swarsel/crowdsec-mcp
1
0
Fork 0
mirror of https://github.com/Swarsel/crowdsec-mcp.git synced 2026-11-05 15:07:56 +01:00
Code Issues Projects Releases Packages Wiki Activity
A MCP server for CrowdSec
1 commit 1 branch 0 tags 76 KiB
  • Python 67.5%
  • Nix 32.5%
Find a file
Exact
Leon Schwarzäugl 76acb8db8d
 feat: Initial commit
2026-07-06 15:23:51 +02:00
src/crowdsec_mcp feat: Initial commit 2026-07-06 15:23:51 +02:00
.gitignore feat: Initial commit 2026-07-06 15:23:51 +02:00
flake.lock feat: Initial commit 2026-07-06 15:23:51 +02:00
flake.nix feat: Initial commit 2026-07-06 15:23:51 +02:00
package.nix feat: Initial commit 2026-07-06 15:23:51 +02:00
pyproject.toml feat: Initial commit 2026-07-06 15:23:51 +02:00
README.md feat: Initial commit 2026-07-06 15:23:51 +02:00

README.md

crowdsec-mcp

A read-only MCP server for CrowdSec, exposing decisions and alerts.

Tools

name endpoint required secret
list_decisions GET /v1/decisions bouncer key
decisions_stream GET /v1/decisions/stream bouncer key
list_alerts GET /v1/alerts machine login
get_alert GET /v1/alerts/{id} machine login

Credentials

We need two credential types:

  • Decisions need only a bouncer API key (cscli bouncers add <name>), which is inherently read-only. This alone is enough for list_decisions / decisions_stream.
  • Alerts are only reachable with machine credentials (cscli machines add), exchanged for a short-lived JWT. That credential is technically read-write on LAPI, so this server only ever issues GET requests (plus the login POST). The alert tools stay disabled unless machine credentials are configured.

Configuration (environment variables)

name default use
CROWDSEC_LAPI_URL http://localhost:8080 LAPI base URL
CROWDSEC_BOUNCER_KEY — bouncer API key (enables decision tools)
CROWDSEC_MACHINE_ID — machine id (enables alert tools)
CROWDSEC_MACHINE_PASSWORD — machine password
CROWDSEC_VERIFY_TLS true set false to skip TLS verification