Shodan MCP Server: Install & Setup

Install Shodan in Claude Code

Claude Code

claude mcp add shodan -e SHODAN_API_KEY=... -- npx -y @burtthecoder/mcp-shodan

mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)

{
  "mcpServers": {
    "shodan": {
      "command": "npx",
      "args": [
        "-y",
        "@burtthecoder/mcp-shodan"
      ],
      "env": {
        "SHODAN_API_KEY": "..."
      }
    }
  }
}

Replace each ... with your own value.

Frequently asked questions

What does the Shodan MCP server do?

Query the Shodan API and Shodan CVEDB: IP lookups, device searches, DNS lookups, vulnerability queries and CPE lookups.

Is the Shodan MCP server free?

The server is free, but you will likely need an account. The server itself is free, but it connects to a service that needs an account or API key, which may have paid tiers. Check the provider for current pricing.

Does Shodan run locally or remotely?

Local. Runs on your machine (stdio). You install it with npx, uvx, Docker or from source.

How do I add Shodan to Claude Code?

Run: claude mcp add shodan -e SHODAN_API_KEY=... -- npx -y @burtthecoder/mcp-shodan

More security & identity MCP servers

View all

VERAX

verax-ai/verax

Sits between an agent and its tools: every call passes a policy gate and leaves a signed decision record before it runs, a refusal is recorded like an approval, payments wait for an operator on the same machine, and the ledger stays there and verifies offline. Apache-2.0.

LocalFreeTypeScript

Seal

aurumflux20/seal

Exactly-once payments for agents: prevents double settlement across processes and retries, confirms charges with the provider and reconciles out-of-band spend.

LocalFreePython

verify-proof

Fulcrum-Enterprises/verify-proof

Verify blockchain-anchored timestamp proofs locally: recompute a file's SHA-256, walk the Merkle path and check the anchor on Polygon or Bitcoin.

LocalFreePython

SaveSaveSaveSave

691

stefantsezarov/SaveSaveSaveSave

Read-only checks before an agent acts: prompt-injection and phishing scan of untrusted text (local), npm package check for malware, hijacked releases and typosquats, crypto address and token scan, and address-poisoning comparison. Zero dependencies.

LocalAccount neededTypeScript

Verity

meloliva14/verity-mcp

Fail-closed trust gate for agents: fact-checking, prompt-injection detection, content moderation, PII and secret detection, and a pre-action guardrail.

LocalAccount neededPython

Rqwstr

Kjopstad-IT/rqwstr-mcp

HTTP security testing toolkit (send, intruder, race, chain, out-of-band) with low-level HTTP/1.1 and HTTP/2 control: raw framing and connection pinning.

LocalFreeGo