@burtthecoder/mcp-shodan 1.0.12 → 1.0.13

package/README.md

@@ -1,6 +1,6 @@
 # Shodan MCP Server
 
-A Model Context Protocol (MCP) server for querying the [Shodan API](https://shodan.io) and [Shodan CVEDB](https://cvedb.shodan.io). This server provides tools for IP lookups, device searches, DNS lookups, vulnerability queries, CPE lookups, and more. It is designed to integrate seamlessly with MCP-compatible applications like [Claude Desktop](https://claude.ai).
+A Model Context Protocol (MCP) server for querying the [Shodan API](https://shodan.io) and [Shodan CVEDB](https://cvedb.shodan.io). This server provides comprehensive access to Shodan's network intelligence and security services, including IP reconnaissance, DNS operations, vulnerability tracking, and device discovery. All tools provide structured, formatted output for easy analysis and integration.
 
 ## Quick Start (Recommended)
 
@@ -58,45 +58,78 @@ npm run build
 
 ## Features
 
-- **IP Lookup**: Retrieve detailed information about an IP address
-- **Search**: Search for devices on Shodan matching specific queries
-- **Ports**: Get a list of ports that Shodan is scanning
-- **CVE Lookup**: Fetch detailed information about specific CVEs using Shodan's CVEDB
-- **CPE Lookup**: Search for Common Platform Enumeration (CPE) entries by product name
-- **CVEs by Product**: Search for all CVEs affecting a specific product or CPE
-- **DNS Lookup**: Resolve hostnames to IP addresses
+- **Network Reconnaissance**: Query detailed information about IP addresses, including open ports, services, and vulnerabilities
+- **DNS Operations**: Forward and reverse DNS lookups for domains and IP addresses
+- **Vulnerability Intelligence**: Access to Shodan's CVEDB for detailed vulnerability information, CPE lookups, and product-specific CVE tracking
+- **Device Discovery**: Search Shodan's database of internet-connected devices with advanced filtering
 
 ## Tools
 
 ### 1. IP Lookup Tool
 - Name: `ip_lookup`
-- Description: Retrieve detailed information about an IP address
+- Description: Retrieve comprehensive information about an IP address, including geolocation, open ports, running services, SSL certificates, hostnames, and cloud provider details if available
 - Parameters:
   * `ip` (required): IP address to lookup
-
-### 2. Search Tool
-- Name: `search`
-- Description: Search for devices on Shodan
+- Returns:
+  * IP Information (address, organization, ISP, ASN)
+  * Location (country, city, coordinates)
+  * Services (ports, protocols, banners)
+  * Cloud Provider details (if available)
+  * Associated hostnames and domains
+  * Tags
+
+### 2. Shodan Search Tool
+- Name: `shodan_search`
+- Description: Search Shodan's database of internet-connected devices
 - Parameters:
   * `query` (required): Shodan search query
   * `max_results` (optional, default: 10): Number of results to return
+- Returns:
+  * Search summary with total results
+  * Country-based distribution statistics
+  * Detailed device information including:
+    - Basic information (IP, organization, ISP)
+    - Location data
+    - Service details
+    - Web server information
+    - Associated hostnames and domains
 
 ### 3. CVE Lookup Tool
 - Name: `cve_lookup`
-- Description: Fetch detailed information about CVEs using Shodan's CVEDB
+- Description: Query detailed vulnerability information from Shodan's CVEDB
 - Parameters:
   * `cve` (required): CVE identifier in format CVE-YYYY-NNNNN (e.g., CVE-2021-44228)
 - Returns:
-  * CVE details including:
-    - CVSS v2 and v3 scores
-    - EPSS score and ranking
+  * Basic Information (ID, published date, summary)
+  * Severity Scores:
+    - CVSS v2 and v3 with severity levels
+    - EPSS probability and ranking
+  * Impact Assessment:
     - KEV status
-    - Proposed action
-    - Ransomware campaign information
-    - Affected products (CPEs)
-    - References
+    - Proposed mitigations
+    - Ransomware associations
+  * Affected products (CPEs)
+  * References
+
+### 4. DNS Lookup Tool
+- Name: `dns_lookup`
+- Description: Resolve domain names to IP addresses using Shodan's DNS service
+- Parameters:
+  * `hostnames` (required): Array of hostnames to resolve
+- Returns:
+  * DNS resolutions mapping hostnames to IPs
+  * Summary of total lookups and queried hostnames
 
