including services, vulnerabilities, and geographic distribution. Supports advanced search filters and returns facet statistics (default: by country). Costs 1 query credit when the query uses
cve_lookupQuery detailed vulnerability information from Shodan's CVEDB. Returns comprehensive CVE details including CVSS scores (v4/v3/v2), EPSS probability and ranking, KEV status, proposed mitigations, ransomware associations, and affected products (CPEs).
dns_lookupResolve domain names to IP addresses using Shodan's DNS service. Supports batch resolution of multiple hostnames in a single query. Returns IP addresses mapped to their corresponding hostnames.
reverse_dns_lookupPerform reverse DNS lookups to find hostnames associated with IP addresses. Supports batch lookups of multiple IP addresses in a single query. Returns all known hostnames for each IP address, with clear indication when no hostnames are found.
cpe_lookupSearch for Common Platform Enumeration (CPE) entries by product name in Shodan's CVEDB. Supports pagination and can return either full CPE details or just the total count. Useful for identifying specific versions and configurations of software and hardware.
cves_by_productSearch for vulnerabilities affecting specific products or CPEs. Supports filtering by KEV status, sorting by EPSS score, date ranges, and pagination. Can search by product name or CPE 2.3 identifier. Returns detailed vulnerability information including severity scores and impact assessments.
shodan_countGet the total number of Shodan results for a query, with optional facet breakdowns (e.g. by country, org, port). Free: does not consume query credits. Use search_filters to list valid filters and facets.
domain_infoGet subdomains and DNS records for a domain from Shodan. Costs 1 query credit per lookup.
api_infoShow the Shodan API plan, remaining query and scan credits, monitored IPs, and usage limits for the configured API key. Free: does not consume credits.
search_filtersList the search filters and facets Shodan supports. Use this to build valid shodan_search and shodan_count queries and facets. Free: does not consume credits.
MCP Shodan is an open-source mcp server by w0h1v, written mainly in TypeScript. MCP server for Shodan — search internet-connected devices, IP reconnaissance, DNS lookups, and CVE/CPE vulnerability intelligence. Works with Claude Code, Codex, Gemini CLI, and Claude Desktop.
At a glance
- Stars
- 183
- Forks
- 30
- Language
- TypeScript
- License
- MIT
- Created
- Dec 2024
- Last update
- Oct 31, 2026
- Type
- MCP Server
- Price
- Free
Topics
Questions about MCP Shodan
What is MCP Shodan?
MCP server for Shodan — search internet-connected devices, IP reconnaissance, DNS lookups, and CVE/CPE vulnerability intelligence. Works with Claude Code, Codex, Gemini CLI, and Claude Desktop.
Who maintains MCP Shodan?
MCP Shodan is maintained by w0h1v on GitHub (w0h1v/mcp-shodan). AgenticMart lists it from public repository data.
Is MCP Shodan safe to use?
AgenticMart scanned MCP Shodan on Nov 5, 2026 with automated checks for hidden code, known-malicious packages, leaked secrets and vulnerable dependencies. The result covers one commit under our scan policy, so review what access you give it and check any advisories shown here.
What license does MCP Shodan use?
It is published under the MIT license.
MCP Shodan alternatives
View more →Similar mcp servers in Security & Testing, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.
| Name | Stars | Licence | Last updated | Scan |
|---|---|---|---|---|
| MCP Shodan (this page) w0h1v | 183 | MIT | Oct 31, 2026 | Scanned, no flagged issues |
| Hexstrike AI 0x4m4 | 13k | MIT | Aug 3, 2026 | Scanned, no flagged issues |
| Viper FunnyWolf | 5.3k | None found | May 31, 2026 | Not scanned yet |
| Open Ontologies fabio-rovai | 2.7k | MIT | Oct 30, 2026 | Scanned, no flagged issues |
| Qu1cksc0pe CYB3RMX | 2.1k | GPL-3.0 | Sep 18, 2026 | Scanned, no flagged issues |
| Cve MCP Server mukul975 | 1.7k | Apache-2.0 | Oct 1, 2026 | Scanned, no flagged issues |