# IPinfo vs Shodan (slim)

> IPinfo scores 62.7 (B) to Shodan's 39.5 (E) for secintel ip enrichment. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/ipinfo-vs-shodan.md (~4,100 tokens) · this version ~2,580 tokens · JSON https://www.anchorterminal.com/compare/ipinfo-vs-shodan.json · canonical https://www.anchorterminal.com/compare/ipinfo-vs-shodan
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-04
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

IPinfo scores 62.7 (B) on agent readiness against Shodan's 39.5 (E), and leads in 5 of 7 scored categories. Both do secintel ip enrichment.

- IPinfo: B 62.7, rank #494 of 1349 · https://www.anchorterminal.com/tools/ipinfo.min.md
- Shodan: E 39.5, rank #1218 of 1349 · https://www.anchorterminal.com/tools/shodan.min.md
- IPinfo, good for An agent that needs to enrich an IP with location, network and anonymiser flags at volume, free for country and ASN, paid for city and privacy signals. Ahead on Schema & documentation, 76 against 46; Agent ergonomics, 84 against 64; Security & auth, 60 against 19; Maintenance & community, 85 against 16; Transparency & trust, 70 against 44. Also Runs on your own machine; Free to start without a card.
- Shodan, good for An agent that needs to know what is exposed on an IP or a range, which ports, products and CVEs, and to watch a network for change.

| Category | IPinfo | Shodan |
| --- | --- | --- |
| Reliability (16%) | 38 | 40 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 76 | 46 |
| Agent ergonomics (13%) | 84 | 64 |
| Security & auth (14%) | 60 | 19 |
| Payments & pricing (10%) | 40 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 85 | 16 |
| Transparency & trust (7%) | 70 | 44 |

| Fact (where they differ) | IPinfo | Shodan |
| --- | --- | --- |
| Vendor | IPinfo Inc. | Shodan |
| Hosted endpoint | `https://mcp.ipinfo.io/` | `https://api.shodan.io` |
| Transports | Streamable HTTP, stdio | HTTP |
| Auth | OAuth or key | API key |
| Licence | none | Proprietary service. The official Python library and CLI in achillean/shodan-python are MIT |
| Tools exposed | 6 | none |
| Read-only variant documented | yes | no |
| llms.txt | yes | no |
| MCP registry | `io.github.ipinfo/mcp` | not listed |
| Last release | 2026-10-29 | 2023-12-17 |
| Terms last updated | 2024-06-03 | no date given |
| Privacy policy last updated | 2026-10-29 | no date given |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 2 stars | 3.5k stars |