-### 4. CPE Lookup Tool
+### 5. Reverse DNS Lookup Tool
+- Name: `reverse_dns_lookup`
+- Description: Perform reverse DNS lookups to find hostnames associated with IP addresses
+- Parameters:
+  * `ips` (required): Array of IP addresses to lookup
+- Returns:
+  * Reverse DNS resolutions mapping IPs to hostnames
+  * Summary of total lookups and results
+
+### 6. CPE Lookup Tool
 - Name: `cpe_lookup`
 - Description: Search for Common Platform Enumeration (CPE) entries by product name
 - Parameters:
@@ -108,9 +141,9 @@ npm run build
   * When count is true: Total number of matching CPEs
   * When count is false: List of CPEs with pagination details
 
-### 5. CVEs by Product Tool
+### 7. CVEs by Product Tool
 - Name: `cves_by_product`
-- Description: Search for CVEs affecting a specific product or CPE
+- Description: Search for vulnerabilities affecting specific products or CPEs
 - Parameters:
   * `cpe23` (optional): CPE 2.3 identifier (format: cpe:2.3:part:vendor:product:version)
   * `product` (optional): Name of the product to search for CVEs
@@ -125,14 +158,13 @@ npm run build
   * Must provide either cpe23 or product, but not both
   * Date filtering uses published time of CVEs
 - Returns:
-  * When count is true: Total number of matching CVEs
-  * When count is false: List of CVEs with pagination details and query parameters
-
-### 6. DNS Lookup Tool
-- Name: `dns_lookup`
-- Description: Resolve hostnames to IP addresses
-- Parameters:
-  * `hostnames` (required): Array of hostnames to resolve
+  * Query information
+  * Results summary with pagination details
+  * Detailed vulnerability information including:
+    - Basic information
+    - Severity scores
+    - Impact assessments
+    - References
 
 ## Requirements
 
@@ -143,15 +175,44 @@ npm run build
 
 ### API Key Issues
 
-If you see API key related errors:
+If you see API key related errors (e.g., "Request failed with status code 401"):
 
 1. Verify your API key:
-   - Should be a valid Shodan API key
-   - No extra spaces or quotes around the key
-   - Must be from your Shodan account settings
-2. After any configuration changes:
-   - Save the config file
-   - Restart Claude Desktop
+   - Must be a valid Shodan API key from your [account settings](https://account.shodan.io/)
+   - Ensure the key has sufficient credits/permissions for the operation
+   - Check for extra spaces or quotes around the key in the configuration
+   - Verify the key is correctly set in the SHODAN_API_KEY environment variable
+
+2. Common Error Codes:
+   - 401 Unauthorized: Invalid API key or missing authentication
+   - 402 Payment Required: Out of query credits
+   - 429 Too Many Requests: Rate limit exceeded
+
+3. Configuration Steps:
+   a. Get your API key from [Shodan Account](https://account.shodan.io/)
+   b. Add it to your configuration file:
+      ```json
+      {
+        "mcpServers": {
+          "shodan": {
+            "command": "mcp-shodan",
+            "env": {
+              "SHODAN_API_KEY": "your-actual-api-key-here"
+            }
+          }
+        }
+      }
+      ```
+   c. Save the config file
+   d. Restart Claude Desktop
+
+4. Testing Your Key:
+   - Try a simple query first (e.g., dns_lookup for "google.com")
+   - Check your [Shodan account dashboard](https://account.shodan.io/) for credit status
+   - Verify the key works directly with curl:
+     ```bash
+     curl "https://api.shodan.io/dns/resolve?hostnames=google.com&key=your-api-key"
+     ```
 
 ### Module Loading Issues
 
@@ -180,6 +241,7 @@ The server includes comprehensive error handling for:
 
 ## Version History
 
+- v1.0.12: Added reverse DNS lookup and improved output formatting
 - v1.0.7: Added CVEs by Product search functionality and renamed vulnerabilities tool to cve_lookup
 - v1.0.6: Added CVEDB integration for enhanced CVE lookups and CPE search functionality
 - v1.0.0: Initial release with core functionality

