is_kev
(optional, default: false): If true, returns only CVEs with KEV flag set
How to use it
is_kev is exposed by the MCP Shodan MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the is_kev tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.
Install MCP Shodan
claude mcp add --transport stdio --env SHODAN_API_KEY=your-shodan-api-key shodan -- npx -y @burtthecoder/mcp-shodanOther tools in MCP Shodan (14)
(optional, default: false): If true, returns only the count of matching CPEs
(optional): CPE 2.3 identifier (format: cpe:2.3:part:vendor:product:version)
(required): CVE identifier in format CVE-YYYY-NNNNN (e.g., CVE-2021-44228)
(optional): End date for filtering CVEs (format: YYYY-MM-DDTHH:MM:SS)
(required): Array of hostnames to resolve
(required): IP address to lookup
(required): Array of IP addresses to lookup
(optional, default: 1000): Maximum number of CPEs to return
(optional, default: 10): Number of results to return
(required): Name of the product to search for
(required): Shodan search query
(optional, default: 0): Number of CPEs to skip (for pagination)
(optional, default: false): If true, sorts CVEs by EPSS score
(optional): Start date for filtering CVEs (format: YYYY-MM-DDTHH:MM:SS)