{ "data": { "a": { "slug": "abuseipdb", "name": "AbuseIPDB", "vendor": "AbuseIPDB LLC", "vendorUrl": "https://www.abuseipdb.com", "kind": "http-api", "category": "security-intelligence", "summary": "AbuseIPDB is a crowdsourced database of IP addresses reported for abuse, run by AbuseIPDB LLC under Marathon Studios. Its API v2 returns an abuse confidence score and report history for an address, a subnet or a blacklist, and takes reports.", "url": "https://www.anchorterminal.com/tools/abuseipdb", "markdownUrl": "https://www.anchorterminal.com/tools/abuseipdb.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/abuseipdb.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/abuseipdb.json", "dns": "abuseipdb.grade.anchorterminal.com", "repo": "https://github.com/AbuseIPDB/abuseipdb-mcp", "transports": [ "stdio" ], "packages": [ { "registry": "pypi", "name": "mcp-server-abuseipdb" } ], "auth": "api-key", "authNotes": "API key from the account page after a browser signup, sent in a `Key` header. The docs also accept the key as a lowercase `key` query or form parameter. No scopes were found. The official MCP server reads the key from `ABUSEIPDB_API_KEY` and is read-only.", "pricing": "freemium", "pricingNotes": "Free Individual plan with 1,000 checks and 1,000 reports a day, 100 block checks, a 10,000-address blacklist and no card. Basic $25 a month (10,000 checks a day) and Premium $99 a month (50,000 a day), each with a 30-day trial. Enterprise by contact. Free plans are for evaluation, contributing reports or non-commercial personal projects under the terms.", "priceSummary": "$25 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the pricing page or the MCP server repository (checked 2026-11-03). Plan limits exceeded on check-block return 402 Payment Required with a plain error, not payment requirements.", "endpoints": [] }, "toolCount": 2, "popularity": { "githubStars": 6, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://docs.abuseipdb.com/", "llmsTxt": "https://www.abuseipdb.com/llms.txt", "registryName": "io.github.abuseipdb/abuseipdb-mcp", "capabilities": [ "secintel.reputation", "secintel.indicators", "secintel.ip-enrichment" ], "tags": [ "hosted", "freemium", "no-card", "free-tier", "api-key", "mcp", "official", "mcp-registry", "stdio", "read-only-mode", "llms-txt", "sla", "status-page", "python", "closed-source" ], "lastRelease": "2026-08-02", "graded": true, "anchor": { "graded": true, "score": 55.7, "grade": "C", "agentReady": false, "rank": 819, "ranked": true, "rankOf": 1349, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 38, "payments": 30, "reliability": 75, "schema": 59, "security": 37, "transparency": 63 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "A free key allows 1,000 IP checks a day with published per-endpoint limits, rate-limit headers and a 99 per cent SLA in the terms, and the official MCP server is read-only. One key covers reads, reports and deletes, the key may travel in a query string, there is no OpenAPI document, and the terms bar redistribution of results.", "bestFor": "An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident.", "strengths": [ "1,000 checks and 1,000 reports a day on a free key with no card, and daily limits published for every endpoint and plan", "429 responses carry Retry-After and X-RateLimit headers, and errors follow the JSON API shape with a status and detail", "The terms include a service level agreement with a 99 per cent monthly availability target", "The first-party MCP server has two read-only tools annotated readOnlyHint and idempotentHint, with per-item errors in bulk checks", "llms.txt on abuseipdb.com describes the API, categories and reporting rules for agents" ], "weaknesses": [ "No OpenAPI document, no API changelog (the blog's last post is from December 2018) and the reports endpoint is marked open beta and may change without notice", "One key per account reaches reads, reports, bulk reports and clear-address deletes, and the docs accept it as a query parameter", "No security.txt, disclosure policy or certification found, and the status page's incident history could not be read", "The terms bar reproducing, copying or reselling any portion of the service and its data, and free plans exclude commercial use", "The privacy policy of 15 March 2023 gives no retention periods and marks every provider's GDPR status as in process" ], "agentNotes": [ "Send `Accept: application/json` and the key in the `Key` header; without the Accept header the API answers with an HTML page", "Act on `abuseConfidenceScore` rather than `isWhitelisted`, and pass `maxAgeInDays` to bound how old the reports can be (default 30, maximum 365)", "Watch `X-RateLimit-Remaining` per endpoint and on a 429 wait for `Retry-After`, which can be most of a day since limits reset at 00:00 UTC", "Use `check-block` for a subnet (up to /24 on the free plan) and `blacklist` with `confidenceMinimum` only on a paid plan; over-limit `limit` values are truncated silently", "Strip personal data from report comments, which are public, and prefer the read-only MCP server when the task never reports" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 55.7 } ], "editorialScores": { "ergonomics": 74, "maintenance": 38, "payments": 30, "reliability": 75, "schema": 59, "security": 37, "transparency": 42 }, "provenanceScore": 84, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "uvx mcp-server-abuseipdb", "http": "curl -G https://api.abuseipdb.com/api/v2/check --data-urlencode \"ipAddress=118.25.6.39\" -d maxAgeInDays=90 -H \"Key: $ABUSEIPDB_API_KEY\" -H \"Accept: application/json\"", "claudeCode": "claude mcp add abuseipdb -e ABUSEIPDB_API_KEY=YOUR_KEY -- uvx mcp-server-abuseipdb", "config": { "mcpServers": { "abuseipdb": { "args": [ "mcp-server-abuseipdb" ], "command": "uvx", "env": { "ABUSEIPDB_API_KEY": "${ABUSEIPDB_API_KEY}" } } } } }, "letme": { "capability": "https://letme.dev/secintel.reputation", "tool": "https://letme.dev/abuseipdb" }, "area": "developer", "unitPrices": [ { "item": "Basic, 10,000 checks a day", "unit": "month", "usd": 25, "note": "$228 a year" }, { "item": "Premium, 50,000 checks a day", "unit": "month", "usd": 99, "note": "$1,068 a year" } ], "provenance": { "legalEntity": "AbuseIPDB LLC", "domain": "abuseipdb.com", "domainRegistered": "2010-04-06", "endpointOnVendorDomain": true, "terms": "https://www.abuseipdb.com/legal", "privacy": "https://www.abuseipdb.com/privacy", "statusPage": "https://status.abuseipdb.com/", "changelog": "https://github.com/AbuseIPDB/abuseipdb-mcp/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "The terms of use and privacy policy, both last updated 15 March 2023, name AbuseIPDB LLC, a Pennsylvania limited liability company, under Pennsylvania law with arbitration