Shodan MCP integration for AI agents.
Connect AI agents to Shodan through 7 structured actions, including count search results, resolve hostnames, and get api info. Review authentication, inputs…
- ACTION CONTRACTS
- 7
- AUTHENTICATION
- API key
- SOURCE STATUS
- Provider-backed
CATALOG SOURCE REVIEWED AUGUST 23, 2026 / ACTION NAMES AND SCHEMAS DERIVED FROM WORKING MACHINES PROVIDER SOURCE
CAPABILITY PROFILE
What the Shodan integration exposes
The Shodan Agent App exposes 7 provider-backed actions for security and data work. Its current contract lets an authorized agent count shodan hosts matching a query and optionally return facet aggregations, resolve hostnames to ip addresses with the shodan dns resolve endpoint, and get api account information and remaining credits from shodan. These operations are called through Working Machines as typed capabilities rather than through browser navigation or copied UI steps.
A connection uses API key. Before execution, the agent can inspect the selected action, its required fields, declared scopes, and expected output contract. Provider credentials remain inside the Working Machines runtime; the calling agent receives the capability and its structured result, not the underlying secret.
For reliable operation, start with the narrowest action that satisfies the task, resolve stable provider identifiers before changing state, and validate the returned object or status after execution. Availability still depends on the connected Shodan account, granted provider permissions, workspace policy, region, plan, and upstream API behavior.
VERIFIED ACTION SAMPLE
Real Shodan capabilities.
Showing 7 of 7 actions. Risk labels are conservative signals based on operation names, not substitutes for provider documentation or runtime policy.
count_search_resultsREADCount Shodan hosts matching a query and optionally return facet aggregations.
INPUTS: query / facets
resolve_hostnamesREVIEWResolve hostnames to IP addresses with the Shodan DNS resolve endpoint.
INPUTS: hostnames
get_api_infoREADGet API account information and remaining credits from Shodan.
get_domain_infoREADGet DNS domain information and known subdomains from Shodan.
INPUTS: domain
get_hostREADGet Shodan host details for one IP address.
INPUTS: ip / history / minify
reverse_dns_lookupREADReverse-resolve IP addresses to hostnames with the Shodan DNS reverse endpoint.
INPUTS: ips
search_hostsREADSearch Shodan hosts with a query string and optional facet aggregation.
INPUTS: query / facets / page / minify
INPUT CONTRACTS
Know what the action needs before it runs.
count_search_results
queryREQUIRED- Search query string passed to the Shodan host count endpoint.
facetsOPTIONAL- Facet aggregation string such as org:5,country:3.
resolve_hostnames
hostnamesOPTIONAL- Hostnames to resolve with Shodan.
get_domain_info
domainOPTIONAL- Domain name to inspect in the Shodan DNS endpoint.
get_host
ipREQUIRED- IPv4 or IPv6 address to inspect in Shodan.
historyOPTIONAL- Whether to include historical banners for the host.
minifyOPTIONAL- Whether to request a minified host payload from Shodan.
PROVIDER-SPECIFIC WORKFLOWS
Jobs this Agent App can support
Inspect Count Search Results
Count Shodan hosts matching a query and optionally return facet aggregations. Use this as a bounded discovery step, retain the returned identifier, and avoid expanding the read beyond the task's stated scope.
count_search_resultsVerify with Get Api Info
Get API account information and remaining credits from Shodan. Compare the returned provider state with the intended outcome and preserve stable IDs or canonical links in the run record.
get_api_infoSAFETY BOUNDARY
Operate Shodan with explicit limits
- Authorize Shodan with API key and grant only the provider access required by the selected actions.
- The current action names appear read-oriented, but returned Shodan data may still be sensitive and should be minimized before it enters model context.
- Do not infer permission from catalog visibility. Workspace policy, connection identity, and upstream authorization still govern execution.
- No provider scope string is declared on the sampled actions. Verify the connected account's actual permissions in Shodan rather than assuming unrestricted access.
- After a call, inspect the structured result and execution record before reporting that the Shodan task completed successfully.
CONNECTION MODEL
API key
Shodan API key passed as the key query parameter. Get it from your account page at https://account.shodan.io.
Working Machines stores provider credentials behind the execution boundary. An agent can use an authorized connection identity, but catalog discovery alone does not reveal OAuth tokens, API keys, or provider secrets.
- READ SIGNALS
- 6
- WRITE SIGNALS
- 0
- HIGH IMPACT
- 0
- REVIEW SIGNALS
- 1
EVIDENCE AND AVAILABILITY
Provider reference
Action names, input fields, authentication types, and counts on this page are generated from the Working Machines provider catalog. Provider behavior, quotas, object semantics, account eligibility, and regional availability remain governed by Shodan.