@burtthecoder/mcp-shodan 1.0.4 → 1.0.6

package/build/index.js

@@ -7,19 +7,27 @@ import dotenv from "dotenv";
 import { z } from "zod";
 import { zodToJsonSchema } from "zod-to-json-schema";
 import fs from "fs";
+import path from "path";
+import os from "os";
 dotenv.config();
-const logFilePath = "E:/dev/shodan-mcp/server.log";
+const logFilePath = path.join(os.tmpdir(), "mcp-shodan-server.log");
 const SHODAN_API_KEY = process.env.SHODAN_API_KEY;
 if (!SHODAN_API_KEY) {
     throw new Error("SHODAN_API_KEY environment variable is required.");
 }
 const API_BASE_URL = "https://api.shodan.io";
+const CVEDB_API_URL = "https://cvedb.shodan.io";
 // Logging Helper Function
 function logToFile(message) {
-    const timestamp = new Date().toISOString();
-    const formattedMessage = `[${timestamp}] ${message}\n`;
-    fs.appendFileSync(logFilePath, formattedMessage, "utf8");
-    console.error(formattedMessage.trim()); // Use stderr for logging to avoid interfering with stdout
+    try {
+        const timestamp = new Date().toISOString();
+        const formattedMessage = `[${timestamp}] ${message}\n`;
+        fs.appendFileSync(logFilePath, formattedMessage, "utf8");
+        console.error(formattedMessage.trim()); // Use stderr for logging to avoid interfering with stdout
+    }
+    catch (error) {
+        console.error(`Failed to write to log file: ${error}`);
+    }
 }
 // Tool Schemas
 const IpLookupArgsSchema = z.object({
@@ -34,7 +42,9 @@ const SearchArgsSchema = z.object({
         .describe("Maximum results to return."),
 });
 const VulnerabilitiesArgsSchema = z.object({
-    cve: z.string().describe("The CVE identifier to query."),
+    cve: z.string()
+        .regex(/^CVE-\d{4}-\d{4,}$/i, "Must be a valid CVE ID format (e.g., CVE-2021-44228)")
+        .describe("The CVE identifier to query (format: CVE-YYYY-NNNNN)."),
 });
 const DnsLookupArgsSchema = z.object({
     hostnames: z.array(z.string()).describe("List of hostnames to resolve."),
@@ -54,6 +64,23 @@ async function queryShodan(endpoint, params) {
         throw new Error(`Shodan API error: ${errorMessage}`);
     }
 }
+// Helper Function for CVE lookups using CVEDB
+async function queryCVEDB(cveId) {
+    try {
+        logToFile(`Querying CVEDB for: ${cveId}`);
+        const response = await axios.get(`${CVEDB_API_URL}/cve/${cveId}`);
+        return response.data;
+    }
+    catch (error) {
+        if (error.response?.status === 422) {
+            throw new Error(`Invalid CVE ID format: ${cveId}`);
+        }
+        if (error.response?.status === 404) {
+            throw new Error(`CVE not found: ${cveId}`);
+        }
+        throw new Error(`CVEDB API error: ${error.message}`);
+    }
+}
 // Server Setup
 const server = new Server({
     name: "shodan-mcp",
@@ -79,7 +106,7 @@ server.setRequestHandler(InitializeRequestSchema, async (request) => {
             name: "shodan-mcp",
             version: "1.0.0",
         },
-        instructions: "This server provides tools for querying Shodan, including IP lookups, searches, and vulnerabilities.",
+        instructions: "This server provides tools for querying Shodan, including IP lookups, searches, and vulnerabilities. For CVE lookups, use the format CVE-YYYY-NNNNN (e.g., CVE-2021-44228).",
     };
 });
 // Register Tools
@@ -97,7 +124,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
         },
         {
             name: "vulnerabilities",
-            description: "Retrieve vulnerability information for a CVE.",
+            description: "Retrieve vulnerability information for a CVE. Use format: CVE-YYYY-NNNNN (e.g., CVE-2021-44228)",
             inputSchema: zodToJsonSchema(VulnerabilitiesArgsSchema),
         },
         {
@@ -151,17 +178,45 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             case "vulnerabilities": {
                 const parsedVulnArgs = VulnerabilitiesArgsSchema.safeParse(args);
                 if (!parsedVulnArgs.success) {
-                    throw new Error("Invalid vulnerabilities arguments");
+                    throw new Error("Invalid CVE format. Please use format: CVE-YYYY-NNNNN (e.g., CVE-2021-44228)");
+                }
+                const cveId = parsedVulnArgs.data.cve.toUpperCase();
+                logToFile(`Looking up CVE: ${cveId}`);
+                try {
+                    const result = await queryCVEDB(cveId);
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: JSON.stringify({
+                                    cve_id: result.cve_id,
+                                    summary: result.summary,
+                                    cvss_v3: result.cvss_v3,
+                                    cvss_v2: result.cvss_v2,
+                                    epss: result.epss,
+                                    ranking_epss: result.ranking_epss,
+                                    kev: result.kev,
+                                    propose_action: result.propose_action,
+                                    ransomware_campaign: result.ransomware_campaign,
+                                    published: result.published_time,
+                                    references: result.references,
+                                    affected_products: result.cpes
+                                }, null, 2),
+                            },
+                        ],
+                    };
+                }
+                catch (error) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: error.message,
+                            },
+                        ],
+                        isError: true,
+                    };
                 }
-                const result = await queryShodan(`/shodan/cve/${parsedVulnArgs.data.cve}`, {});
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: JSON.stringify(result, null, 2),
-                        },
-                    ],
-                };
             }
             case "dns_lookup": {
                 const parsedDnsArgs = DnsLookupArgsSchema.safeParse(args);

package/package.json

@@ -1,7 +1,7 @@
 {
   "type": "module",
   "name": "@burtthecoder/mcp-shodan",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "A Model Context Protocol server for Shodan API queries.",
   "main": "./build/index.js",
   "bin": {