in Philadelphia. The about page says the project is managed by Marathon Studios Inc.", "Section 3 of the terms forbids accessing the website by automated means other than search engines that follow robots.txt and authorised API use. Public pages were read for this listing and the clause is recorded as a fact.", "www.abuseipdb.com/robots.txt disallows /account and /enterprise/ for all crawlers with a crawl delay of 2; neither path was fetched. docs.abuseipdb.com has no robots.txt.", "The changelog link is the MCP server's. No changelog for the REST API was found; the blog's newest post is dated 13 December 2018.", "status.abuseipdb.com is an UptimeRobot page linked from the footer. Its monitors and history load by script and answered with an error when read on 3 November 2026.", "www.abuseipdb.com/.well-known/security.txt returns 404. RDAP at Verisign gives a registration date of 6 April 2010." ], "score": 84 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/abuseipdb.json", "live": { "slug": "abuseipdb", "vendorStatus": { "page": "https://status.abuseipdb.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-04T15:31:19.057306817Z" }, "versions": [ { "registry": "pypi", "name": "mcp-server-abuseipdb", "version": "0.1.1", "released": "2026-08-03", "seenAt": "2026-11-04T19:54:02.081091414Z" } ], "githubStars": 6, "pypiWeekly": 38, "securityTxt": { "url": "https://abuseipdb.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:21.604779568Z" }, "updatedAt": "2026-11-04T19:54:02.294565318Z" } }, "answer": "AbuseIPDB scores 55.7 (C) on agent readiness against Shodan's 39.5 (E), and leads in 6 of 7 scored categories. Shodan leads on payments \u0026 pricing.", "b": { "slug": "shodan", "name": "Shodan", "vendor": "Shodan", "vendorUrl": "https://www.shodan.io", "kind": "http-api", "category": "security-intelligence", "summary": "Shodan is a search engine for internet-connected devices. Its REST API returns the open ports, banners, certificates and known vulnerabilities of an IP address, searches the index by filter, scans ranges on demand and monitors networks for change.", "url": "https://www.anchorterminal.com/tools/shodan", "markdownUrl": "https://www.anchorterminal.com/tools/shodan.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shodan.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shodan.json", "dns": "shodan.grade.anchorterminal.com", "repo": "https://github.com/achillean/shodan-python", "license": "Proprietary service. The official Python library and CLI in achillean/shodan-python are MIT", "transports": [ "http" ], "remoteUrl": "https://api.shodan.io", "packages": [ { "registry": "pypi", "name": "shodan" } ], "auth": "api-key", "authNotes": "One API key per account, shown after a browser signup for a free account. Every documented call sends it as `key=` in the query string, the only method the API reference and the OpenAPI document show. No scopes, no read-only keys and no header option were found. The free API plan allows unfiltered searches and counts; host lookups need at least a one-time Membership, and scanning needs a plan with scan credits (checked 2026-11-03).", "pricing": "freemium", "pricingNotes": "Free account with a free API plan. Membership $49 one time (100 query and 100 scan credits a month, 16 monitored IPs). Freelancer $69 a month (10,000 query credits, 5,120 scan credits), Small Business $359 (200,000 and 65,536), Corporate $1,099 (unlimited query credits, 327,680 scan credits), Enterprise by contact. One query credit is 100 results of a filtered or paged search, one scan credit is one IP. All API plans are limited to 1 request a second (https://account.shodan.io/billing). InternetDB and CVEDB are keyless and free for non-commercial use.", "priceSummary": "$49 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API reference, the OpenAPI document, the billing page or the help centre (checked 2026-11-03). Plans are bought in a browser at account.shodan.io.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 3463, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://developer.shodan.io/api", "openapi": "https://developer.shodan.io/api/openapi.json", "capabilities": [ "secintel.exposure", "secintel.ip-enrichment", "secintel.dns", "secintel.indicators" ], "tags": [ "hosted", "freemium", "api-key", "free-tier", "openapi", "python", "cli", "security" ], "lastRelease": "2023-12-17", "graded": true, "anchor": { "graded": true, "score": 39.5, "grade": "E", "agentReady": false, "rank": 1221, "ranked": true, "rankOf": 1349, "categoryRank": 8, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 16, "payments": 40, "reliability": 40, "schema": 46, "security": 19, "transparency": 44 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "One GET endpoint per job returns ports, banners and vulnerabilities for an IP, with `minify` and `fields` to trim responses and public plan prices from a $49 one-time Membership. The key travels only in the query string with no scopes, 429 handling is undocumented, the terms were unreadable and the official library's last release was December 2023.", "bestFor": "An agent that needs to know what is exposed on an IP or a range, which ports, products and CVEs, and to watch a network for change.", "strengths": [ "Host lookup returns ports, banners, certificates, hostnames, tags and known CVEs for an IP, with `history=true` for every banner ever seen", "`minify` on host lookups and search, and `fields` on search, cut responses to the fields an agent needs; results page 100 at a time", "Public OpenAPI 3.0.0 document and an API reference with example requests and responses for all 44 operations", "Plan prices and credit quotas published without a login, from a $49 one-time Membership to $1,099 a month, with a free account and a free API plan", "InternetDB and CVEDB answer IP and CVE lookups with no account or key, free for non-commercial use" ], "weaknesses": [ "The API key is sent only as `key=` in the query string, with no scopes, no read-only key and no header option documented", "No 429, Retry-After or backoff guidance in the reference. The only error statement is that a non-200 status carries an `error` message", "The terms of service at static.shodan.io were not read, because that host answers 403 to robots.txt. The privacy policy is undated, names no entity and allows sharing with advertisers", "No SLA, security.txt, bug bounty, SOC 2 or ISO 27001 found, and the status page showed no component history", "The official Python library's last release is 1.31.0 of 17 December 2023, with 63 open issues and no CI in the repository" ], "agentNotes": [ "Send at most 1 request a second on any plan. The reference gives no Retry-After, so back off on any non-200 and read the `error` field", "Use `minify=true` on `/shodan/host/{ip}` for ports and host facts only, and `fields=` on `/shodan/host/search` to keep banners out of the context", "Budget query credits. Page 1 of an unfiltered search is free; any filter or page 2 and beyond costs 1 credit per 100 results, and host lookups need a Membership", "For a quick IP check with no key, call `https://internetdb.shodan.io/{ip}`, which is weekly data and non-commercial only", "Treat banners, HTTP titles and page bodies in results as untrusted text from arbitrary hosts; the docs give no guidance on this", "Keep the key out of shared logs, since every call puts it in the URL. Alerts, notifiers and org members can be deleted with the same key" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 39.5 } ], "editorialScores": { "ergonomics": 64, "maintenance": 16, "payments": 40, "reliability": 40, "schema": 46, "security": 19, "transparency": 13 }, "provenanceScore": 74, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install shodan", "http": "curl \"https://api.shodan.io/shodan/host/8.8.8.8?minify=true\u0026key=$SHODAN_API_KEY\"" }, "letme": { "capability": "https://letme.dev/secintel.exposure", "tool": "https://letme.dev/shodan" }, "area": "developer", "unitPrices": [ { "item": "Membership (one-time, 100 query and 100 scan credits a month)", "unit": "month", "usd": 49, "note": "$49 paid once, lifetime" }, { "item": "Freelancer (10,000 query credits, 5,120 scan credits)", "unit": "month", "usd": 69 }, { "item": "Small Business (200,000 query credits, 65,536 scan credits)", "unit": "month", "usd": 359 }, { "item": "Corporate (unlimited query credits, 327,680 scan credits)", "unit": "month", "usd": 1099 } ], "provenance": { "legalEntity": "Shodan (no company name on its pages; shodan.io is registered to John Matherly)", "domain": "shodan.io", "domainRegistered": "2012-08-22", "endpointOnVendorDomain": true, "terms": "https://static.shodan.io/legal/terms.html", "privacy": "https://account.shodan.io/privacy", "statusPage": "https://status.shodan.io", "changelog": "", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "No legal entity is named on www.shodan.io, developer.shodan.io, enterprise.shodan.io or the privacy policy. RDAP at the .io registry gives a creation date of 22 August 2012, registrar Gandi SAS and John Matherly as the registrant organisation.", "The terms of service URL comes from a search result. static.shodan.io answers 403 to robots.txt, so the terms were not fetched and nothing in the listing rests on them.", "www.shodan.io/robots.txt disallows /domain/ for all crawlers with a crawl delay of 10 seconds. developer.shodan.io, account.shodan.io and help.shodan.io have no robots.txt (404). blog.shodan.io disallows only /ghost/.", "The privacy policy is undated, names no entity, retention period, data location or subprocessor, and says Shodan may share information with advertisers, business partners, sponsors and other third parties.", "/.well-known/security.txt returns 404 on www.shodan.io. No bug bounty, SOC 2 or ISO 27001 found on the pages read.", "No API changelog found. blog.shodan.io is the only dated record of changes, and its newest post is 7 August 2024." ], "score": 74 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shodan.json", "live": { "slug": "shodan", "probe": { "target": "https://api.shodan.io", "method": "get", "lastAt": "2026-11-04T20:05:25.522786899Z", "lastOk": true, "lastStatus": 404, "lastMs": 196, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 231, "p95ms24h": 372, "samples24h": 48, "samples30d": 48, "days": [ { "date": "2026-11-04", "probes": 48, "ok": 48 } ] }, "vendorStatus": { "page": "https://status.shodan.io", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-04T15:32:35.193047696Z" }, "securityTxt": { "url": "https://shodan.io/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:54:49.622046628Z" }, "updatedAt": "2026-11-04T20:05:25.522786899Z" } }, "edges": [ { "by": 35, "category": "reliability", "leads": "abuseipdb", "name": "Reliability", "reasons": { "a": "Read with the hosted lines. A status page on UptimeRobot is linked from every page's footer (20). Its monitors and 90-day history load by script and answered with an error on 3 November 2026, so no incident record could be read (5). Daily limits are published per endpoint and per plan, 1,000 checks a day on the free plan up to 50,000 on Premium (15). A 429 carries Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a repeated report of the same address with the same comment within 24 hours updates the earlier report instead of adding one (15). The terms carry a service level agreement with a 99 per cent monthly availability target and a refund as the sole remedy (10). API v2 is generally available, with only the reports endpoint in open beta (10). 20 + 5 + 15 + 15 + 10 + 10 = 75.", "b": "Read with the hosted lines. A public status page exists at status.shodan.io (UptimeRobot), but on 3 November 2026 its component list failed to load and it showed only that there were no updates in the last 7 days, so no component history was readable (10 of 20). No readable incident record for the 90 days (5). The billing page states that all API plans are limited to 1 request a second, and credits per plan are published with numbers (15). No 429, Retry-After or backoff guidance was found in the reference or the OpenAPI document; the only error statement is that a non-200 status carries an error message, and no idempotency keys exist for alert, notifier or scan writes. The official Python client throttles itself to 1 request a second and retries a timed-out search cursor, which is client behaviour, not an API contract (0). No SLA found on the billing, enterprise or developer pages (0). The REST API is generally available (10). 10 + 5 + 15 + 0 + 0 + 10 = 40." }, "scores": { "a": 75, "b": 40 } }, { "by": 22, "category": "maintenance", "leads": "abuseipdb", "name": "Maintenance \u0026 community", "reasons": { "a": "Read as a closed service with an official MCP server. The newest dated change to the surface is the MCP server's v0.1.1 on 2 August 2026, 93 days before the check; the API docs and blog carry no later date (10 of 30). One release in the last 90 days, v0.1.1 fell just outside it (0 of 20). Support is a contact form with no guaranteed response on the free plan, there is no public changelog for the API, and the MCP repository shows a pull request merged on 2 August but GitHub's issue pages could not be read (5 of 15). The MCP server sits in the official registry under io.github.abuseipdb (15). The MCP package has CI on Python 3.11 to 3.14 with ruff, pytest and a packaging check, and a locked dependency set (8 of 10). 