Checking remote desktop exposure
Priya Sharma, security engineer at BigCo, asked how many of the company's IPs exposed RDP. Memtro ran a free count with port and organisation facets, then read one flagged host's open ports, products and known CVEs.
Shodan + Memtro
What does our office IP range expose to the internet?
Shodan tells you what your addresses show the internet. You see what an IP exposes, with open ports, products, versions, known CVEs, hostnames and owner, plus searches and free counts with facets over Shodan's index, a domain's DNS records, network alerts, scans and your plan's credits. When asked and granted, Memtro can create, change and delete network alerts, turn their triggers on or off, ignore a service, route an alert to an existing notifier and request a scan of your own IPs. Worth knowing: scans need a paid API plan and spend credits Shodan does not refund.
In Memtro
What you can do with Shodan in Memtro
Ask in plain English from chat, your editor, a scheduled job or your own agent. The model picks the right Shodan tool, reads what it needs, and answers with the source cited.
What it does
- 01See what one IP exposes: open ports, products, versions, CVE ids, hostnames, organisation and ASN.
- 02Count matching services with facets for free, or search Shodan's index, which spends a query credit when filtered.
- 03Read a domain's subdomains and DNS records, and resolve hostnames and IPs both ways.
- 04Check network alerts, scan status, credits left and the notifiers on the account.
- 05When asked and granted, create, change or delete network alerts, and turning triggers on notifies whoever the alert's notifiers reach.
- 06When asked and granted, request a scan of IPs the company owns, which probes every port and spends scan credits.
Acts when asked
When you ask it to
These tools change something in Shodan. The model is told to use them only when you ask for exactly that, and an administrator grants each one by name to the teams that may use it; a personal connection acts only after its owner allows it.
- 01Create a network alert to monitor IPs or ranges
- 02Change the networks an alert monitors
- 03Delete a network alert (permanent)
- 04Turn alert triggers on (notifications start)
- 05Turn alert triggers off
- 06Ignore a service for an alert trigger
- 07Stop ignoring a service for an alert trigger
- 08Send an alert's notifications to an existing notifier
- 09Stop sending an alert to a notifier
- 10Request an on-demand scan of IPs (spends scan credits, probes those addresses)
In practice
Ask it like you would a colleague
Once Shodan is connected, these are the kinds of things people ask. Plain questions, no syntax. If the answer lives partly in another system you have connected, Memtro looks there too.
Shodan + MemtroWhat does our office IP range expose to the internet?
How many of our IPs expose RDP?
Which known CVEs does Shodan list for 203.0.113.10?
Which subdomains of acme.example has Shodan seen?
How many scan credits do we have left?
Alert on the office range
Tom Reilly, IT manager at Northwind, asked Memtro to watch the office range. Memtro created a network alert, turned on the new service and vulnerable triggers, and attached the team's existing Slack notifier. The people that channel reaches are now told when one fires.
Teams
Where it fits
The teams that lean on Shodan most, a question each of them asks, and what they connect beside it.
- EngineeringKeep decisions from evaporatingEngineer, Tech lead, On call, New joiner“Who owns the billing migration, and what did we decide about retries?”Used alongside GitHub, Linear, Jira, Confluence, Slack and 5 more.
- ProductHear what customers actually ask forProduct manager, Researcher, Designer, Head of product“Which customers asked for SSO this quarter, and what is their combined ARR?”Used alongside Help Scout, HubSpot, Linear, Jira, Slack and 6 more.
- Agent buildersMemory and tools for the agents you buildSolo builder, Platform team, Automation engineer, Whoever signs it off“Search memtro for what we know about Acme before drafting the proposal”Used alongside GitHub, Linear and Slack.
Better together
Works with
A record in Shodan is rarely the whole story. Connect the systems that hold the rest and Memtro checks them together, then remembers what it learned so the next question starts further along.
- Work managementShodan with JiraJQL search, issue details and projects from Jira Cloud.
- Work managementShodan with Clio ManageAsk the matter: its client, its fee earner, the time on it and what is still unbilled.
- Work managementShodan with LinearIssues, projects and teams, synced hourly into memory.
- SupportShodan with Help ScoutAI that reads your support conversations and cross-references the customer everywhere else.
- SupportShodan with ZendeskEvery ticket, reply and internal note, ready to be asked about.
- SupportShodan with IntercomCustomer conversations and the people behind them, in your company memory.
- Documents and wikisShodan with NotionSearch pages and query databases, and write to them when you ask.
- Documents and wikisShodan with Google DriveSearch Drive and read Docs, Sheets and Slides as text, and write a Doc when you ask.
- Documents and wikisShodan with ConfluenceSearch and read wiki pages, and write them when you ask.
Also in Engineering and operations
Using something else for the same job, or both? Each connector has its own tools; connect as many as you like.
