crowdsec-local-mcp
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get_waf_top_level_promptA | Get the top-level CrowdSec WAF workflow prompt that explains how to approach rule and test creation |
| get_waf_promptA | Get the main WAF rule generation prompt for CrowdSec |
| get_waf_examplesB | Get WAF rule generation examples for CrowdSec |
| generate_waf_ruleB | Get the complete WAF rule generation prompt (main prompt + examples) for CrowdSec |
| generate_waf_testsC | Get the WAF test generation prompt for producing config.yaml and adapted Nuclei templates |
| get_waf_pr_promptB | Get the WAF PR preparation prompt for writing test assets and drafting a PR comment |
| get_waf_rule_challenge_promptB | Get the prompt for challenging drafted WAF rules to reduce false positives and weak detections |
| run_waf_testsA | Start the WAF harness and execute the provided nuclei test template against it. If this action fails because docker isn't present or cannot be run, prompt the user to set it up manually. |
| validate_waf_ruleB | Validate that a CrowdSec WAF rule YAML is syntactically correct |
| lint_waf_ruleA | Lint a CrowdSec WAF rule and provide warnings/hints for improvement |
| deploy_waf_ruleB | Get deployment instructions for CrowdSec WAF rules |
| prepare_waf_prB | Help prepare a pull request in a local clone of the CrowdSec hub repository by adding the generated WAF rule and associated test files. |
| fetch_nuclei_exploitA | Retrieve nuclei templates from the official repository for a CVE to help with generation of WAF rules |
| manage_waf_stackA | Start or stop the Docker-based CrowdSec AppSec test stack so the rule can be exercised with allowed and blocked requests. If this action fails because docker isn't present or cannot be run, prompt the user to set it up manually. |
| curl_waf_endpointB | Execute an HTTP request against the local WAF test endpoint (http://localhost:8081) |
| get_scenario_promptB | Retrieve the base prompt for authoring CrowdSec scenarios |
| get_scenario_examplesA | Retrieve example CrowdSec scenarios and annotations |
| get_scenario_expr_helpersA | Retrieve helper expressions for CrowdSec scenario authoring |
| validate_scenario_yamlB | Validate CrowdSec scenario YAML structure for required fields |
| lint_scenario_yamlB | Lint CrowdSec scenario YAML and highlight potential improvements |
| deploy_scenarioC | Retrieve guidance for packaging and deploying a CrowdSec scenario |
| manage_scenario_stackA | Manage the lifecycle of the scenario testing stack (ONLY USE FOR TESTING SCENARIOS) |
| explain_scenarioA | |
| test_scenarioB | Test a CrowdSec scenario against multiple log lines (effectively replaying the events as if they were occurring in real-time). |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| WAF Top-Level Workflow Prompt | High-level guidance for handling CrowdSec WAF rule requests and which tools to use |
| WAF Rule Generation Prompt | Main prompt for generating CrowdSec WAF rules from Nuclei templates |
| WAF Rule Examples | Examples of WAF rule generation for CrowdSec |
| WAF Rule Deployment Guide | Step-by-step guide for deploying CrowdSec WAF rules |
| WAF Test Generation Prompt | Instructions for producing config.yaml and adapted Nuclei templates for WAF testing |
| WAF PR Preparation Prompt | Short guidance for preparing WAF PR assets and drafting a PR comment |
| WAF Rule Challenge Prompt | Adversarial checklist for tightening WAF rules and reducing false positives |
| Scenario Authoring Prompt | Foundation prompt to guide the authoring of CrowdSec detection scenarios |
| Scenario Examples | Worked scenario examples with callouts |
| Scenario Deployment Helper | Guidance for packaging and deploying CrowdSec scenarios to local or hub environments |
| Scenario Expression Helpers | List of supported expression helpers when writing CrowdSec scenarios |
TDQS
Scored across 24 tools
Many tools have overlapping purposes, especially the prompt-getting tools (get_waf_top_level_prompt, get_waf_prompt, get_waf_examples, generate_waf_rule). The testing workflow is ambiguous between run_waf_tests, manage_waf_stack, and curl_waf_endpoint. Agents could easily confuse which tool to use for a given task.
Most names use snake_case with verb_noun pattern, but verbs vary inconsistently (get, generate, validate, lint, deploy, prepare, fetch, manage, curl, explain, test). Some tools omit the 'waf' prefix (e.g., fetch_nuclei_exploit, manage_scenario_stack) breaking the pattern. The naming is readable but not uniform.
24 tools is on the higher side, but the server covers two distinct domains (WAF rules and scenarios). However, many prompt-related tools could be consolidated (e.g., get_waf_prompt, get_waf_top_level_prompt, get_waf_examples). The count feels slightly bloated.
The tool set covers the full lifecycle for both WAF rules and scenarios: generation, validation, linting, testing, deployment, and PR preparation. Minor gaps like missing a direct 'update' operation, but the domain is authoring-oriented, which is well-covered.