10 + 0 + 5 + 15 + 8 = 38.", "b": "No dated API change found. The blog's newest post is 7 August 2024, and the official Python library `shodan` 1.31.0 was published on 17 December 2023 with the repository's last push on 5 August 2024 (0 of 30). No releases or dated changelog entries in the last 90 days (0 of 20). 63 open issues on the Python repository with no push since August 2024; a support email and a help centre exist (5 of 25). The official Python SDK still installs but is two years old, and the other clients are community work (8 of 15). The repository has no CI configuration and no CHANGELOG entry since 1.28.0 of July 2022 (3 of 10). 0 + 0 + 5 + 8 + 3 = 16." }, "scores": { "a": 38, "b": 16 } }, { "by": 19, "category": "transparency", "leads": "abuseipdb", "name": "Transparency \u0026 trust", "reasons": { "a": "A closed service with clear terms that name AbuseIPDB LLC and the governing law, and an MIT MCP server (15 of 30). The privacy policy of 15 March 2023 lists providers and says data is kept as long as needed, with no retention periods, no DPA and every provider's GDPR status marked in process (10 of 30). No deprecation policy; the reports endpoint may change without notice and the only migration note is from APIv1 (3 of 20). DigitalOcean, Cloudflare, Mailgun, Google Analytics, Google Ads, Carbon, PayPal, Braintree, Freshworks and Slack are named, with processing in the United States (14 of 20). 15 + 10 + 3 + 14 = 42.", "b": "Editorial half. A closed service whose terms at static.shodan.io/legal/terms.html were not read, because that host answers 403 to robots.txt, so their clarity can't be assessed; the Python library is MIT (5 of 30). The privacy policy at account.shodan.io/privacy carries no date, names no legal entity, retention period, data location or subprocessor, and says Shodan may share information with advertisers, business partners, sponsors and other third parties (5 of 30). The help centre says export credits are deprecated and no longer sold, with no date; no deprecation policy found (3 of 20). No subprocessors or data locations disclosed (0 of 20). 5 + 5 + 3 + 0 = 13." }, "scores": { "a": 63, "b": 44 } }, { "by": 18, "category": "security", "leads": "abuseipdb", "name": "Security \u0026 auth", "reasons": { "a": "One API key per account with no scopes found, recommended in a Key header but also accepted as a query or form parameter per the docs (20 less 10 for the query string, so 10). The same key submits reports, bulk reports and clear-address deletes, with no read-only key; the official MCP server is read-only and its write-tool switch is inert (10 of 20). check and reports return reporter comments, which are public user-submitted text, and no guidance on treating them as untrusted was found (4 of 15). Paid plans include API log downloads for the last 24 to 120 hours and the pricing page lists the window per plan (10 of 15). security.txt returns 404, no disclosure policy, bug bounty or certification was found, and the MCP repository's SECURITY.md points to the vendor's support channels (3 of 20). 10 + 10 + 4 + 10 + 3 = 37.", "b": "One key per account with no scopes, sent as `key=` in the query string on every documented call and in the OpenAPI document, with no header option. Read as a plain key, the way the Alpha Vantage listing was read, less 10 for the query string (10 of 30). No read-only key or least-privilege mode; the free plan's limits are quotas, not scopes, and alerts, notifiers and org members can be deleted with the same key and no confirmation (3 of 20). Results carry banners, HTTP titles and page bodies collected from arbitrary hosts, and no guidance on treating them as untrusted was found (3 of 15). `/api-info` reports the plan and credits, and no call log for the key holder was found (3 of 15). security.txt returns 404 on www.shodan.io, and no bug bounty, disclosure policy, SOC 2 or ISO 27001 was found on the pages read (0 of 20). 10 + 3 + 3 + 3 + 0 = 19." }, "scores": { "a": 37, "b": 19 } }, { "by": 13, "category": "schema", "leads": "abuseipdb", "name": "Schema \u0026 documentation", "reasons": { "a": "The surface graded is the REST API v2, with the official MCP server noted. No OpenAPI document was found. The MCP server's two tools carry JSON Schema inputs with range constraints from pydantic Field (8 of 25). llms.txt on abuseipdb.com describes the API, endpoints, categories and reporting rules (10). Each endpoint has a purpose statement and a parameter table, the FAQ explains scoring and decay, and the docs say to act on abuseConfidenceScore rather than isWhitelisted, with little on when not to call (14 of 20). Parameters give defaults and ranges (maxAgeInDays 1 to 365, perPage 1 to 100), usageType has a listed set of values and categories are numbered, but types are not stated and the categories default is ambiguous (10 of 15). Examples in cURL, Python, PHP, C# and VBScript for every endpoint, and errors follow the JSON API shape with 422, 429 and 402 examples (12 of 15). v2 is in the path, there is no API changelog, the blog's last post is from December 2018, and the reports endpoint may change without notice (5 of 15). 8 + 10 + 14 + 10 + 12 + 5 = 59.", "b": "The surface graded is the REST API at api.shodan.io. An OpenAPI 3.0.0 document at developer.shodan.io/api/openapi.json covers 37 paths and 44 operations, but declares no securitySchemes, no enums and a non-200 response on one operation only (15 of 25). No llms.txt on developer.shodan.io or www.shodan.io, both 404, and no Markdown docs served for agents (0 of 10). Every operation carries a description, and the reference says which calls cost credits and which plans can scan, with little on when not to use a call (12 of 20). Required flags on the key and path parameters, with `facets`, `query` and `fields` as free strings and no enums or constraints (7 of 15). Example requests and responses for every endpoint in the reference, and errors documented only as a non-200 status with an `error` field (9 of 15). No version in the path, the OpenAPI document says 1.0.0, and the only dated record of changes is the blog, whose newest post is 7 August 2024 (3 of 15). 15 + 0 + 12 + 7 + 9 + 3 = 46." }, "scores": { "a": 59, "b": 46 } }, { "by": 10, "category": "ergonomics", "leads": "abuseipdb", "name": "Agent ergonomics", "reasons": { "a": "check returns a compact record unless verbose is set, which adds the reports array, maxAgeInDays bounds the window, and blacklist takes a limit and a plaintext form (18 of 25). reports is paginated with page and perPage up to 100 and next and previous links, and blacklist filters by confidence, country and IP version, though check has no field selection (16 of 20). Errors carry a status and a detail an agent can act on, 429 names the daily limit and the headers say when it resets, and a 402 marks a plan limit on check-block (16 of 20). Every lookup is a GET, duplicate reports within 24 hours collapse, and both MCP tools are annotated readOnlyHint and idempotentHint (16 of 20). One required parameter per endpoint with sensible defaults. No official SDK beyond a Laravel package in the vendor's GitHub organisation and the Python MCP server (8 of 15). 