- GitHub
- AWS CloudWatch
- Sentry
- ServiceNow
- Okta
- Twilio
- AWS CloudTrail
- GitLab
- Bitbucket
- Vercel
- PagerDuty
- Datadog
- Grafana
- incident.io
- Azure DevOps
- CircleCI
- Cloudflare
- LaunchDarkly
- New Relic
- Rollbar
- Snyk
- Better Stack
- Buildkite
- DigitalOcean
- Heroku
- Netlify
- SonarQube Cloud
- Statuspage
UptimeRobot- Axiom
- BugSnag
- Checkly
- Hetzner Cloud
Honeycomb- Pingdom
- Render
- Statsig
- Sumo Logic
- Supabase
- HCP Terraform
- Vultr
- Airbrake
- Codecov
Cronitor- Dynatrace
FireHydrant- Fly.io
- Honeybadger
- Akamai Linode
- Octopus Deploy
- Pulumi
- Rootly
- Semgrep
- Splunk
StatusCake- Tailscale
- Argo CD
- authentik
- Coolify
- Gitea
GlitchTip
GLPI- Jenkins
Langfuse
LibreNMS- n8n
NetBox- Portainer
- Prefect
Snipe-IT
Woodpecker CI
Zabbix
LangSmith
Helicone- OpenAI (usage and cost)
- Anthropic (usage and cost)
- Algolia
- Flagsmith
- Unleash
GrowthBook
Drata
Intruder
GitGuardian
Secureframe
ilert- KnowBe4
JumpCloud
ConfigCat- Railway
- Fastly
- Postman
- Make
- Braintrust
- OpenRouter
- ElevenLabs
Split- Scaleway
Aikido Security- AssemblyAI
Astronomer- Bamboo
- Baseten
- Bitrise
- Bitwarden
- BrowserStack
- bunny.net
- Cachet
- Checkmk
- Civo
- Cloudsmith
- Codacy
- Codemagic
Comet Opik- Coralogix
CrowdStrike Falcon- Dagster+
- DeepSource
Detectify- Docker Hub
Domotz- Grafana OnCall
- Harness
- Hugging Face
- Instatus
- Koyeb
- Lambda Cloud
LambdaTest
LangWatch
LlamaCloud
Logz.io
Lunary- Mezmo
NinjaOne- Nomad
Northflank- Oh Dear
- OVHcloud
Portkey- Probely (Snyk API & Web)
PromptLayer- Proxmox VE
PRTG Network Monitor- Qase
Raygun
Retell AI- Retool
Runpod- SecurityScorecard
- Semaphore CI
- SigNoz
- Socket
Spike.sh
Squadcast- SwaggerHub
- TeamCity
Tenable- Together AI
- Travis CI
UpGuard
Uptime.com
Vanta- Vapi
- Windmill
Zenduty- OpsLevel
Cortex- Auth0
- Clerk
WorkOS
Kandji
Automox
Huntress- HackerOne
SimpleMDM- AppSignal
Healthchecks.io
Rapid7 InsightVM- 1Password Events
- JFrog Artifactory
- Sauce Labs
Zenhub- Deepgram
- Replicate
Setup
How to connect
Connect withAPI key
- 1
Sign in at account.shodan.io and copy the key from Account Overview. Your Shodan plan decides what is allowed.
- 2
In Memtro, open Connections → Shodan and paste it into API key.
- 3
An administrator grants the actions by name, such as Request scan or Enable alert triggers, to the teams that may use them.
- 4
Ask what your office IP range exposes to the internet.
Also works from
Chat in the dashboard, the OpenAI-compatible API, scheduled jobs, and any MCP client: Claude Code, OpenCode, Cursor, Claude Desktop. The Shodan tools are the same everywhere.
FAQ
Questions
Can Memtro change anything in Shodan?+
Only when you ask, and only what it has been granted: create a network alert to monitor IPs or ranges; change the networks an alert monitors; delete a network alert (permanent); turn alert triggers on (notifications start); turn alert triggers off; ignore a service for an alert trigger; stop ignoring a service for an alert trigger; send an alert's notifications to an existing notifier; stop sending an alert to a notifier; request an on-demand scan of IPs (spends scan credits, probes those addresses). Every other tool reads, searches or lists. The Connections page labels the tools that act, an administrator grants each one by name to the teams that may use it, and a personal connection acts only after its owner allows it.
Who can use a Shodan connection?+
A personal connection serves only your own requests. A shared connection serves the organisation: everyone, or only the teams an admin chooses. Admins can always add shared connections; other members need the permission.
Does Memtro store my Shodan data?+
Credentials are encrypted at rest. Tool results are cached briefly so agent loops do not repeat identical calls, and the facts the model extracts are saved to your organisation's memory with provenance (system, record and link) so they can be checked and superseded.
How do I connect Shodan?+
API key. Sign in at account.shodan.io and copy the key from Account Overview. Your Shodan plan decides what is allowed.
Connect Shodan in a few minutes
Seven-day free trial, then one monthly price per organisation. Connectors, jobs and memory are never metered.