Shodan MCP server

What the model can do

Shodan internet-exposure search: what a given IP exposes (open ports, products, versions, known CVEs, hostnames, owner), searches and free counts with facets over Shodan's index, a domain's DNS records and subdomains, DNS lookups, network alerts, on-demand scans and the plan's credits; when you ask, can create, change and delete network alerts, turn their triggers on or off, ignore a service, route an alert to an existing notifier, and request a scan of your own IPs.

Reads

• shodan_hostWhat Shodan has seen on one IP address: hostnames, domains, organisation, ISP, ASN, OS, open ports, tags, known vulnerabilities (CVE ids)…
• shodan_searchSearches Shodan's index with its query syntax (e.g. org:"Acme" port:3389, net:203.0.113.0/24, product:nginx) and optional facets…
• shodan_countHow many services in Shodan's index match a query, with facet counts (e.g. facets "org,port,vuln:10"), without results.
• shodan_dns_domainA domain's subdomains and DNS records as Shodan has seen them (type, subdomain, value, last seen), 100 per page…
• shodan_dns_lookupResolves hostnames to IP addresses, or IP addresses back to hostnames, through Shodan.
• shodan_list_alertsShodan network alerts on this account (or one by id): name, monitored IPs and ranges, size, enabled triggers, attached notifier ids…
• shodan_list_scansOn-demand scans requested on this account (or one by id): id, status (SUBMITTING, QUEUE, PROCESSING, DONE), number of IPs, when.
• shodan_accountThe Shodan plan behind this key: plan name, query and scan credits left, monitored IPs and limits, and the notifiers set up on the account…

Acts, when you ask

These change something in Shodan. The model is told to use them only when you ask for exactly that, and each one is granted by name: per team on a shared connection, by the owner on a personal one.

• shodan_create_alertCreates a Shodan network alert that monitors the given IPs or CIDR ranges (they count against the plan's monitored-IP limit)…
• shodan_update_alert_networksReplaces the IPs and ranges a Shodan network alert monitors with the list given.
• shodan_delete_alertPermanently deletes a Shodan network alert; monitoring and its notifications stop.
• shodan_enable_alert_triggersTurns on triggers for a Shodan network alert (e.g. new_service, vulnerable, malware, open_database), so its notifiers…
• shodan_disable_alert_triggersTurns off triggers on a Shodan network alert, so they stop notifying.
• shodan_ignore_serviceTells one trigger of a Shodan alert to ignore one service (ip:port), so it no longer notifies about it.
• shodan_unignore_serviceStops ignoring a service (ip:port) for one trigger of a Shodan alert, so it notifies about it again.
• shodan_attach_notifierSends a Shodan alert's notifications to an existing notifier (default is the account email; others are email, Slack, PagerDuty…
• shodan_detach_notifierStops sending a Shodan alert's notifications to a notifier.
• shodan_request_scanAsks Shodan's crawlers to scan the given IPs or CIDR ranges now, which probes every port on those addresses from Shodan's network.

Connect it

First connect Shodan on Dashboard → Connections, then add Memtro to your client once. The Shodan tools appear alongside the tools of everything else you have connected; nothing is configured per connector.

claude plugin marketplace add memtro-org/claude-memtro
claude plugin install memtro@memtro --config api_key=sk-memtro-...

{
  "mcpServers": {
    "memtro": {
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

{
  "mcp": {
    "memtro": {
      "type": "remote",
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

Who may use it

The key identifies the person, and the server offers that person the tools they may use everywhere else in Memtro. A shared Shodan connection is used by the teams an administrator granted it to, tool by tool, on the Permissions page; a personal connection is used by its owner alone, and its tools that act stay off until the owner allows them. See Teams and permissions and Connectors.

Ask it like this

• › What does our office IP range expose to the internet?
• › How many of our IPs expose RDP?
• › Which known CVEs does Shodan list for 203.0.113.10?
• › Which subdomains of acme.example has Shodan seen?
• › How many scan credits do we have left?

Questions

Is this an official Shodan MCP server?

No. It is Memtro's MCP server with Memtro's Shodan connector behind it: the connector reads Shodan through its API with the credentials you connect on Dashboard → Connections, and Shodan publishes nothing here. The same endpoint carries every other system you connect and Memtro's memory tools.

What does it cost?

Nothing on top of Memtro. One price per organisation by its number of users, from $50 a month for up to 10 users after a 7-day free trial, with every connector, the MCP server, jobs and memory included. You bring your own model keys.

Can it change anything in Shodan?

Only when you ask, and only what it has been granted: create a network alert to monitor IPs or ranges; change the networks an alert monitors; delete a network alert (permanent); turn alert triggers on (notifications start); turn alert triggers off; ignore a service for an alert trigger; stop ignoring a service for an alert trigger; send an alert's notifications to an existing notifier; stop sending an alert to a notifier; request an on-demand scan of IPs (spends scan credits, probes those addresses). Every other tool reads, searches or lists. An administrator grants each acting tool by name per team, and a personal connection acts only after its owner allows it.

Which clients work?

Any MCP client that speaks Streamable HTTP: Claude Code, Cursor, Claude Desktop, OpenCode, Codex, Zed, Windsurf, Cline and the Anthropic and OpenAI SDKs. There is no local process to run; the server is remote and authenticated with your key.

Other MCP servers · Engineering and operations

• GitHub MCP server
• AWS CloudWatch MCP server
• Sentry MCP server
• ServiceNow MCP server
• Okta MCP server
• Twilio MCP server