Shodan MCP Server – Internet Exposure Intelligence
The Cyreslab-AI Shodan MCP server connects AI agents to Shodan's internet intelligence API and Shodan's vulnerability data. Use it for authorized asset discovery, exposure review, host and service investigation, certificate research, and vulnerability-context gathering.
Overview
This community-maintained MCP server connects an AI agent to the Shodan API,
which indexes publicly visible information about internet-connected systems
and services. It is developed by Cyreslab-AI and is also packaged in Docker's
MCP Catalog. It is not an official Shodan MCP server, although it relies on
Shodan's official API and requires a valid Shodan API key.
What the MCP server enables
The server exposes structured tools that let an AI agent query Shodan without
manually constructing every API request. Documented capabilities include:
- Looking up available information about a public IP address.
- Searching Shodan for internet-facing devices and services.
- Reviewing SSL certificate information associated with a domain.
- Searching for categories of internet-connected and IoT devices.
- Querying network ranges and retrieving supported host details.
- Looking up CVEs, CPE information, Known Exploited Vulnerabilities, and EPSS data.
- Reviewing Shodan account information, credits, filters, facets, ports, and protocols.
When to use it
Use this MCP server for defensive and authorized security workflows, such as
reviewing an organization's external attack surface, investigating an approved
public IP address, validating known internet exposure, enriching vulnerability
analysis, or gathering context during incident response. It can also help an
agent summarize search results and correlate exposed services with known CVEs.
Do not use it to target systems without permission. Shodan data describes
publicly observable services, but access to that information does not grant
authorization to probe, scan, exploit, or modify third-party systems.
Connection and authentication
The verified configuration below runs the Docker-packaged MCP server over
stdio using the image mcp/cyreslab-ai-shodan. The server expects the
SHODAN_API_KEY environment variable. Store the real key outside this YAML
and inject it securely at runtime.
Key considerations
Some Shodan API features require a paid membership or consume query or scan
credits. Search, network scanning, certificate lookup, device search, and some
domain operations may depend on the account plan. Results represent Shodan's
indexed observations and may be incomplete, delayed, or no longer reflect a
system's current state. Validate important findings through authorized methods
before making security decisions.
Supported Transports
stdio
Command: docker
Args:
run-i--rm-eSHODAN_API_KEYmcp/cyreslab-ai-shodan
Frequently Asked Questions
- When should an AI agent use the Shodan MCP server?
- Use it for authorized external-asset discovery, internet-exposure review, host and service investigation, certificate research, vulnerability enrichment, and defensive security analysis involving Shodan data.
- What does the Shodan MCP server add to an AI agent's capabilities?
- It gives the agent structured access to current Shodan observations and vulnerability data, allowing it to retrieve and summarize host, service, device, certificate, CVE, CPE, KEV, and EPSS information through MCP tools.
- What can an AI agent access through this server?
- Depending on the Shodan account plan, the agent can look up public IP information, search devices and services, inspect SSL and domain data, review supported network ranges, query vulnerability records, and inspect API-plan information such as credits and limits.
- How is authentication configured for the Shodan MCP server?
- The Docker-based server reads a Shodan API key from the SHODAN_API_KEY environment variable. Keep the real key in a secret manager or local environment and provide only the variable reference in configuration.
- Which transport should be used for the Shodan MCP server?
- Use stdio with the Docker image mcp/cyreslab-ai-shodan. The reviewed documentation did not provide a trusted hosted Streamable HTTP or SSE endpoint, so no remote transport is included in this YAML.