Shodan MCP Server – network reconnaissance, DNS operations, and vulnerability intelligence
Shodan MCP Server – network reconnaissance, DNS operations, and vulnerability intelligence. That is what the mcp mcp server brings to an AI assistant: the same capability, reachable through the Model Context Protocol rather than a separate app or dashboard.
Get your API key at account.shodan.io.
Installation goes through your MCP client rather than a global install: point it at @tocharianou/mcp-shodan on npm and it is fetched when the client starts. The copy-paste blocks for Claude Desktop, Claude Code and Cursor are further down this page.
The server publishes 7 tools. What each one is for:
ip_lookup — IP address analysis: ports, services, banners, cloud provider, hostnamesshodan_search — Search internet-connected devices with country distribution statsdns_lookup — Batch forward DNS resolution (hostnames → IPs)reverse_dns_lookup — Batch reverse DNS lookup (IPs → hostnames)cve_lookup — CVE details: CVSS v2/v3, EPSS, KEV status, ransomware associationscpe_lookup — Search CPE entries by product name with paginationcves_by_product — All CVEs for a product or CPE 2.3 identifier with filteringConfiguration is passed through the environment: SHODAN_API_KEY, SHODAN_BASE_URL, SHODAN_AUTH_TOKEN, SHODAN_CVEDB_URL, MCP_HTTP_HOST, YOUR_BEARER_TOKEN. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.
Plenty of database access servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. MCP's toolset — ip_lookup, shodan_search, dns_lookup and 4 more — is a fair guide to whether it matches your workflow. It is maintained by tocharian; worth a glance at recent repository activity before you build anything load-bearing on it.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
| Tool | What it does |
|---|---|
| ip_lookup | IP address analysis: ports, services, banners, cloud provider, hostnames |
| shodan_search | Search internet-connected devices with country distribution stats |
| dns_lookup | Batch forward DNS resolution (hostnames → IPs) |
| reverse_dns_lookup | Batch reverse DNS lookup (IPs → hostnames) |
| cve_lookup | CVE details: CVSS v2/v3, EPSS, KEV status, ransomware associations |
| cpe_lookup | Search CPE entries by product name with pagination |
| cves_by_product | All CVEs for a product or CPE 2.3 identifier with filtering |
{
"mcpServers": {
"shodan": {
"command": "npx",
"args": ["-y", "@tocharianou/mcp-shodan"],
"env": {
"SHODAN_API_KEY": "<your-api-key>"
}
}
}
}Configuration as documented by the project. Restart the client after saving.
| Variable | Description | Required |
|---|---|---|
| SHODAN_API_KEY | Credential the server authenticates with. | Yes |
| SHODAN_BASE_URL | Endpoint or connection string the server talks to. | Yes |
| SHODAN_AUTH_TOKEN | Credential the server authenticates with. | Yes |
| SHODAN_CVEDB_URL | Endpoint or connection string the server talks to. | Yes |
| MCP_HTTP_HOST | Endpoint or connection string the server talks to. | Optional |
| YOUR_BEARER_TOKEN | Credential the server authenticates with. | Yes |
Read-only SQL access to Postgres — let your assistant inspect schemas and answer questions from real data.
Manage your whole Supabase project in conversation — database, auth, storage, Edge Functions and branches.
Query, modify and analyse local SQLite databases in conversation — the fastest way to chat with a data file.
Metabase ships its own MCP endpoint — search your BI content, build and run queries, and save questions and dashboards without leaving the chat.
Official MongoDB server covering data, schemas and Atlas management — from find queries to spinning up clusters.
Serverless Postgres with database branching — point your assistant at Neon and let it work on disposable copies.