Skip to main content
Glama
crowdsecurity

crowdsec-local-mcp

Official
by crowdsecurity
OverviewSchemaRelated ServersScoreDiscussions
Python
Local

Server Configuration

Describes the environment variables required to run the server.

NameRequiredDescriptionDefault

No arguments

Capabilities

Features and capabilities supported by this server

CapabilityDetails
tools
{
  "listChanged": false
}
resources
{
  "subscribe": false,
  "listChanged": false
}
experimental
{}

Tools

Functions exposed to the LLM to take actions

NameDescription
get_waf_top_level_promptA

Get the top-level CrowdSec WAF workflow prompt that explains how to approach rule and test creation

get_waf_promptA

Get the main WAF rule generation prompt for CrowdSec

get_waf_examplesB

Get WAF rule generation examples for CrowdSec

generate_waf_ruleB

Get the complete WAF rule generation prompt (main prompt + examples) for CrowdSec

generate_waf_testsC

Get the WAF test generation prompt for producing config.yaml and adapted Nuclei templates

get_waf_pr_promptB

Get the WAF PR preparation prompt for writing test assets and drafting a PR comment

get_waf_rule_challenge_promptB

Get the prompt for challenging drafted WAF rules to reduce false positives and weak detections

run_waf_testsA

Start the WAF harness and execute the provided nuclei test template against it. If this action fails because docker isn't present or cannot be run, prompt the user to set it up manually.

validate_waf_ruleB

Validate that a CrowdSec WAF rule YAML is syntactically correct

lint_waf_ruleA

Lint a CrowdSec WAF rule and provide warnings/hints for improvement

deploy_waf_ruleB

Get deployment instructions for CrowdSec WAF rules

prepare_waf_prB

Help prepare a pull request in a local clone of the CrowdSec hub repository by adding the generated WAF rule and associated test files.

fetch_nuclei_exploitA

Retrieve nuclei templates from the official repository for a CVE to help with generation of WAF rules

manage_waf_stackA

Start or stop the Docker-based CrowdSec AppSec test stack so the rule can be exercised with allowed and blocked requests. If this action fails because docker isn't present or cannot be run, prompt the user to set it up manually.

curl_waf_endpointB

Execute an HTTP request against the local WAF test endpoint (http://localhost:8081)

get_scenario_promptB

Retrieve the base prompt for authoring CrowdSec scenarios

get_scenario_examplesA

Retrieve example CrowdSec scenarios and annotations

get_scenario_expr_helpersA

Retrieve helper expressions for CrowdSec scenario authoring

validate_scenario_yamlB

Validate CrowdSec scenario YAML structure for required fields

lint_scenario_yamlB

Lint CrowdSec scenario YAML and highlight potential improvements

deploy_scenarioC

Retrieve guidance for packaging and deploying a CrowdSec scenario

manage_scenario_stackA

Manage the lifecycle of the scenario testing stack (ONLY USE FOR TESTING SCENARIOS)

explain_scenarioA
    Shows how crowdsec processes a single log line: what is extracted by the parsers, and which scenarios match.
    A match does not mean an alert is generated, only that the event was of interest for the scenario.
    This tool MUST NEVER be called with multiple log lines. If you need to test whether a scenario generates an alert, use the `test_scenario` tool instead.
    The scenario stack (manage_scenario_stack) must be running to use this tool.
test_scenarioB

Test a CrowdSec scenario against multiple log lines (effectively replaying the events as if they were occurring in real-time).

Prompts

Interactive templates invoked by user choice

NameDescription

No prompts

Resources

Contextual data attached and managed by the client

NameDescription
WAF Top-Level Workflow PromptHigh-level guidance for handling CrowdSec WAF rule requests and which tools to use
WAF Rule Generation PromptMain prompt for generating CrowdSec WAF rules from Nuclei templates
WAF Rule ExamplesExamples of WAF rule generation for CrowdSec
WAF Rule Deployment GuideStep-by-step guide for deploying CrowdSec WAF rules
WAF Test Generation PromptInstructions for producing config.yaml and adapted Nuclei templates for WAF testing
WAF PR Preparation PromptShort guidance for preparing WAF PR assets and drafting a PR comment
WAF Rule Challenge PromptAdversarial checklist for tightening WAF rules and reducing false positives
Scenario Authoring PromptFoundation prompt to guide the authoring of CrowdSec detection scenarios
Scenario ExamplesWorked scenario examples with callouts
Scenario Deployment HelperGuidance for packaging and deploying CrowdSec scenarios to local or hub environments
Scenario Expression HelpersList of supported expression helpers when writing CrowdSec scenarios

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/crowdsecurity/crowdsec-local-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server