package/build/index.js

@@ -33,7 +33,7 @@ function logToFile(message) {
 const IpLookupArgsSchema = z.object({
     ip: z.string().describe("The IP address to query."),
 });
-const SearchArgsSchema = z.object({
+const ShodanSearchArgsSchema = z.object({
     query: z.string().describe("Search query for Shodan."),
     max_results: z
         .number()
@@ -49,6 +49,9 @@ const CVELookupArgsSchema = z.object({
 const DnsLookupArgsSchema = z.object({
     hostnames: z.array(z.string()).describe("List of hostnames to resolve."),
 });
+const ReverseDnsLookupArgsSchema = z.object({
+    ips: z.array(z.string()).describe("List of IP addresses to perform reverse DNS lookup on."),
+});
 const CpeLookupArgsSchema = z.object({
     product: z.string().describe("The name of the product to search for CPEs."),
     count: z.boolean().optional().default(false).describe("If true, returns only the count of matching CPEs."),
@@ -151,7 +154,14 @@ server.setRequestHandler(InitializeRequestSchema, async (request) => {
             name: "shodan-mcp",
             version: "1.0.0",
         },
-        instructions: "This server provides tools for querying Shodan, including IP lookups, searches, CVE lookups, CPE lookups, and CVE searches by product/CPE.",
+        instructions: `This MCP server provides comprehensive access to Shodan's network intelligence and security services:
+
+- Network Reconnaissance: Query detailed information about IP addresses, including open ports, services, and vulnerabilities
+- DNS Operations: Forward and reverse DNS lookups for domains and IP addresses
+- Vulnerability Intelligence: Access to Shodan's CVEDB for detailed vulnerability information, CPE lookups, and product-specific CVE tracking
+- Device Discovery: Search Shodan's database of internet-connected devices with advanced filtering
+
+Each tool provides structured, formatted output for easy analysis and integration.`,
     };
 });
 // Register Tools
@@ -159,34 +169,39 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
     const tools = [
         {
             name: "ip_lookup",
-            description: "Retrieve information about an IP address.",
+            description: "Retrieve comprehensive information about an IP address, including geolocation, open ports, running services, SSL certificates, hostnames, and cloud provider details if available. Returns service banners and HTTP server information when present.",
             inputSchema: zodToJsonSchema(IpLookupArgsSchema),
         },
         {
-            name: "search",
-            description: "Search for devices on Shodan.",
-            inputSchema: zodToJsonSchema(SearchArgsSchema),
+            name: "shodan_search",
+            description: "Search Shodan's database of internet-connected devices. Returns detailed information about matching devices including services, vulnerabilities, and geographic distribution. Supports advanced search filters and returns country-based statistics.",
+            inputSchema: zodToJsonSchema(ShodanSearchArgsSchema),
         },
         {
             name: "cve_lookup",
-            description: "Retrieve vulnerability information for a CVE. Use format: CVE-YYYY-NNNNN (e.g., CVE-2021-44228)",
+            description: "Query detailed vulnerability information from Shodan's CVEDB. Returns comprehensive CVE details including CVSS scores (v2/v3), EPSS probability and ranking, KEV status, proposed mitigations, ransomware associations, and affected products (CPEs).",
             inputSchema: zodToJsonSchema(CVELookupArgsSchema),
         },
         {
             name: "dns_lookup",
-            description: "Perform DNS lookups using Shodan.",
+            description: "Resolve domain names to IP addresses using Shodan's DNS service. Supports batch resolution of multiple hostnames in a single query. Returns IP addresses mapped to their corresponding hostnames.",
             inputSchema: zodToJsonSchema(DnsLookupArgsSchema),
         },
         {
             name: "cpe_lookup",
-            description: "Search for Common Platform Enumeration (CPE) entries by product name.",
+            description: "Search for Common Platform Enumeration (CPE) entries by product name in Shodan's CVEDB. Supports pagination and can return either full CPE details or just the total count. Useful for identifying specific versions and configurations of software and hardware.",
             inputSchema: zodToJsonSchema(CpeLookupArgsSchema),
         },
         {
             name: "cves_by_product",
-            description: "Search for CVEs affecting a specific product or CPE. Provide either product name or CPE 2.3 identifier.",
+            description: "Search for vulnerabilities affecting specific products or CPEs. Supports filtering by KEV status, sorting by EPSS score, date ranges, and pagination. Can search by product name or CPE 2.3 identifier. Returns detailed vulnerability information including severity scores and impact assessments.",
             inputSchema: zodToJsonSchema(CVEsByProductArgsSchema),
         },
+        {
+            name: "reverse_dns_lookup",
+            description: "Perform reverse DNS lookups to find hostnames associated with IP addresses. Supports batch lookups of multiple IP addresses in a single query. Returns all known hostnames for each IP address, with clear indication when no hostnames are found.",
+            inputSchema: zodToJsonSchema(ReverseDnsLookupArgsSchema),
+        },
     ];
     logToFile("Registered tools.");
     return { tools };
@@ -203,17 +218,55 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                     throw new Error("Invalid ip_lookup arguments");
                 }
                 const result = await queryShodan(`/shodan/host/${parsedIpArgs.data.ip}`, {});
+                // Format the response in a user-friendly way
+                const formattedResult = {
+                    "IP Information": {
+                        "IP Address": result.ip_str,
