Shodan OSINT MCP Server MCP Server

About

## Shodan MCP Server: Internet Intelligence and OSINT Platform The **Shodan MCP Server** integrates the world's first search engine for internet-connected devices into Google Antigravity, enabling security researchers to discover exposed services, monitor attack surfaces, and gather threat intelligence. ### Why Shodan MCP? - **Device discovery** - Find internet-connected devices and services - **Attack surface** - Monitor your organization's external exposure - **Vulnerability research** - Discover systems with known vulnerabilities - **Threat intelligence** - Track malicious infrastructure and botnets - **Historical data** - Access historical snapshots of internet assets ### Key Features #### 1. Host Search ```python # Search for specific services results = await mcp.call("shodan", "search", { "query": "apache country:US port:443", "limit": 100 }) for host in results["matches"]: print(f"{host[\"ip_str\"]}:{host[\"port\"]}") print(f" Org: {host.get(\"org\", \"Unknown\")}") print(f" Product: {host.get(\"product\", \"N/A\")}") ``` #### 2. Host Information ```python # Get detailed host information host = await mcp.call("shodan", "host", { "ip": "8.8.8.8", "history": True }) print(f"IP: {host[\"ip_str\"]}") print(f"Organization: {host[\"org\"]}") print(f"OS: {host.get(\"os\", \"Unknown\")}") for service in host["data"]: print(f" Port {service[\"port\"]}: {service.get(\"product\", \"Unknown\")}") if service.get("vulns"): print(f" Vulns: {list(service[\"vulns\"].keys())}") ``` #### 3. Attack Surface Monitoring ```python # Monitor organization exposure monitoring = await mcp.call("shodan", "create_monitor", { "name": "My Company", "ips": ["192.168.1.0/24", "10.0.0.0/8"] }) # Get alerts for changes alerts = await mcp.call("shodan", "get_alerts", { "monitor_id": monitoring["id"], "since": "2024-01-01" }) for alert in alerts: print(f"[{alert[\"type\"]}] {alert[\"ip\"]}:{alert[\"port\"]}") print(f" Change: {alert[\"description\"]}") ``` #### 4. Vulnerability Discovery ```python # Find vulnerable systems vulns = await mcp.call("shodan", "search", { "query": "vuln:CVE-2021-44228", "facets": ["country", "org"] }) print(f"Total affected: {vulns[\"total\"]}") for facet in vulns["facets"]["country"]: print(f" {facet[\"value\"]}: {facet[\"count\"]}") ``` ### Configuration ```json { "mcpServers": { "shodan": { "command": "npx", "args": ["-y", "@anthropic/mcp-shodan"], "env": { "SHODAN_API_KEY": "your-shodan-api-key" } } } } ``` ### Use Cases **Attack Surface Management**: Discover and monitor your external exposure. **Threat Research**: Track malicious infrastructure and threat actors. **Vulnerability Assessment**: Find systems affected by specific CVEs. **Due Diligence**: Assess security posture of third parties and acquisitions. The Shodan MCP Server enables internet-scale security intelligence gathering.

Installation

{
  "mcpServers": {
    "shodan": {
      "mcpServers": {
        "shodan": {
          "env": {
            "SHODAN_API_KEY": "YOUR_API_KEY"
          },
          "args": [
            "-y",
            "@adeosec/mcp-shodan"
          ],
          "command": "npx"
        }
      }
    }
  }
}

How to Use

1. 1Internet device search
2. 2Port and service scanning
3. 3Security research