A Model Context Protocol (MCP) server for interacting with the Shodan API. This server provides a WebSocket interface for querying Shodan's database of internet-connected devices and vulnerabilities.
Server has 6 tools with basic schemas and descriptions, but significant quality gaps. All tools have descriptions (10-60 chars, mostly under 20 chars baseline), which is below the 194-char average for A+ tools. Input schemas are present but minimal, only 1 required parameter per tool, no enums, no constraints, no output schemas documented. Parameter descriptions are terse (e.g., 'The IP address to query'). No error recovery guidance, no pagination support despite search tool returning potentially large result sets, no tool annotations (readOnlyHint missing despite all being READ_ONLY). Tool names follow verb_noun pattern (good), but descriptions lack WHEN/WHY context. No documented output structure means LLMs cannot plan downstream calls or extract chaining IDs.
Retrieve information about a specific CVE ID
Retrieve information about a specific CVE ID from cvedb.shodan.io
Perform DNS lookups for a given domain
Get information about a specific IP address
Track vulnerabilities associated with a specific IP address
Search Shodan for devices matching a query
Descriptions are too short (10-60 chars) and lack WHEN/WHY context. Baseline for A+ tools is 194 chars. Examples: 'Get information about a specific IP address' (43 chars) does not explain when to call get_ip_info vs get_vulnerabilities, or what fields are returned.
No output schemas documented. LLMs cannot infer what fields to expect from responses, preventing downstream tool chaining and forcing wasteful discovery calls. E.g., does get_ip_info return 'ip_address' or 'ip'? Does search return 'total_count' or 'count'?
search tool returns raw JSON from Shodan API with no pagination, limit, or result count. Large result sets will blow context window. No documented limit or guidance on handling 100+ results.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 42 | 2026-07-28+ | v2 |
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). All 6 tools are READ_ONLY but this is not declared in the tool definition, forcing LLMs to infer safety from descriptions alone.
Error handling returns raw exception messages ('Shodan API error: ...') with no recovery guidance. LLMs cannot determine if error is retryable, user-fixable, or fatal. No actionable next steps provided.