+                        "Organization": result.org,
+                        "ISP": result.isp,
+                        "ASN": result.asn,
+                        "Last Update": result.last_update
+                    },
+                    "Location": {
+                        "Country": result.country_name,
+                        "City": result.city,
+                        "Coordinates": `${result.latitude}, ${result.longitude}`,
+                        "Region": result.region_code
+                    },
+                    "Services": result.ports.map((port) => {
+                        const service = result.data.find((d) => d.port === port);
+                        return {
+                            "Port": port,
+                            "Protocol": service?.transport || "unknown",
+                            "Service": service?.data?.trim() || "No banner",
+                            ...(service?.http ? {
+                                "HTTP": {
+                                    "Server": service.http.server,
+                                    "Title": service.http.title,
+                                }
+                            } : {})
+                        };
+                    }),
+                    "Cloud Provider": result.data[0]?.cloud ? {
+                        "Provider": result.data[0].cloud.provider,
+                        "Service": result.data[0].cloud.service,
+                        "Region": result.data[0].cloud.region
+                    } : "Not detected",
+                    "Hostnames": result.hostnames || [],
+                    "Domains": result.domains || [],
+                    "Tags": result.tags || []
+                };
                 return {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify(result, null, 2),
+                            text: JSON.stringify(formattedResult, null, 2),
                         },
                     ],
                 };
             }
-            case "search": {
-                const parsedSearchArgs = SearchArgsSchema.safeParse(args);
+            case "shodan_search": {
+                const parsedSearchArgs = ShodanSearchArgsSchema.safeParse(args);
                 if (!parsedSearchArgs.success) {
                     throw new Error("Invalid search arguments");
                 }
@@ -221,11 +274,54 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                     query: parsedSearchArgs.data.query,
                     limit: parsedSearchArgs.data.max_results,
                 });
+                // Format the response in a user-friendly way
+                const formattedResult = {
+                    "Search Summary": {
+                        "Query": parsedSearchArgs.data.query,
+                        "Total Results": result.total,
+                        "Results Returned": result.matches.length
+                    },
+                    "Country Distribution": result.facets?.country?.map(country => ({
+                        "Country": country.value,
+                        "Count": country.count,
+                        "Percentage": `${((country.count / result.total) * 100).toFixed(2)}%`
+                    })) || [],
+                    "Matches": result.matches.map(match => ({
+                        "Basic Information": {
+                            "IP Address": match.ip_str,
+                            "Organization": match.org,
+                            "ISP": match.isp,
+                            "ASN": match.asn,
+                            "Last Update": match.timestamp
+                        },
+                        "Location": {
+                            "Country": match.location.country_name,
+                            "City": match.location.city || "Unknown",
+                            "Region": match.location.region_code || "Unknown",
+                            "Coordinates": `${match.location.latitude}, ${match.location.longitude}`
+                        },
+                        "Service Details": {
+                            "Port": match.port,
+                            "Transport": match.transport,
+                            "Product": match.product || "Unknown",
+                            "Version": match.version || "Unknown",
+                            "CPE": match.cpe || []
+                        },
+                        "Web Information": match.http ? {
+                            "Server": match.http.server,
+                            "Title": match.http.title,
+                            "Robots.txt": match.http.robots ? "Present" : "Not found",
+                            "Sitemap": match.http.sitemap ? "Present" : "Not found"
+                        } : "No HTTP information",
+                        "Hostnames": match.hostnames,
+                        "Domains": match.domains
+                    }))
+                };
                 return {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify(result, null, 2),
+                            text: JSON.stringify(formattedResult, null, 2),
                         },
                     ],
                 };
@@ -239,24 +335,54 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 logToFile(`Looking up CVE: ${cveId}`);
                 try {
                     const result = await queryCVEDB(cveId);
+                    // Helper function to format CVSS score severity
+                    const getCvssSeverity = (score) => {
+                        if (score >= 9.0)
+                            return "Critical";
+                        if (score >= 7.0)
+                            return "High";
+                        if (score >= 4.0)
+                            return "Medium";
+                        if (score >= 0.1)
+                            return "Low";
+                        return "None";
+                    };
+                    // Format the response in a user-friendly way
