Integration

Shodan integration

Shodan is a search engine for Internet-connected devices. Look up the open services, banners, location and network owner Shodan has recorded for an IP address, search or count its database with Shodan query filters and facets, list the subdomains and DNS records it knows for a domain, resolve hostnames and IPs, manage network alerts that watch your IP ranges and the notifiers they use, browse saved queries, bulk datasets and your organization, and read your plan's remaining credits. Searches with a filter, result pages past the first and domain lookups spend query credits. Host and search results describe third parties' Internet-facing machines and can contain personal data. Left out: requesting on-demand scans (they probe third-party hosts and spend scan credits), creating or editing notifiers (they take Slack, Telegram, Gitter or PagerDuty secrets) and the two utility routes that echo the caller's own IP and headers. Authentication is your Shodan API key (Account page), sent as the key query parameter.

Connect Shodan How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Shodan.Built from the 38 Shodan tools below, on the connection you add once.

What you can do with Shodan

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Each badge shows the default agent permission of an endpoint (allowed: an agent calls it without asking; ask first: you are asked before an agent calls it, when the agent or chat asks permission for sensitive actions; never: no agent may call it), which every user can change endpoint by endpoint in their credential settings.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Alert, 5 operations

create_alertCreate alertPOSTAgents: ask firstCreates a network alert that watches IP addresses or ranges for services Shodan discovers. It counts against the plan's monitored IPs; enable triggers with enable_alert_triggers to get notified.
delete_alertDelete alertDELETEAgents: ask firstPermanently deletes a network alert: Shodan stops monitoring its IPs and sends no more notifications for it.
get_alertGet alertGETAgents: ask firstReturns one network alert: name, monitored IPs or ranges, enabled triggers and their ignored services, notifiers, size, creation date and expiry.
list_alertsList alertsGETAgents: ask firstLists the network alerts active on the account: name, monitored IPs or ranges, enabled triggers, notifiers, size and expiry.
update_alert_networksUpdate alert networksPOSTAgents: ask firstReplaces the IPs or ranges a network alert monitors with the list sent. Read the alert with get_alert first and send every IP or range to keep.

Alert trigger, 3 operations

disable_alert_triggersDisable alert triggersDELETEAgents: ask firstDisables one or more triggers on a network alert: matching services are no longer notified.
enable_alert_triggersEnable alert triggersPUTAgents: ask firstEnables one or more triggers on a network alert: services matching them in the monitored range are then notified through the alert's notifiers.
list_alert_triggersList alert triggersGETAgents: ask firstLists the triggers a network alert can enable (for example malware, open_database, iot, uncommon): name, the search rule it applies and a description.

Host, 3 operations

count_hostsCount hostsGETAgents: ask firstCounts the hosts matching a Shodan search query, with optional facet breakdowns (top values of a property), without returning results. Spends no query credits.
get_hostGet hostGETAgents: ask firstReturns everything Shodan has recorded for an IP address: owner, location, hostnames, domains, open ports and one banner per service found. IP owners and locations can be personal data.
search_hostsSearch hostsGETAgents: ask firstSearches Shodan's banners with the website's query syntax, 100 results per page, plus optional facet breakdowns. A query with a filter, or any page past 1, spends 1 query credit (per 100 results past page 1).

Notifier, 3 operations

delete_notifierDelete notifierDELETEAgents: ask firstPermanently deletes a notifier; alerts using it stop sending notifications through it.
get_notifierGet notifierGETAgents: ask firstReturns one notifier: id, provider and description. Provider secrets such as webhook URLs and tokens are not returned; an email or phone notifier shows its address.
list_notifiersList notifiersGETAgents: ask firstLists the notifiers on the account (where alert notifications go): id, provider and description. Provider secrets such as webhook URLs and tokens are not returned; an email or phone notifier shows its address.

Alert ignored service, 2 operations

ignore_alert_serviceIgnore alert servicePUTAgents: ask firstIgnores one service (IP and port) for a trigger on a network alert: it no longer causes notifications for that trigger.
unignore_alert_serviceUnignore alert serviceDELETEAgents: ask firstStops ignoring a service (IP and port) for a trigger on a network alert, so it causes notifications again.

