shodan-internetdb

v0.1.0Verified publisher

Looks up an IP address in Shodan's free InternetDB: open ports, host names, software, tags and known CVEs

Run

TerminalAgent

Through ot mcp, an agent calls run_tool with this; ot asks you before anything that goes online or touches a target. Set it up: ot mcp install claude (or cursor, vscode, codex, gemini).

{"tool":"osintverse-community/shodan-internetdb","target":"8.8.8.8","input_type":"ip"}

Or just say: "Run osintverse-community/shodan-internetdb on 8.8.8.8 with OTInstaller." The registry's read-only MCP server at api.otinstaller.com/mcp can find tools without installing anything.

ot run osintverse-community/shodan-internetdb ip:8.8.8.8 --format table

ot install osintverse-community/shodan-internetdb

Docker image in a read-only container · talks to internetdb.shodan.io · no key · up to 1 min. The first ot run installs the tool after asking once. The example value is the registry's own test input, so this command has run. Drop --format table for JSON.

Don't have ot? Install it in one line

macOS / LinuxWindows

curl -fsSL https://get.otinstaller.com/ot | sh

What this script does

Downloads the latest ot release for your machine from GitHub Releases.
Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
Puts ot in /usr/local/bin or ~/.local/bin. Nothing else is written. Read the script.

irm https://get.otinstaller.com/ot.ps1 | iex

What this script does

Downloads the latest ot release for your machine from GitHub Releases.
Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
Puts ot in %LOCALAPPDATA%\Programs\ot, and adds it to your PATH. Nothing else is written. Read the script.

Evidence

Security tab →

Pinnedimage sha256:8527f622…69fec1. The same bytes on every install; ot pulls by digest, never by tag.
Signedby https://github.com/osintverse-community/shodan-internetdb/.github/workflows/otinstaller-release.yml@refs/heads/main via token.actions.githubusercontent.com, verified by the registry on 24 Oct 2026. ot checks the same identity before every install and refuses another signer.
Scanned24 Oct 2026: 0 critical, 44 high, 63 medium, 62 low vulnerabilities; 0 embedded secrets, 0 malware heuristics; SBOM with 89 packages.
Workssmoke test passed on 24 Oct 2026 (exit 0 in 6.0 s, offline sandbox); the nightly health check has not run yet.
Backed upa copy of this image is on the registry's mirror. If the original registry refuses it, ot pulls the same digest from the mirror and checks the same signature.
Reviewedosintverse-community is a verified publisher: the registry confirmed who runs it, and a person reviewed its first release against the acceptable-use rules.

From the community

Issues →

Not health-checked yet; 0.1.0 came out today; nobody has said yet whether it works.

0.1.0 is in its first week. Nobody has said whether it works yet.

Used 0.1.0?It's broken for me

What you get back

Result envelope →

{
  "envelope": 1,
  "tool": "osintverse-community/shodan-internetdb@0.1.0",
  "runtime": "docker",
  "input": {
    "ip": "8.8.8.8"
  },
  "started_at": "2026-10-24T19:28:12Z",
  "exit_code": 0,
  "entities": [
    {
      "type": "ip",
      "value": "8.8.8.8",
      "source": "shodan-internetdb",
      "confidence": "high",
      "attrs": {
        "ports": [
          53,
          443
        ],
        "cpes": [],
        "tags": [],
        "vulns": [],
        "hostnames": [
          "dns.google",
          "direct.suntory.co.jp"
        ],
        "link": "https://www.shodan.io/host/8.8.8.8"
      }
    },
    {
      "type": "domain",
      "value": "dns.google",
      "source": "shodan-internetdb",
      "confidence": "medium",
      "attrs": {
        "relation": "host name seen on the address",
        "ip": "8.8.8.8"
      }
    },
    {
      "type": "domain",
      "value": "direct.suntory.co.jp",
      "source": "shodan-internetdb",
      "confidence": "medium",
      "attrs": {
        "relation": "host name seen on the address",
        "ip": "8.8.8.8"
      }
    }
  ],
  "warnings": []
}

Recorded from the registry's own run of version 0.1.0 on its test input, 24 Oct 2026. --format table to read it; ot extract and ot auto to continue.

shodan-internetdb

Looks up an IP address in Shodan's InternetDB, a free summary of what Shodan's internet-wide scans last saw on an address: its open ports, the host names pointing at it, the software it runs (as CPEs), tags such as cdn, vpn or self-signed, and the known vulnerabilities (CVEs) that software has. No key or account is needed. Only Shodan's database is read, so the target is not contacted.

ot run osintverse-community/shodan-internetdb --ip 8.8.8.8

Inputs

Input	Required
`ip`	yes	IPv4 or IPv6 address

Keys

None. InternetDB is free for non-commercial use; Shodan asks anyone using it to make money to buy an enterprise license.

Notes

InternetDB is updated about once a week and keeps no banners or history, so a port may have closed since. The CVEs are inferred from software versions, not tested, and a patched build that keeps its version number still shows them. An address Shodan has no information on, and a private or reserved address, give no entities and a note on stderr.

Next steps

See the services' banners and history with osintverse-community/shodan-host (needs a Shodan key), or check the address's reputation with osintverse-community/abuseipdb.

Development

python -m unittest
ot validate

Releases are built, signed and published by the otinstaller release workflow (Actions tab, with the version to release).

License

MIT

What next

shodan-internetdb finds ip, domain. Tools that take those:

ip → 10 tools domain → 10 tools ot auto, with a saved result

Other ip address tools

All ip address tools →

Alternatives to shodan-internetdb that also take an ip address; ot auto runs every installed one on the same value.