+                    const formattedResult = {
+                        "Basic Information": {
+                            "CVE ID": result.cve_id,
+                            "Published": new Date(result.published_time).toLocaleString(),
+                            "Summary": result.summary
+                        },
+                        "Severity Scores": {
+                            "CVSS v3": result.cvss_v3 ? {
+                                "Score": result.cvss_v3,
+                                "Severity": getCvssSeverity(result.cvss_v3)
+                            } : "Not available",
+                            "CVSS v2": result.cvss_v2 ? {
+                                "Score": result.cvss_v2,
+                                "Severity": getCvssSeverity(result.cvss_v2)
+                            } : "Not available",
+                            "EPSS": result.epss ? {
+                                "Score": `${(result.epss * 100).toFixed(2)}%`,
+                                "Ranking": `Top ${(result.ranking_epss * 100).toFixed(2)}%`
+                            } : "Not available"
+                        },
+                        "Impact Assessment": {
+                            "Known Exploited Vulnerability": result.kev ? "Yes" : "No",
+                            "Proposed Action": result.propose_action || "No specific action proposed",
+                            "Ransomware Campaign": result.ransomware_campaign || "No known ransomware campaigns"
+                        },
+                        "Affected Products": result.cpes?.length > 0 ? result.cpes : ["No specific products listed"],
+                        "Additional Information": {
+                            "References": result.references?.length > 0 ? result.references : ["No references provided"]
+                        }
+                    };
                     return {
                         content: [
                             {
                                 type: "text",
-                                text: JSON.stringify({
-                                    cve_id: result.cve_id,
-                                    summary: result.summary,
-                                    cvss_v3: result.cvss_v3,
-                                    cvss_v2: result.cvss_v2,
-                                    epss: result.epss,
-                                    ranking_epss: result.ranking_epss,
-                                    kev: result.kev,
-                                    propose_action: result.propose_action,
-                                    ransomware_campaign: result.ransomware_campaign,
-                                    published: result.published_time,
-                                    references: result.references,
-                                    affected_products: result.cpes
-                                }, null, 2),
+                                text: JSON.stringify(formattedResult, null, 2),
                             },
                         ],
                     };
@@ -278,20 +404,27 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 if (!parsedDnsArgs.success) {
                     throw new Error("Invalid dns_lookup arguments");
                 }
-                // Ensure proper formatting of hostnames for the API request
+                // Join hostnames with commas for the API request
                 const hostnamesString = parsedDnsArgs.data.hostnames.join(",");
-                // Log the request parameters for debugging
-                logToFile(`DNS lookup request parameters: ${JSON.stringify({ hostnames: hostnamesString })}`);
                 const result = await queryShodan("/dns/resolve", {
                     hostnames: hostnamesString
                 });
-                // Log the raw response for debugging
-                logToFile(`DNS lookup raw response: ${JSON.stringify(result)}`);
+                // Format the response in a user-friendly way
+                const formattedResult = {
+                    "DNS Resolutions": Object.entries(result).map(([hostname, ip]) => ({
+                        "Hostname": hostname,
+                        "IP Address": ip
+                    })),
+                    "Summary": {
+                        "Total Lookups": Object.keys(result).length,
+                        "Queried Hostnames": parsedDnsArgs.data.hostnames
+                    }
+                };
                 return {
                     content: [
                         {
                             type: "text",
-                            text: JSON.stringify(result, null, 2)
+                            text: JSON.stringify(formattedResult, null, 2)
                         },
                     ],
                 };
@@ -355,22 +488,74 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                         start_date: parsedArgs.data.start_date,
                         end_date: parsedArgs.data.end_date
                     });
+                    // Helper function to format CVSS score severity
+                    const getCvssSeverity = (score) => {
+                        if (score >= 9.0)
+                            return "Critical";
+                        if (score >= 7.0)
+                            return "High";
+                        if (score >= 4.0)
+                            return "Medium";
+                        if (score >= 0.1)
+                            return "Low";
+                        return "None";
+                    };
                     // Format the response based on whether it's a count request or full CVE list
                     const formattedResult = parsedArgs.data.count
-                        ? { total_cves: result.total }
-                        : {
-                            cves: result.cves,
-                            skip: parsedArgs.data.skip,
-                            limit: parsedArgs.data.limit,
