Shodan MCP

---
name: shodan-mcp
category: osint-technical-infrastructure
cost: freemium
api_key_required: yes
repo: https://github.com/BurtTheCoder/mcp-shodan
paired_skills: ["ip-and-asn-attribution", "cdn-and-origin-discovery", "shodan-investigative-queries", "residence-security-survey"]
capabilities: ["internet-scan", "service-intel", "exposed-devices"]
---

# Shodan MCP — internet-wide service intel, banner data, CVE-tagged searches

Queries Shodan for exposed services, pulls banner and certificate data, runs CVE-tagged searches, and traces shared infrastructure across IP ranges.

## Install

```
uvx mcp-shodan
```

## Configuration

```json
{
  "mcpServers": {
    "shodan": {
      "command": "uvx",
      "args": ["mcp-shodan"],
      "env": {
        "SHODAN_API_KEY": "YOUR_SHODAN_KEY_HERE"
      }
    }
  }
}
```

Get your API key at account.shodan.io.

## What it adds

Claude queries what services a target IP or range is exposing to the internet — open ports, banner fingerprints, SSL cert details, vulnerability tags. Traces shared infrastructure by finding other IPs running identical services or certs. Essential for the origin-discovery workflow (finding the real server behind a CDN) and for identifying exposed attack surface during EP residence/venue surveys.

## Pairs with skills

- 042 `ip-and-asn-attribution`
- 045 `cdn-and-origin-discovery`
- 383 `shodan-investigative-queries`
- 623 `residence-security-survey` (EP — exposed IoT/CCTV)

## Cost

Free tier: ~100 queries/month — sufficient for spot investigations. Shodan Membership ~$49 one-time (often discounted) gives a budget adequate for regular investigative work.