{
  "slug": "io-github-w0h1v-shodan",
  "name": "io.github.w0h1v/shodan",
  "title": "shodan",
  "description": "MCP server for Shodan API — device search, IP and domain recon, DNS, and CVE/CPE queries.",
  "version": "1.0.34",
  "publishedAt": "2026-10-12T15:14:01.116618Z",
  "updatedAt": "2026-10-12T15:14:01.116618Z",
  "repoUrl": "https://github.com/w0h1v/mcp-shodan",
  "websiteUrl": null,
  "namespace": {
    "type": "github",
    "owner": "w0h1v"
  },
  "kind": "local",
  "packages": [
    {
      "registryType": "npm",
      "identifier": "@burtthecoder/mcp-shodan",
      "version": "1.0.34",
      "transport": "stdio",
      "runtimeHint": null
    }
  ],
  "remotes": [],
  "envVars": [
    {
      "name": "SHODAN_API_KEY",
      "isSecret": true,
      "isRequired": true,
      "description": "Your Shodan API key"
    }
  ],
  "category": "security",
  "subcategory": "vuln",
  "company": "",
  "categoryAuto": true,
  "checks": [
    {
      "id": "source-linked",
      "label": "Source repository linked",
      "result": "pass",
      "detail": "https://github.com/w0h1v/mcp-shodan"
    },
    {
      "id": "version-pinned",
      "label": "Version pinned",
      "result": "pass",
      "detail": "Every package has an explicit version"
    },
    {
      "id": "secrets-requested",
      "label": "Secrets requested",
      "result": "info",
      "detail": "Asks for 1 secret: SHODAN_API_KEY"
    },
    {
      "id": "known-registry",
      "label": "Known package registry",
      "result": "pass",
      "detail": "All packages come from npm, PyPI, OCI, NuGet or MCPB"
    },
    {
      "id": "namespace",
      "label": "Namespace ownership",
      "result": "info",
      "detail": "Name verified via GitHub account w0h1v"
    },
    {
      "id": "meta-text",
      "label": "Registry text aimed at the AI",
      "result": "pass",
      "detail": "Description and settings contain no hidden characters or instructions to the AI"
    },
    {
      "id": "install-scripts",
      "label": "Install scripts",
      "result": "pass",
      "detail": "@burtthecoder/mcp-shodan@1.0.34 runs nothing at install"
    },
    {
      "id": "code-flags",
      "label": "Code red flags",
      "result": "pass",
      "detail": "Read 16 files in @burtthecoder/mcp-shodan@1.0.34: no obfuscation, encoded execution, credential reads or data-collection endpoints found"
    },
    {
      "id": "ai-text",
      "label": "Text aimed at the AI",
      "result": "pass",
      "detail": "No hidden characters or instructions to the AI in 16 files, including comments and the README"
    }
  ],
  "scannedAt": "2026-10-29",
  "level": "Scanned",
  "install": [
    {
      "label": "Claude Desktop (npm)",
      "kind": "claude_desktop_json",
      "text": "{\n  \"mcpServers\": {\n    \"shodan\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"@burtthecoder/mcp-shodan@1.0.34\"\n      ],\n      \"env\": {\n        \"SHODAN_API_KEY\": \"<your value>\"\n      }\n    }\n  }\n}"
    }
  ],
  "curated": true,
  "stars": 182,
  "archived": false,
  "pushedAt": "2026-10-26T06:02:08Z",
  "review": {
    "package": "@burtthecoder/mcp-shodan",
    "version": "1.0.34",
    "at": "2026-10-31",
    "files": 14,
    "lines": 951,
    "verdict": "pass",
    "summary": "Looks up IPs, domains, devices and CVEs using Shodan. It only talks to Shodan's API and CVE database, and your Shodan key is sent only to Shodan. Some searches use your Shodan query credits, which the tool descriptions state clearly.",
    "hosts": [
      {
        "host": "api.shodan.io",
        "when": "only when a tool is called",
        "sends": "IP addresses, hostnames, domains, search queries and facets, plus the API key as the 'key' query parameter (Shodan's API design)"
      },
      {
        "host": "cvedb.shodan.io",
        "when": "when cve_lookup, cpe_lookup or cves_by_product is called",
        "sends": "CVE id, product name or CPE string and filters (no API key)"
      }
    ],
    "env": [
      {
        "name": "SHODAN_API_KEY",
        "sent_to": "api.shodan.io only (query string)"
      },
      {
        "name": "MCP_TRANSPORT / MCP_PORT / MCP_HOST / MCP_ENDPOINT",
        "sent_to": "local (optional HTTP transport, default host localhost)"
      }
    ],
    "local": "Loads .env via dotenv; reads its own package.json for the version. No other file access.",
    "exec": "None.",
    "telemetry": "None.",
    "tools": [
      "ip_lookup",
      "shodan_search",
      "cve_lookup",
      "dns_lookup",
      "reverse_dns_lookup",
      "cpe_lookup",
      "cves_by_product",
      "shodan_count",
      "domain_info",
      "api_info",
      "search_filters"
    ],
    "toolText": "clean (descriptions accurately state which calls cost Shodan query credits)",
    "deps": [
      "fastmcp (npm)",
      "axios",
      "zod",
      "dotenv"
    ],
    "findings": [
      {
        "severity": "info",
        "at": "build/helpers.js:7-13",
        "what": "The API key travels as a URL query parameter, as the Shodan API requires; error messages logged to stderr do not include the URL or key."
      },
      {
        "severity": "info",
        "at": "build/tools/ip-lookup.js:8, domain-info.js:3-12, cve-lookup.js:10",
        "what": "Inputs placed in URL paths are validated (z.ip(), hostname regex, CVE regex, encodeURIComponent)."
      },
      {
        "severity": "info",
        "at": "build/index.js:51-61",
        "what": "Optional httpStream transport binds localhost by default with no auth; stdio is the default."
      },
      {
        "severity": "info",
        "at": "package",
        "what": "No package.json in the reviewed copy (read at runtime for the version); dependencies are taken from imports. All tools are read-only lookups. No obfuscation, install hooks, dynamic code or hard-coded secrets."
      },
      {
        "severity": "info",
        "at": "manifest.tsv",
        "what": "lines_read (951) is the real line count of every file (Read tool / splitlines). The manifest's 965 counts one extra empty 'line' after the trailing newline of 14 files; no file or line was skipped."
      }
    ]
  },
  "health": {
    "score": 72,
    "parts": {
      "popularity": 0.5285409596287567,
      "activity": 0.9341369565641697,
      "issues": null,
      "security": 1
    },
    "fail": 0,
    "warn": 0,
    "raw": {
      "stars": 183,
      "forks": 30,
      "downloads": 648,
      "hn": {
        "n": 0,
        "pts": 0,
        "t": []
      },
      "issuesOpen": 0,
      "issuesClosed": 2,
      "prsMerged": 10,
      "commits90": 30,
      "release": "2026-09-08T16:52:55Z",
      "pushed": "2026-10-26T06:02:08Z",
      "growth": null,
      "growthDays": null,
      "archived": false
    },
    "at": "2026-10-31T07:42:38.200Z"
  }
}