-                            total_returned: result.cves.length,
-                            query_params: {
-                                cpe23: parsedArgs.data.cpe23,
-                                product: parsedArgs.data.product,
-                                is_kev: parsedArgs.data.is_kev,
-                                sort_by_epss: parsedArgs.data.sort_by_epss,
-                                start_date: parsedArgs.data.start_date,
-                                end_date: parsedArgs.data.end_date
+                        ? {
+                            "Query Information": {
+                                "Product": parsedArgs.data.product || "N/A",
+                                "CPE 2.3": parsedArgs.data.cpe23 || "N/A",
+                                "KEV Only": parsedArgs.data.is_kev ? "Yes" : "No",
+                                "Sort by EPSS": parsedArgs.data.sort_by_epss ? "Yes" : "No"
+                            },
+                            "Results": {
+                                "Total CVEs Found": result.total
                             }
+                        }
+                        : {
+                            "Query Information": {
+                                "Product": parsedArgs.data.product || "N/A",
+                                "CPE 2.3": parsedArgs.data.cpe23 || "N/A",
+                                "KEV Only": parsedArgs.data.is_kev ? "Yes" : "No",
+                                "Sort by EPSS": parsedArgs.data.sort_by_epss ? "Yes" : "No",
+                                "Date Range": parsedArgs.data.start_date ?
+                                    `${parsedArgs.data.start_date} to ${parsedArgs.data.end_date || 'now'}` :
+                                    "All dates"
+                            },
+                            "Results Summary": {
+                                "Total CVEs Found": result.total,
+                                "CVEs Returned": result.cves.length,
+                                "Page": `${Math.floor(parsedArgs.data.skip / parsedArgs.data.limit) + 1}`,
+                                "CVEs per Page": parsedArgs.data.limit
+                            },
+                            "Vulnerabilities": result.cves.map((cve) => ({
+                                "Basic Information": {
+                                    "CVE ID": cve.cve_id,
+                                    "Published": new Date(cve.published_time).toLocaleString(),
+                                    "Summary": cve.summary
+                                },
+                                "Severity Scores": {
+                                    "CVSS v3": cve.cvss_v3 ? {
+                                        "Score": cve.cvss_v3,
+                                        "Severity": getCvssSeverity(cve.cvss_v3)
+                                    } : "Not available",
+                                    "CVSS v2": cve.cvss_v2 ? {
+                                        "Score": cve.cvss_v2,
+                                        "Severity": getCvssSeverity(cve.cvss_v2)
+                                    } : "Not available",
+                                    "EPSS": cve.epss ? {
+                                        "Score": `${(cve.epss * 100).toFixed(2)}%`,
+                                        "Ranking": `Top ${(cve.ranking_epss * 100).toFixed(2)}%`
+                                    } : "Not available"
+                                },
+                                "Impact Assessment": {
+                                    "Known Exploited Vulnerability": cve.kev ? "Yes" : "No",
+                                    "Proposed Action": cve.propose_action || "No specific action proposed",
+                                    "Ransomware Campaign": cve.ransomware_campaign || "No known ransomware campaigns"
+                                },
+                                "References": cve.references?.length > 0 ? cve.references : ["No references provided"]
+                            }))
                         };
                     return {
                         content: [
@@ -393,6 +578,37 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                     };
                 }
             }
+            case "reverse_dns_lookup": {
+                const parsedArgs = ReverseDnsLookupArgsSchema.safeParse(args);
+                if (!parsedArgs.success) {
+                    throw new Error("Invalid reverse_dns_lookup arguments");
+                }
+                // Join IPs with commas for the API request
+                const ipsString = parsedArgs.data.ips.join(",");
+                const result = await queryShodan("/dns/reverse", {
+                    ips: ipsString
+                });
+                // Format the response in a user-friendly way
+                const formattedResult = {
+                    "Reverse DNS Resolutions": Object.entries(result).map(([ip, hostnames]) => ({
+                        "IP Address": ip,
+                        "Hostnames": hostnames.length > 0 ? hostnames : ["No hostnames found"]
+                    })),
+                    "Summary": {
+                        "Total IPs Queried": parsedArgs.data.ips.length,
+                        "IPs with Results": Object.keys(result).length,
+                        "Queried IP Addresses": parsedArgs.data.ips
+                    }
+                };
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(formattedResult, null, 2)
+                        },
+                    ],
+                };
+            }
             default:
                 throw new Error(`Unknown tool: ${name}`);
         }

package/package.json

@@ -1,7 +1,7 @@
 {
   "type": "module",
   "name": "@burtthecoder/mcp-shodan",
-  "version": "1.0.12",
+  "version": "1.0.13",
   "description": "A Model Context Protocol server for Shodan API queries.",
   "main": "build/index.js",
   "bin": {