18 + 16 + 16 + 16 + 8 = 74.", "b": "`minify` on host lookups drops banners and returns ports and host facts, `minify` on search (on by default) truncates large fields and `fields` selects which fields come back, so an agent can size a response (20 of 25). `page` with 100 results a page, `facets` for summaries, `count` for a free total, and the whole filter language of the search engine (18 of 20). Errors are a non-200 status and a short message such as Invalid IP, with no code list to branch on (8 of 20). Most calls are GET reads. Alerts, notifiers, scans and org members are written with POST, PUT and DELETE and no idempotency key, and nothing marks a destructive call (10 of 20). Few required parameters and sensible defaults, but only one official SDK, the Python library, with the other twelve languages community work (8 of 15). 20 + 18 + 8 + 10 + 8 = 64." }, "scores": { "a": 74, "b": 64 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "AbuseIPDB LLC", "b": "Shodan", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.shodan.io", "name": "Hosted endpoint" }, { "a": "stdio", "b": "HTTP", "name": "Transports" }, { "a": "API key", "b": "API key", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "Proprietary service. The official Python library and CLI in achillean/shodan-python are MIT", "name": "Licence" }, { "a": "2", "b": "none", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "io.github.abuseipdb/abuseipdb-mcp", "b": "not listed", "name": "MCP registry" }, { "a": "2026-08-02", "b": "2023-12-17", "name": "Last release" }, { "a": "no date given", "b": "no date given", "name": "Terms last updated" }, { "a": "no date given", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "6 stars", "b": "3.5k stars", "name": "Popularity" } ], "faq": [ { "answer": "AbuseIPDB scores 55.7 (C) on agent readiness against Shodan's 39.5 (E), and leads in 6 of 7 scored categories. Shodan leads on payments \u0026 pricing.", "question": "Which is better for AI agents, AbuseIPDB or Shodan?" }, { "answer": "Both need an API key.", "question": "Do AbuseIPDB and Shodan need an API key?" }, { "answer": "AbuseIPDB runs on your own machine, with no hosted endpoint listed. Shodan has a hosted endpoint at https://api.shodan.io.", "question": "Can an agent call AbuseIPDB and Shodan without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 75 against 40", "Schema \u0026 documentation, 59 against 46", "Agent ergonomics, 74 against 64", "Security \u0026 auth, 37 against 19", "Maintenance \u0026 community, 38 against 16", "Transparency \u0026 trust, 63 against 44" ], "also": [ "Runs on your own machine", "Free to start without a card" ], "goodFor": "An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident.", "slug": "abuseipdb", "watchFor": "No OpenAPI document, no API changelog (the blog's last post is from December 2018) and the reports endpoint is marked open beta and may change without notice" }, { "aheadOn": [ "Payments \u0026 pricing, 40 against 30" ], "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "An agent that needs to know what is exposed on an IP or a range, which ports, products and CVEs, and to watch a network for change.", "slug": "shodan", "watchFor": "The API key is sent only as `key=` in the query string, with no scopes, no read-only key and no header option documented" } ], "history": null, "job": { "capability": "secintel.indicators", "name": "Secintel indicators" }, "others": [ { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-censys.json", "title": "AbuseIPDB vs Censys", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-censys" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-greynoise.json", "title": "AbuseIPDB vs GreyNoise", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-greynoise" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo.json", "title": "AbuseIPDB vs IPinfo", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-pulsedive.json", "title": "AbuseIPDB vs Pulsedive", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-pulsedive" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-virustotal.json", "title": "AbuseIPDB vs VirusTotal", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-virustotal" }, { "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api.json", "title": "AbuseIPDB vs WhoisXML API", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api" }, { "json": "https://www.anchorterminal.com/compare/greynoise-vs-shodan.json", "title": "GreyNoise vs Shodan", "url": "https://www.anchorterminal.com/compare/greynoise-vs-shodan" }, { "json": "https://www.anchorterminal.com/compare/ipinfo-vs-shodan.json", "title": "IPinfo vs Shodan", "url": "https://www.anchorterminal.com/compare/ipinfo-vs-shodan" }, { "json": "https://www.anchorterminal.com/compare/securitytrails-vs-shodan.json", "title": "SecurityTrails vs Shodan", "url": "https://www.anchorterminal.com/compare/securitytrails-vs-shodan" }, { "json": "https://www.anchorterminal.com/compare/shodan-vs-whoisxml-api.json", "title": "Shodan vs WhoisXML API", "url": "https://www.anchorterminal.com/compare/shodan-vs-whoisxml-api" }, { "json": "https://www.anchorterminal.com/compare/pulsedive-vs-shodan.json", "title": "Pulsedive vs Shodan", "url": "https://www.anchorterminal.com/compare/pulsedive-vs-shodan" }, { "json": "https://www.anchorterminal.com/compare/censys-vs-shodan.json", "title": "Censys vs Shodan", "url": "https://www.anchorterminal.com/compare/censys-vs-shodan" } ], "panel": null, "scores": [ { "abuseipdb": 75, "by": 35, "edge": "abuseipdb", "key": "reliability", "name": "Reliability", "shodan": 40, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "abuseipdb": 59, "by": 13, "edge": "abuseipdb", "key": "schema", "name": "Schema \u0026 documentation", "shodan": 46, "weight": 13 }, { "abuseipdb": 74, "by": 10, "edge": "abuseipdb", "key": "ergonomics", "name": "Agent ergonomics", "shodan": 64, "weight": 13 }, { "abuseipdb": 37, "by": 18, "edge": "abuseipdb", "key": "security", "name": "Security \u0026 auth", "shodan": 19, "weight": 14 }, { "abuseipdb": 30, "by": 10, "edge": "shodan", "key": "payments", "name": "Payments \u0026 pricing", "shodan": 40, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "abuseipdb": 38, "by": 22, "edge": "abuseipdb", "key": "maintenance", "name": "Maintenance \u0026 community", "shodan": 16, "weight": 7 }, { "abuseipdb": 63, "by": 19, "edge": "abuseipdb", "key": "transparency", "name": "Transparency \u0026 trust", "shodan": 44, "weight": 7 } ], "summary": "AbuseIPDB scores 55.7 (C) on agent readiness against Shodan's 39.5 (E), and leads in 6 of 7 scored categories. Shodan leads on payments \u0026 pricing. Both do secintel indicators.", "tasks": null, "tutorials": [], "verdicts": { "abuseipdb": "A free key allows 1,000 IP checks a day with published per-endpoint limits, rate-limit headers and a 99 per cent SLA in the terms, and the official MCP server is read-only. One key covers reads, reports and deletes, the key may travel in a query string, there is no OpenAPI document, and the terms bar redistribution of results.", "shodan": "One GET endpoint per job returns ports, banners and vulnerabilities for an IP, with `minify` and `fields` to trim responses and public plan prices from a $49 one-time Membership. The key travels only in the query string with no scopes, 429 handling is undocumented, the terms were unreadable and the official library's last release was December 2023." