Skip to main content
Glama
Sign In
crowdsec-mcp

crowdsec-mcp

by vbc-it
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

crowdsec-mcp

A read-only MCP server for CrowdSec, exposing decisions and alerts.

Tools

name

endpoint

required secret

list_decisions

GET /v1/decisions

bouncer key

decisions_stream

GET /v1/decisions/stream

bouncer key

list_alerts

GET /v1/alerts

machine login

get_alert

GET /v1/alerts/{id}

machine login

Related MCP server: LimaCharlie MCP

Credentials

We need two credential types:

  • Decisions need only a bouncer API key (cscli bouncers add <name>), which is inherently read-only. This alone is enough for list_decisions / decisions_stream.

  • Alerts are only reachable with machine credentials (cscli machines add), exchanged for a short-lived JWT. That credential is technically read-write on LAPI, so this server only ever issues GET requests (plus the login POST). The alert tools stay disabled unless machine credentials are configured.

Configuration (environment variables)

name

default

use

CROWDSEC_LAPI_URL

http://localhost:8080

LAPI base URL

CROWDSEC_BOUNCER_KEY

—

bouncer API key (enables decision tools)

CROWDSEC_MACHINE_ID

—

machine id (enables alert tools)

CROWDSEC_MACHINE_PASSWORD

—

machine password

CROWDSEC_VERIFY_TLS

true

set false to skip TLS verification

Available Tools

4 tools
decisions_streamD

Inputs: scopes, origins, startup, scenarios_containing, +1 more. Returns: object

get_alertD

Inputs: alert_id (required). Returns: object

list_alertsD

Inputs: ip, limit, range, scope, +7 more. Returns: result

list_decisionsD

Inputs: ip, type, range, scope, +4 more. Returns: result

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    D1.8/5.0

    Scored across 4 tools

    Disambiguation4/5

    The four tools target two distinct resources (decisions and alerts) with clear action prefixes (list, get, stream). The main ambiguity is between list_decisions and decisions_stream, both dealing with decisions, but one implies a static list and the other a real-time stream. Overall, the purposes are distinguishable.

    Naming Consistency3/5

    Three tools follow the verb_noun pattern (list_decisions, list_alerts, get_alert), but decisions_stream breaks this pattern with a noun_noun structure. The underscores are consistent, but the mix of verb-leading and noun-leading names is a minor inconsistency.

    Tool Count4/5

    With 4 tools, the set is within the typical well-scoped range (3-15). The count feels minimal but appropriate for a read-only client focused on listing and streaming decisions and alerts. It could be slightly more comprehensive, but it is not excessive.

    Completeness3/5

    The domain is CrowdSec decisions and alerts, and the set covers listing and streaming decisions, plus listing and fetching alerts. Notable gaps include a get_decision operation and any mutation endpoints (create/update/delete). These are common expectations in such a domain, so the surface is incomplete but not severely so.

    Maintenance

    ActivityInactive
    ResponsivenessNo recent community issues

    Resources

    Related MCP Connectors

    Related MCP Servers

    • openobserve-community-mcp

      alilxxey
      A
      license
      B
      quality
      D
      maintenance
      A read-only MCP server for OpenObserve Community Edition that works over the REST API. Provides tools for searching logs, traces, stream schemas, and dashboards - no Enterprise license required.
      8
      89 PyPI
      16
      GPL 3.0

    • LimaCharlie MCP

      geoffbelknap
      A
      license
      C
      quality
      D
      maintenance
      A local MCP server for the LimaCharlie security platform that provides investigation, administration, and content-review workflows via a broad read-only tool surface with explicit organization scoping and audit logging.
      100
      MIT

    • crowdsec-ops-mcp

      frli4797
      F
      license
      A
      quality
      C
      maintenance
      Local MCP server for CrowdSec operations, enabling inspection of decisions/alerts, summaries, and generation of audited single-IP action proposals without executing changes.
      12
      -