ADEO CTI MCP Server
Developed by ADEO Cybersecurity Services
A Model Context Protocol (MCP) server that provides access to both Shodan and VirusTotal APIs for comprehensive security analysis and threat intelligence. This server, developed and maintained by ADEO Cybersecurity Services, enables cybersecurity analysts to perform network intelligence operations including host information lookup, DNS operations, vulnerability analysis, network scanning, and alerts management through a collection of tools and prompt templates.
About ADEO Cybersecurity Services
ADEO Cybersecurity Services specializes in providing advanced security solutions and tools for cybersecurity professionals. This ADEO CTI MCP Server is part of our commitment to enhancing cybersecurity capabilities through innovative tools and integrations with industry-leading security data sources.
Features
Shodan Capabilities
- Detailed information about IP addresses including open ports, services, and location data
- DNS lookup and reverse DNS operations
- Domain information retrieval including subdomains
- Advanced search capabilities with facets and filters
- On-demand network scanning
- Network alerts and monitoring
- Vulnerability analysis and CVE tracking
- Account and API management
- Historical data access
VirusTotal Integration
- Malware analysis and detection
- URL scanning and reputation checking
- IP address reputation analysis
- Domain threat intelligence
- File hash analysis
- Comprehensive threat reports
Combined Analysis Features
- Unified security analysis using both platforms
- Correlated threat intelligence
- Integrated vulnerability assessment
- Cross-platform data enrichment
Enhanced Functionality
- Rich data formatting and presentation
- Intelligent workflow automation
- Pre-built analysis templates
- Custom search filters
- Batch processing capabilities
- Real-time monitoring
Tools
Shodan Tools
Host Information
- host-info
* Get detailed information about a host from Shodan
* Parameters:
ip (required): IP address to look uphistory (optional): Include historical informationminify (optional): Return only basic host information
DNS Operations
- dns-lookup
* Resolve hostnames to IP addresses
* Parameters:
* `hostnames` (required): Comma-separated list of hostnames to resolve
* Example:
@shodan dns-lookup hostnames="google.com,facebook.com"
- reverse-dns
* Look up hostnames for IP addresses
* Parameters:
* `ips` (required): Comma-separated list of IP addresses
* Example:
@shodan reverse-dns ips="8.8.8.8,1.1.1.1"
- domain-info
* Get DNS entries and subdomains for a domain
* Parameters:
* `domain` (required): Domain name to look up
* Example:
@shodan domain-info domain="example.com"
Search Operations
- search-host
* Search Shodan for hosts matching specific criteria
* Parameters:
* `query` (required): Shodan search query
* `facets` (optional): Comma-separated list of properties for summary information
* `page` (optional): Page number for results
* Example:
@shodan search-host query="apache country:DE" facets="org,port"
- search-host-count
* Get count of matching results without full details
* Parameters:
* `query` (required): Shodan search query
* `facets` (optional): Comma-separated list of facets
* Example:
@shodan search-host-count query="product:nginx"
Search Utilities
- list-search-facets
* List all available search facets
* No parameters required
- list-search-filters
* List all filters that can be used when searching
* No parameters required
- search-tokens
* Analyze and break down search query components
* Parameters:
* `query` (required): Shodan search query to analyze
* Example:
@shodan search-tokens query="apache port:80 country:DE"
Network Information
- list-ports
* List all ports that Shodan is actively scanning
* No parameters required
- list-protocols
* List all protocols available for scanning
* No parameters required
Scanning Operations
- request-scan
* Request Shodan to scan specific targets
* Parameters:
* `ips` (required): Comma-separated list of IPs or networks in CIDR notation
* Example:
@shodan request-scan ips="192.168.1.0/24"
- get-scan-status
* Check the status of a submitted scan
* Parameters:
* `id` (required): The unique scan ID
* Example:
@shodan get-scan-status id="SCAN_ID"
- list-scans
* View all your submitted scans
* No parameters required
Alert Management
- list-triggers
* List available network alert triggers
* No parameters required
- create-alert
* Set up network monitoring alerts
* Parameters:
* `name` (required): Alert name
* `filters` (required): Alert filters
* `expires` (optional): Expiration time in seconds
* Example:
@shodan create-alert name="My Alert" filters={"ip":["8.8.8.8"],"port":[80,443]}
- get-alert-info
* Get details about a specific alert
* Parameters:
* `id` (required): Alert ID
* Example:
@shodan get-alert-info id="ALERT_ID"
- delete-alert
* Remove an existing alert
* Parameters:
* `id` (required): Alert ID to delete
- edit-alert
* Modify an existing alert
* Parameters:
* `id` (required): Alert ID