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/abuseipdb-vs-shodan", "json": "https://www.anchorterminal.com/compare/abuseipdb-vs-shodan.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/abuseipdb-vs-shodan.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/abuseipdb-vs-shodan.min.md" }, "markdown": "AbuseIPDB scores 55.7 (C) on agent readiness against Shodan's 39.5 (E), and leads in 6 of 7 scored categories. Shodan leads on payments \u0026 pricing. Both do secintel indicators.\n\n- AbuseIPDB: grade C, 55.7/100, rank #819 of 1349. Markdown https://www.anchorterminal.com/tools/abuseipdb.md · JSON https://www.anchorterminal.com/api/v1/tools/abuseipdb.json\n- Shodan: grade E, 39.5/100, rank #1221 of 1349. Markdown https://www.anchorterminal.com/tools/shodan.md · JSON https://www.anchorterminal.com/api/v1/tools/shodan.json\n- Best threat and security intelligence APIs for AI agents: https://www.anchorterminal.com/best/security-intelligence/index.md\n- All 33 security intel comparisons: https://www.anchorterminal.com/compare/security-intelligence/index.md\n\n## Which one, for what\n\n### AbuseIPDB (C)\n\nGood for: An agent that needs a quick reputation verdict on an IP or subnet, or wants to report abuse from its own logs, with a free daily quota large enough for one incident.\n\nAhead on:\n- Reliability, 75 against 40\n- Schema \u0026 documentation, 59 against 46\n- Agent ergonomics, 74 against 64\n- Security \u0026 auth, 37 against 19\n- Maintenance \u0026 community, 38 against 16\n- Transparency \u0026 trust, 63 against 44\n\nAlso in its favour:\n- Runs on your own machine\n- Free to start without a card\n\nWatch for: No OpenAPI document, no API changelog (the blog's last post is from December 2018) and the reports endpoint is marked open beta and may change without notice\n\n### Shodan (E)\n\nGood for: An agent that needs to know what is exposed on an IP or a range, which ports, products and CVEs, and to watch a network for change.\n\nAhead on:\n- Payments \u0026 pricing, 40 against 30\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: The API key is sent only as `key=` in the query string, with no scopes, no read-only key and no header option documented\n\n\n## Why the edge\n\n### Reliability: AbuseIPDB +35\n\n- AbuseIPDB (75): Read with the hosted lines. A status page on UptimeRobot is linked from every page's footer (20). Its monitors and 90-day history load by script and answered with an error on 3 November 2026, so no incident record could be read (5). Daily limits are published per endpoint and per plan, 1,000 checks a day on the free plan up to 50,000 on Premium (15). A 429 carries Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a repeated report of the same address with the same comment within 24 hours updates the earlier report instead of adding one (15). The terms carry a service level agreement with a 99 per cent monthly availability target and a refund as the sole remedy (10). API v2 is generally available, with only the reports endpoint in open beta (10). 20 + 5 + 15 + 15 + 10 + 10 = 75.\n- Shodan (40): Read with the hosted lines. A public status page exists at status.shodan.io (UptimeRobot), but on 3 November 2026 its component list failed to load and it showed only that there were no updates in the last 7 days, so no component history was readable (10 of 20). No readable incident record for the 90 days (5). The billing page states that all API plans are limited to 1 request a second, and credits per plan are published with numbers (15). No 429, Retry-After or backoff guidance was found in the reference or the OpenAPI document; the only error statement is that a non-200 status carries an error message, and no idempotency keys exist for alert, notifier or scan writes. The official Python client throttles itself to 1 request a second and retries a timed-out search cursor, which is client behaviour, not an API contract (0). No SLA found on the billing, enterprise or developer pages (0). The REST API is generally available (10). 10 + 5 + 15 + 0 + 0 + 10 = 40.\n\n### Maintenance \u0026 community: AbuseIPDB +22\n\n- AbuseIPDB (38): Read as a closed service with an official MCP server. The newest dated change to the surface is the MCP server's v0.1.1 on 2 August 2026, 93 days before the check; the API docs and blog carry no later date (10 of 30). One release in the last 90 days, v0.1.1 fell just outside it (0 of 20). Support is a contact form with no guaranteed response on the free plan, there is no public changelog for the API, and the MCP repository shows a pull request merged on 2 August but GitHub's issue pages could not be read (5 of 15). The MCP server sits in the official registry under io.github.abuseipdb (15). The MCP package has CI on Python 3.11 to 3.14 with ruff, pytest and a packaging check, and a locked dependency set (8 of 10). 10 + 0 + 5 + 15 + 8 = 38.\n- Shodan (16): No dated API change found. The blog's newest post is 7 August 2024, and the official Python library `shodan` 1.31.0 was published on 17 December 2023 with the repository's last push on 5 August 2024 (0 of 30). No releases or dated changelog entries in the last 90 days (0 of 20). 63 open issues on the Python repository with no push since August 2024; a support email and a help centre exist (5 of 25). The official Python SDK still installs but is two years old, and the other clients are community work (8 of 15). The repository has no CI configuration and no CHANGELOG entry since 1.28.0 of July 2022 (3 of 10). 0 + 0 + 5 + 8 + 3 = 16.