Alert notifier, 2 operations

add_alert_notifierAdd alert notifierPUTAgents: ask firstAttaches a notifier to a network alert so its enabled triggers send notifications through it. Every account has a default email notifier.
remove_alert_notifierRemove alert notifierDELETEAgents: ask firstDetaches a notifier from a network alert: the alert stops sending notifications through it.

Organization member, 2 operations

add_organization_memberAdd organization memberPUTAgents: ask firstAdds a Shodan user to your organization and upgrades their account (Enterprise). This grants them the organization's access. Set notify to true to email them about it.
remove_organization_memberRemove organization memberDELETEAgents: ask firstRemoves a member from your organization and downgrades their account (Enterprise): they lose the organization's access.

Saved query, 2 operations

list_saved_queriesList saved queriesGETAgents: ask firstLists search queries that Shodan users have saved and shared publicly, 10 per page: title, query, description, tags, votes and date.
search_saved_queriesSearch saved queriesGETAgents: ask firstSearches the public directory of saved Shodan search queries, 10 per page: title, query, description, tags, votes and date.

Scan, 2 operations

get_scanGet scanGETAgents: ask firstReturns the progress of an on-demand scan submitted on the account: status (SUBMITTING, QUEUE, PROCESSING or DONE), number of IPs and creation date.
list_scansList scansGETAgents: ask firstLists the on-demand scans submitted on the account: id, status, size in IPs, creation date, last status check and scan credits left.

Account profile, 1 operation

get_account_profileGet account profileGETAgents: ask firstReturns the Shodan account behind the API key: whether it is a paid member, its remaining credits, display name and creation date.

Api plan, 1 operation

get_api_plan_infoGet api plan infoGETAgents: ask firstReturns the API plan behind the key and what is left of it: query credits, scan credits, monitored IPs, unlocked results and the plan's monthly limits (-1 means unlimited).

Dataset, 1 operation

list_datasetsList datasetsGETAgents: ask firstLists the bulk datasets the account can download (Enterprise or bulk data plans): name, update scope (daily or monthly) and description.

Dataset file, 1 operation

list_dataset_filesList dataset filesGETAgents: ask firstLists the downloadable files of one bulk dataset: file name, size in bytes, SHA-1, timestamp and download URL.

Domain, 1 operation

get_domain_infoGet domain infoGETAgents: ask firstLists the subdomains and DNS records (A, AAAA, CNAME, NS, SOA, MX, TXT) Shodan knows for a domain, 100 per page, with when each was last seen. Spends 1 query credit per call.

Hostname, 1 operation

resolve_hostnamesResolve hostnamesGETAgents: ask firstResolves hostnames to IP addresses. The answer maps each hostname to its IP address.

Ip address, 1 operation

reverse_lookup_ipsReverse lookup ipsGETAgents: ask firstLooks up the hostnames defined for IP addresses (reverse DNS). The answer maps each IP address to a list of its hostnames.

Notifier provider, 1 operation

list_notifier_providersList notifier providersGETAgents: ask firstLists the notification providers a notifier can use (email, phone, slack, telegram, webhook, pagerduty, gitter) and the settings each one requires.

Organization, 1 operation

get_organizationGet organizationGETAgents: ask firstReturns your organization (Enterprise accounts): name, creation date, admins and members with their usernames and email addresses (personal data), the upgrade type, authorized domains and id.

Port, 1 operation

list_portsList portsGETAgents: ask firstLists the port numbers Shodan's crawlers look for on the Internet.

Saved query tag, 1 operation

list_saved_query_tagsList saved query tagsGETAgents: ask firstLists the most popular tags of saved Shodan search queries, with how many queries use each.

Search facet, 1 operation

list_search_facetsList search facetsGETAgents: ask firstLists the property names that can be used as facets in search_hosts and count_hosts (for example country, org, port).

Search filter, 1 operation

list_search_filtersList search filtersGETAgents: ask firstLists the filter names that can be used in a Shodan search query (for example country, port, org, product).

Search query, 1 operation

get_search_query_tokensGet search query tokensGETAgents: ask firstBreaks a Shodan search query into its parts: the free text, the filters used and their values, and any parse errors. Use it to check a query before searching.

Use Shodan from Claude Code, Cursor or Codex

Connect Shodan in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Shodan operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Shodan

Create your workspace
Sign up free. Nothing to install.
Connect Shodan once
Add your Shodan connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.