* `name` (optional): New alert name
* `filters` (optional): Updated filters
- list-alerts
* View all active alerts
* No parameters required
Query Management
- list-queries
* View saved search queries
* Parameters:
* `page` (optional): Results page number
* `sort` (optional): Sort by "votes" or "timestamp"
* `order` (optional): "asc" or "desc"
- search-queries
* Search through saved queries
* Parameters:
* `query` (required): Search term
* `page` (optional): Page number
- list-query-tags
* View popular query tags
* Parameters:
* `size` (optional): Number of tags to return
Account Management
- get-profile
* View account information
* No parameters required
- get-api-info
* Check API subscription status
* No parameters required
- get-billing
* View billing information
* No parameters required
- get-http-headers
* Check your request headers
* No parameters required
- get-my-ip
* View your current IP address
* No parameters required
Vulnerability Analysis
- cve-lookup
* Get CVE details
* Parameters:
* `cve` (required): CVE ID (e.g., CVE-2021-44228)
* Example:
@shodan cve-lookup cve="CVE-2021-44228"
- cpe-vuln-search
* Search vulnerabilities by CPE
* Parameters:
* `cpe` (required): CPE 2.3 string
* `minCvss` (optional): Minimum CVSS score
* `maxResults` (optional): Result limit
* Example:
@shodan cpe-vuln-search cpe="cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*" minCvss=7.0
VirusTotal Tools
URL Analysis
- virustotal-url-analysis
* Analyze URLs for security threats
* Parameters:
url (required): Target URL
File Analysis
- virustotal-file-analysis
* Check file hashes for malware
* Parameters:
hash (required): MD5/SHA-1/SHA-256 hash
IP Analysis
- virustotal-ip-analysis
* Check IP reputation
* Parameters:
ip (required): Target IP address
Domain Analysis
- virustotal-domain-analysis
* Analyze domain reputation
* Parameters:
domain (required): Target domain
MCP Server Prompts
The server provides a set of intelligent prompts for comprehensive cybersecurity analysis workflows:
Asset Discovery
Vulnerability Assessment
Name : vulnerability-assessment
Description : Find vulnerabilities in internet-connected systems
Parameters :
target_type (required): Type of target to analyze ("host", "domain", "cpe", "cve")target (required): Target identifier (IP, domain, CPE string, or CVE ID)severity_threshold (optional): Minimum severity threshold ("all", "medium", "high", "critical")include_vt_analysis (optional): Include VirusTotal security analysis ("yes" or "no")
Example :
@shodan vulnerability-assessment target_type=host target=192.168.1.1 severity_threshold=high
Internet Search
Network Monitoring
Name : network-monitoring
Description : Set up network monitoring and alerts
Parameters :
target (required): IP, network range, or domain to monitormonitor_type (required): Type of changes to monitor ("new-service", "vulnerability", "certificate", "custom")notification_threshold (optional): Minimum severity for notifications ("all", "high", "critical")
Example :
@shodan network-monitoring target=192.168.0.0/24 monitor_type=vulnerability notification_threshold=high
ICS Analysis
DNS Intelligence
Service Exposure Analysis
Account Status
Scan Management
Search Analytics
Vulnerability Hunting
Name : vulnerability-hunting
Description : Hunt for specific vulnerabilities across the internet
Parameters :
vuln_type (required): Type of vulnerability to hunt ("cve", "product", "service", "custom")target (required): Vulnerability target (CVE ID, product name, service type)scope (optional): Scope of the search ("global", "regional", "industry")scope_value (optional): Value for scope (country, industry)
Example :
@shodan vulnerability-hunting vuln_type=cve target=CVE-2021-44228 scope=regional scope_value=US
Malware Analysis
Infrastructure Analysis
Name : infrastructure-analysis
Description : Analyze network infrastructure using combined Shodan and VirusTotal data
Parameters :
target_type (required): Type of target to analyze ("ip" or "domain")target (required): IP address or domain to analyzedepth (optional): Analysis depth ("basic" or "comprehensive")include_vt_analysis (optional): Include VirusTotal analysis ("yes" or "no")
Example :
@shodan infrastructure-analysis target_type=domain target=example.com depth=comprehensive
Threat Hunting
Environment Setup
Set required environment variables:
SHODAN_API_KEY=your_shodan_api_key
VIRUSTOTAL_API_KEY=your_virustotal_api_key
Install dependencies:
npm install
Build the project:
npm run build
Start the server:
npm start
API Rate Limits
- Respect Shodan API limits based on your subscription
- VirusTotal API has separate rate limits
- Use batch operations when possible
- Implement appropriate delay between requests
Error Handling
The server handles various error scenarios:
- Invalid API keys
- Rate limiting
- Network issues
- Invalid parameters
- Missing permissions
Contributing
- Fork the repository
- Create a feature branch
- Submit a pull request
License
Copyright © 2024 ADEO Cybersecurity Services. All rights reserved.