\n\n### Transparency \u0026 trust: AbuseIPDB +19\n\n- AbuseIPDB (63): A closed service with clear terms that name AbuseIPDB LLC and the governing law, and an MIT MCP server (15 of 30). The privacy policy of 15 March 2023 lists providers and says data is kept as long as needed, with no retention periods, no DPA and every provider's GDPR status marked in process (10 of 30). No deprecation policy; the reports endpoint may change without notice and the only migration note is from APIv1 (3 of 20). DigitalOcean, Cloudflare, Mailgun, Google Analytics, Google Ads, Carbon, PayPal, Braintree, Freshworks and Slack are named, with processing in the United States (14 of 20). 15 + 10 + 3 + 14 = 42.\n- Shodan (44): Editorial half. A closed service whose terms at static.shodan.io/legal/terms.html were not read, because that host answers 403 to robots.txt, so their clarity can't be assessed; the Python library is MIT (5 of 30). The privacy policy at account.shodan.io/privacy carries no date, names no legal entity, retention period, data location or subprocessor, and says Shodan may share information with advertisers, business partners, sponsors and other third parties (5 of 30). The help centre says export credits are deprecated and no longer sold, with no date; no deprecation policy found (3 of 20). No subprocessors or data locations disclosed (0 of 20). 5 + 5 + 3 + 0 = 13.\n\n### Security \u0026 auth: AbuseIPDB +18\n\n- AbuseIPDB (37): One API key per account with no scopes found, recommended in a Key header but also accepted as a query or form parameter per the docs (20 less 10 for the query string, so 10). The same key submits reports, bulk reports and clear-address deletes, with no read-only key; the official MCP server is read-only and its write-tool switch is inert (10 of 20). check and reports return reporter comments, which are public user-submitted text, and no guidance on treating them as untrusted was found (4 of 15). Paid plans include API log downloads for the last 24 to 120 hours and the pricing page lists the window per plan (10 of 15). security.txt returns 404, no disclosure policy, bug bounty or certification was found, and the MCP repository's SECURITY.md points to the vendor's support channels (3 of 20). 10 + 10 + 4 + 10 + 3 = 37.\n- Shodan (19): One key per account with no scopes, sent as `key=` in the query string on every documented call and in the OpenAPI document, with no header option. Read as a plain key, the way the Alpha Vantage listing was read, less 10 for the query string (10 of 30). No read-only key or least-privilege mode; the free plan's limits are quotas, not scopes, and alerts, notifiers and org members can be deleted with the same key and no confirmation (3 of 20). Results carry banners, HTTP titles and page bodies collected from arbitrary hosts, and no guidance on treating them as untrusted was found (3 of 15). `/api-info` reports the plan and credits, and no call log for the key holder was found (3 of 15). security.txt returns 404 on www.shodan.io, and no bug bounty, disclosure policy, SOC 2 or ISO 27001 was found on the pages read (0 of 20). 10 + 3 + 3 + 3 + 0 = 19.\n\n### Schema \u0026 documentation: AbuseIPDB +13\n\n- AbuseIPDB (59): The surface graded is the REST API v2, with the official MCP server noted. No OpenAPI document was found. The MCP server's two tools carry JSON Schema inputs with range constraints from pydantic Field (8 of 25). llms.txt on abuseipdb.com describes the API, endpoints, categories and reporting rules (10). Each endpoint has a purpose statement and a parameter table, the FAQ explains scoring and decay, and the docs say to act on abuseConfidenceScore rather than isWhitelisted, with little on when not to call (14 of 20). Parameters give defaults and ranges (maxAgeInDays 1 to 365, perPage 1 to 100), usageType has a listed set of values and categories are numbered, but types are not stated and the categories default is ambiguous (10 of 15). Examples in cURL, Python, PHP, C# and VBScript for every endpoint, and errors follow the JSON API shape with 422, 429 and 402 examples (12 of 15). v2 is in the path, there is no API changelog, the blog's last post is from December 2018, and the reports endpoint may change without notice (5 of 15). 8 + 10 + 14 + 10 + 12 + 5 = 59.\n- Shodan (46): The surface graded is the REST API at api.shodan.io. An OpenAPI 3.0.0 document at developer.shodan.io/api/openapi.json covers 37 paths and 44 operations, but declares no securitySchemes, no enums and a non-200 response on one operation only (15 of 25). No llms.txt on developer.shodan.io or www.shodan.io, both 404, and no Markdown docs served for agents (0 of 10). Every operation carries a description, and the reference says which calls cost credits and which plans can scan, with little on when not to use a call (12 of 20). Required flags on the key and path parameters, with `facets`, `query` and `fields` as free strings and no enums or constraints (7 of 15). Example requests and responses for every endpoint in the reference, and errors documented only as a non-200 status with an `error` field (9 of 15). No version in the path, the OpenAPI document says 1.0.0, and the only dated record of changes is the blog, whose newest post is 7 August 2024 (3 of 15). 15 + 0 + 12 + 7 + 9 + 3 = 46.\n\n### Agent ergonomics: AbuseIPDB +10\n\n- AbuseIPDB (74): check returns a compact record unless verbose is set, which adds the reports array, maxAgeInDays bounds the window, and blacklist takes a limit and a plaintext form (18 of 25). reports is paginated with page and perPage up to 100 and next and previous links, and blacklist filters by confidence, country and IP version, though check has no field selection (16 of 20). Errors carry a status and a detail an agent can act on, 429 names the daily limit and the headers say when it resets, and a 402 marks a plan limit on check-block (16 of 20). Every lookup is a GET, duplicate reports within 24 hours collapse, and both MCP tools are annotated readOnlyHint and idempotentHint (16 of 20). One required parameter per endpoint with sensible defaults. No official SDK beyond a Laravel package in the vendor's GitHub organisation and the Python MCP server (8 of 15). 18 + 16 + 16 + 16 + 8 = 74.\n- Shodan (64): `minify` on host lookups drops banners and returns ports and host facts, `minify` on search (on by default) truncates large fields and `fields` selects which fields come back, so an agent can size a response (20 of 25). `page` with 100 results a page, `facets` for summaries, `count` for a free total, and the whole filter language of the search engine (18 of 20). Errors are a non-200 status and a short message such as Invalid IP, with no code list to branch on (8 of 20). Most calls are GET reads. Alerts, notifiers, scans and org members are written with POST, PUT and DELETE and no idempotency key, and nothing marks a destructive call (10 of 20). Few required parameters and sensible defaults, but only one official SDK, the Python library, with the other twelve languages community work (8 of 15). 