Loading ToolBench
MCP server for scanning your own infrastructure and searching Shodan's internet-wide data
Strong naming conventions (all verb_noun pattern: shodan_my_ip, shodan_host_lookup, etc.). Descriptions are well-written (avg 180 chars, within 10-1024 baseline) and explain WHAT, WHEN, and WHY. All 11 tools have Zod schemas with type definitions and parameter descriptions. Tool annotations (readOnlyHint) correctly applied to all tools. Key gaps: no output schema documentation (tools return JSON.stringify of API responses without field descriptions), no pagination guidance for search results, and error handling lacks recovery hints. Parameters are well-constrained (e.g., page min(1), limit max(1000)) but some tools accept unbounded strings (query, domain, cpe23) without format validation.
Show this API key's plan and remaining query/scan credits. Check this before running credit-consuming operations.
Fetch details for a specific CVE from Shodan's CVEDB, including CVSS score, affected CPEs, and how many internet-facing hosts Shodan currently sees running vulnerable versions.
List recent/known CVEs affecting a given CPE (product+version), e.g. 'cpe:2.3:a:apache:log4j'. Useful for tracking what's currently going on for a specific technology.
Look up subdomains and DNS entries Shodan has seen for a domain. Use this to map out your own domain's exposed surface.
Resolve one or more hostnames to their IP addresses.
Look up the hostnames associated with one or more IP addresses.
No output schema documentation. Tools return raw API responses (JSON.stringify) without documenting field structure, types, or which fields are safe for downstream tool chaining. LLMs cannot plan multi-step workflows or extract required IDs.
Search tools (shodan_search, shodan_host_count) accept unbounded query strings without format validation or injection guards. No guidance on Shodan query syntax or common mistakes. LLMs may pass malformed queries.
No pagination or result-limiting guidance. shodan_search can return hundreds of results; no mention of max results, next_cursor, or token cost. Large responses risk context window exhaustion.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 64 | 2026-07-28+ | v2 |
Count how many hosts match a Shodan search query without spending query credits. Use this for quick world-scale stats (e.g. how many hosts expose a given CVE) before running a full search.
Look up everything Shodan knows about a single IP address: open ports, banners, detected products/versions, and known vulnerabilities. Use this to check what your own infrastructure exposes.
Returns the public IP address Shodan sees this API key's requests coming from. Use this as the starting point for scanning your own infrastructure.
Search Shodan's database of internet-connected devices using Shodan search syntax (e.g. 'apache country:DE', 'net:203.0.113.0/24', 'vuln:CVE-2021-44228'). Use this for general reconnaissance and world-scale intelligence gathering.
List the search filters Shodan supports (e.g. country, port, net, vuln, product). Use this before writing a shodan_search query to confirm the right filter name.
Error handling is minimal. shodanGet/cvedbGet throw generic 'Shodan API error' messages without recovery guidance. LLMs cannot distinguish retryable (rate limit) from fatal (invalid API key) errors.
DNS tools (shodan_dns_resolve, shodan_dns_reverse) accept comma-separated strings but lack format validation or examples. Descriptions are brief (75 chars) and do not explain expected input format or output structure.