Why the edge:
- Maintenance & community, IPinfo +69: IPinfo 85 (Read as a closed service with an official MCP server and SDKs. MCP server v0.2.3 on 29 October 2026, a commit on 3 November, and SDK repositories pushed in October and November (30). Eight MCP releases since 8 September 2026, v0.1.12 to v0.2.3 (20). GitHub releases for the MCP server, a community forum, a help centre and a support form, but no changelog for the API and GitHub issue pages could not be read (10 of 15). The MCP server is in the official registry as io.github.ipinfo/mcp and the SDKs are official (15). The MCP package has tests, CI with pinned actions, CodeQL and Scorecard workflows and a lock file (10). 30 + 20 + 10 + 15 + 10 = 85.); Shodan 16 (No dated API change found. The blog's newest post is 7 August 2024, and the official Python library `shodan` 1.31.0 was published on 17 December 2023 with the repository's last push on 5 August 2024 (0 of 30). No releases or dated changelog entries in the last 90 days (0 of 20). 63 open issues on the Python repository with no push since August 2024; a support email and a help centre exist (5 of 25). The official Python SDK still installs but is two years old, and the other clients are community work (8 of 15). The repository has no CI configuration and no CHANGELOG entry since 1.28.0 of July 2022 (3 of 10). 0 + 0 + 5 + 8 + 3 = 16.)
- Security & auth, IPinfo +41: IPinfo 60 (One access token per account, accepted as a Bearer header, HTTP Basic or a token query parameter, with no scopes found; the hosted MCP server adds OAuth with short-lived tokens (20 less 10 for the query string, plus 4 for OAuth on the MCP server, so 14). Every endpoint is a read and tools return ACCESS_DENIED outside the plan, but there is no read-only or restricted token (16 of 20). Responses are structured network data rather than third-party free text (10 of 15). The dashboard shows request graphs and lookup history per the pricing page, with no per-call log documented (8 of 15). security.txt valid until 21 August 2027 with a PGP key, a SECURITY.md with 2-day acknowledgement and a 90-day disclosure window, no bug bounty or certification found beyond a bank-grade claim (12 of 20). 14 + 16 + 10 + 8 + 12 = 60.); Shodan 19 (One key per account with no scopes, sent as `key=` in the query string on every documented call and in the OpenAPI document, with no header option. Read as a plain key, the way the Alpha Vantage listing was read, less 10 for the query string (10 of 30). No read-only key or least-privilege mode; the free plan's limits are quotas, not scopes, and alerts, notifiers and org members can be deleted with the same key and no confirmation (3 of 20). Results carry banners, HTTP titles and page bodies collected from arbitrary hosts, and no guidance on treating them as untrusted was found (3 of 15). `/api-info` reports the plan and credits, and no call log for the key holder was found (3 of 15). security.txt returns 404 on www.shodan.io, and no bug bounty, disclosure policy, SOC 2 or ISO 27001 was found on the pages read (0 of 20). 10 + 3 + 3 + 3 + 0 = 19.)
- Schema & documentation, IPinfo +30: IPinfo 76 (The surface graded is the REST API, with the hosted MCP server noted. A public OpenAPI 3.0 document with 48 operations, and the MCP tools carry JSON Schema inputs (25). llms.txt and llms-full.txt, and every developer page is served as Markdown (10). Each tier page says what it returns and which plan unlocks it, and the MCP tool descriptions say which tiers each option needs, with little on when not to call (14 of 20). Schemas and examples on most responses, path parameters typed, but 401 is undocumented and some operations lack the 429 response (11 of 15). Examples in several languages on every page; only 429 is documented as an error, with no error body shape (9 of 15). A new API system since 2025 with the legacy one kept, but no public changelog, no version in the path and the OpenAPI document at 1.0.0 (7 of 15). 25 + 10 + 14 + 11 + 9 + 7 = 76.); Shodan 46 (The surface graded is the REST API at api.shodan.io. An OpenAPI 3.0.0 document at developer.shodan.io/api/openapi.json covers 37 paths and 44 operations, but declares no securitySchemes, no enums and a non-200 response on one operation only (15 of 25). No llms.txt on developer.shodan.io or www.shodan.io, both 404, and no Markdown docs served for agents (0 of 10). Every operation carries a description, and the reference says which calls cost credits and which plans can scan, with little on when not to use a call (12 of 20). Required flags on the key and path parameters, with `facets`, `query` and `fields` as free strings and no enums or constraints (7 of 15). Example requests and responses for every endpoint in the reference, and errors documented only as a non-200 status with an `error` field (9 of 15). No version in the path, the OpenAPI document says 1.0.0, and the only dated record of changes is the blog, whose newest post is 7 August 2024 (3 of 15). 15 + 0 + 12 + 7 + 9 + 3 = 46.)
- Transparency & trust, IPinfo +26: IPinfo 70 (A closed service with clear terms naming IPinfo Inc. and the governing law, with the MCP server and SDKs under Apache-2.0 (17 of 30). The privacy policy of 29 October 2026 lists processors, links a DPA and says data is kept as long as needed, with no periods (16 of 30). No deprecation policy; the legacy API is maintained for existing users with no end date (6 of 20). Processors named and hosting in the United States (16 of 20). 17 + 16 + 6 + 16 = 55.); Shodan 44 (Editorial half. A closed service whose terms at static.shodan.io/legal/terms.html were not read, because that host answers 403 to robots.txt, so their clarity can't be assessed; the Python library is MIT (5 of 30). The privacy policy at account.shodan.io/privacy carries no date, names no legal entity, retention period, data location or subprocessor, and says Shodan may share information with advertisers, business partners, sponsors and other third parties (5 of 30). The help centre says export credits are deprecated and no longer sold, with no date; no deprecation policy found (3 of 20). No subprocessors or data locations disclosed (0 of 20). 5 + 5 + 3 + 0 = 13.)
- Agent ergonomics, IPinfo +20: IPinfo 84 (Field paths such as /country return one value, the Lite and lookup objects are small, and the MCP server has six compact tools with a per-session cache (23 of 25). Batch takes up to 1,000 lookups with filter=1 to drop empty results; no pagination is needed on single lookups, and ASN and range responses have no size control (16 of 20). The only documented error is 429; the MCP server returns coded errors with a message and a suggestion (12 of 20). Every call is a read, batch is a read over POST, and the MCP tools carry tool annotations (18 of 20). One parameter per call, sensible defaults and official SDKs in eleven languages (15). 23 + 16 + 12 + 18 + 15 = 84.); Shodan 64 (`minify` on host lookups drops banners and returns ports and host facts, `minify` on search (on by default) truncates large fields and `fields` selects which fields come back, so an agent can size a response (20 of 25). `page` with 100 results a page, `facets` for summaries, `count` for a free total, and the whole filter language of the search engine (18 of 20). Errors are a non-200 status and a short message such as Invalid IP, with no code list to branch on (8 of 20). Most calls are GET reads. Alerts, notifiers, scans and org members are written with POST, PUT and DELETE and no idempotency key, and nothing marks a destructive call (10 of 20). Few required parameters and sensible defaults, but only one official SDK, the Python library, with the other twelve languages community work (8 of 15). 20 + 18 + 8 + 10 + 8 = 64.)