20 + 18 + 8 + 10 + 8 = 64.\n\n## Score by category\n\n| Category | Weight | AbuseIPDB | Shodan | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 75 | 40 | AbuseIPDB +35 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 59 | 46 | AbuseIPDB +13 |\n| Agent ergonomics | 13% (16.2 this run) | 74 | 64 | AbuseIPDB +10 |\n| Security \u0026 auth | 14% (17.5 this run) | 37 | 19 | AbuseIPDB +18 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 40 | Shodan +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 38 | 16 | AbuseIPDB +22 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 63 | 44 | AbuseIPDB +19 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **55.7 · C** | **39.5 · E** | |\n\n## Facts side by side\n\n| Fact | AbuseIPDB | Shodan |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | AbuseIPDB LLC | Shodan |\n| Hosted endpoint | no (local only) | `https://api.shodan.io` |\n| Transports | stdio | HTTP |\n| Auth | API key | API key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | none | Proprietary service. The official Python library and CLI in achillean/shodan-python are MIT |\n| Tools exposed | 2 | none |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | no |\n| MCP registry | `io.github.abuseipdb/abuseipdb-mcp` | not listed |\n| Last release | 2026-08-02 | 2023-12-17 |\n| Terms last updated | no date given | no date given |\n| Privacy policy last updated | no date given | no date given |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | yes |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | yes | yes |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Popularity | 6 stars | 3.5k stars |\n\n## Verdicts\n\n**AbuseIPDB.** A free key allows 1,000 IP checks a day with published per-endpoint limits, rate-limit headers and a 99 per cent SLA in the terms, and the official MCP server is read-only. One key covers reads, reports and deletes, the key may travel in a query string, there is no OpenAPI document, and the terms bar redistribution of results.\n\n**Shodan.** One GET endpoint per job returns ports, banners and vulnerabilities for an IP, with `minify` and `fields` to trim responses and public plan prices from a $49 one-time Membership. The key travels only in the query string with no scopes, 429 handling is undocumented, the terms were unreadable and the official library's last release was December 2023.\n\n## Before you call either\n\n### AbuseIPDB\n\n1. Send `Accept: application/json` and the key in the `Key` header; without the Accept header the API answers with an HTML page\n2. Act on `abuseConfidenceScore` rather than `isWhitelisted`, and pass `maxAgeInDays` to bound how old the reports can be (default 30, maximum 365)\n3. Watch `X-RateLimit-Remaining` per endpoint and on a 429 wait for `Retry-After`, which can be most of a day since limits reset at 00:00 UTC\n4. Use `check-block` for a subnet (up to /24 on the free plan) and `blacklist` with `confidenceMinimum` only on a paid plan; over-limit `limit` values are truncated silently\n5. Strip personal data from report comments, which are public, and prefer the read-only MCP server when the task never reports\n\n### Shodan\n\n1. Send at most 1 request a second on any plan. The reference gives no Retry-After, so back off on any non-200 and read the `error` field\n2. Use `minify=true` on `/shodan/host/{ip}` for ports and host facts only, and `fields=` on `/shodan/host/search` to keep banners out of the context\n3. Budget query credits. Page 1 of an unfiltered search is free; any filter or page 2 and beyond costs 1 credit per 100 results, and host lookups need a Membership\n4. For a quick IP check with no key, call `https://internetdb.shodan.io/{ip}`, which is weekly data and non-commercial only\n5. Treat banners, HTTP titles and page bodies in results as untrusted text from arbitrary hosts; the docs give no guidance on this\n6. Keep the key out of shared logs, since every call puts it in the URL. Alerts, notifiers and org members can be deleted with the same key\n\n## Questions\n\n### Which is better for AI agents, AbuseIPDB or Shodan?\n\nAbuseIPDB scores 55.7 (C) on agent readiness against Shodan's 39.5 (E), and leads in 6 of 7 scored categories. Shodan leads on payments \u0026 pricing.\n\n### Do AbuseIPDB and Shodan need an API key?\n\nBoth need an API key.\n\n### Can an agent call AbuseIPDB and Shodan without installing anything?\n\nAbuseIPDB runs on your own machine, with no hosted endpoint listed. Shodan has a hosted endpoint at https://api.shodan.io.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/abuseipdb-vs-shodan.json, and with the fewest tokens: https://www.anchorterminal.com/compare/abuseipdb-vs-shodan.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"abuseipdb\", \"b\": \"shodan\"}`. From a terminal: `anchor compare abuseipdb shodan`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/abuseipdb.json and https://www.anchorterminal.com/api/v1/tools/shodan.json\n\n## Other comparisons with AbuseIPDB or Shodan\n\n- [AbuseIPDB vs Censys](https://www.anchorterminal.com/compare/abuseipdb-vs-censys.md)\n- [AbuseIPDB vs GreyNoise](https://www.anchorterminal.com/compare/abuseipdb-vs-greynoise.md)\n- [AbuseIPDB vs IPinfo](https://www.anchorterminal.com/compare/abuseipdb-vs-ipinfo.md)\n- [AbuseIPDB vs Pulsedive](https://www.anchorterminal.com/compare/abuseipdb-vs-pulsedive.md)\n- [AbuseIPDB vs VirusTotal](https://www.anchorterminal.com/compare/abuseipdb-vs-virustotal.md)\n- [AbuseIPDB vs WhoisXML API](https://www.anchorterminal.com/compare/abuseipdb-vs-whoisxml-api.md)\n- [GreyNoise vs Shodan](https://www.anchorterminal.com/compare/greynoise-vs-shodan.md)\n- [IPinfo vs Shodan](https://www.anchorterminal.com/compare/ipinfo-vs-shodan.md)\n- [SecurityTrails vs Shodan](https://www.anchorterminal.com/compare/securitytrails-vs-shodan.md)\n- [Shodan vs WhoisXML API](https://www.anchorterminal.com/compare/shodan-vs-whoisxml-api.md)\n- [Pulsedive vs Shodan](https://www.anchorterminal.com/compare/pulsedive-vs-shodan.md)\n- [Censys vs Shodan](https://www.anchorterminal.com/compare/censys-vs-shodan.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "AbuseIPDB vs Shodan", "url": "" } ], "description": "AbuseIPDB scores 55.7 (C) to Shodan's 39.5 (E) for secintel indicators. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "AbuseIPDB C 55.7", "Shodan E 39.5", "scores" ], "h1": "AbuseIPDB vs Shodan", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/abuseipdb-vs-shodan", "published": "2026-10-01", "section": "tools", "title": "AbuseIPDB vs Shodan for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-03", "url": "https://www.anchorterminal.com/compare/abuseipdb-vs-shodan" }, "tokens": { "markdown": 4850, "slim": 3230 }, "version": 1 }