# CrowdSec MCP for AI Agents AI Agent Connect

> CrowdSec MCP lets your AI agent handle threat intelligence and network security. Query local blocks, monitor real-time security updates, and check global IP reputations to defend your infrastructure without manual log digging.

## Overview
- **Category:** fort-knox
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_2elfrol73nICZiMR18YQg2LgVuwctPXwaxqoZfA4/ai-agent-connect
- **Tags:** threat-intelligence, firewall-management, ip-reputation, network-security, intrusion-prevention

## Description

Instead of hunting through logs or running complex CLI commands to see why an IP got blocked, you can just ask your agent. This Connector connects your CrowdSec security engine to your AI client so you can talk to your security data like a human. You can check if a specific IP is currently blocked on your local network, see what new threats are hitting your system in real-time, or find out if a random IP has a bad reputation globally. It turns your agent into a security analyst that knows your specific defense posture. When you're managing these defenses through the Vinkius catalog, you get a unified way to handle these complex security tasks without switching tabs or mastering a dozen different commands. It's about moving from "how do I find this?" to "tell me why this IP is flagged."

## Tools

### get_cti_smoke
Get the global reputation and behavior scores for a specific IP address. This helps you decide if a connection is a known threat.

### get_decisions_stream
Poll for a live feed of new and deleted security decisions from your local API. Use this to stay updated on active blocks in real-time.

### get_decisions
Query your local CrowdSec database for specific decisions on an IP or range. This lets you see the exact reason why a block was applied.

## Prompt Examples

**Prompt:** 
```
Is IP 192.168.1.45 currently blocked on our local system and why?
```

**Response:** 
```
I've checked your local CrowdSec decisions. **IP 192.168.1.45** is currently blocked.

*   **Decision:** Block
*   **Reason:** `http-backdoor-attempts`
*   **Time Applied:** 2 hours ago
*   **Expiry:** 22 hours remaining
*   **Metadata:** High confidence score, triggered by multiple failed login attempts on port 80.
```

**Prompt:** 
```
Give me a summary of the latest security events from the last 10 minutes.
```

**Response:** 
```
Here are the recent security updates from your CrowdSec stream:

| Time | Action | Source IP | Reason |
| :--- | :--- | :--- | :--- |
| 14:02 | New Block | 193.x.x.x | SSH Brute Force |
| 14:05 | New Block | 194.x.x.x | Port Scanning |
| 14:08 | Deleted | 10.0.0.5 | Expired Block |

**Summary:** 2 new blocks were added for brute force and scanning activity.
```

**Prompt:** 
```
What's the global reputation for the IP 45.33.22.11?
```

**Response:** 
```
According to the CrowdSec CTI network, **45.33.22.11** has the following reputation:

*   **Classification:** Known Malicious Actor
*   **Behavior:** Frequently reported for scanning activities globally.
*   **Noise Score:** High
*   **Status:** Currently flagged in multiple community blocklists.

I recommend keeping this IP blocked on your local firewall.
```

## Capabilities

### Check local IP blocks
See exactly which IPs are currently blocked on your system and the reasons why.

### Watch security updates
Get a live feed of new and deleted security decisions from your local database.

### Look up global reputation
Find out if an IP is known for malicious behavior worldwide using CrowdSec CTI.

### Audit security metadata
Inspect the specific classifications and metadata for suspicious actors instantly.

### Monitor threat streams
Keep your security context updated with real-time data polling from your local API.

## Use Cases

### Rapid Incident Response
An engineer asks "Why is this IP blocked?" and gets the specific reason and timestamp immediately using get_decisions.

### Proactive Defense Verification
A dev asks "Is this new range known for scanning?" before whitelisting it to prevent security holes using get_cti_smoke.

### Automated Security Auditing
An admin asks "Show me all new blocks from the last hour" to spot a new pattern of attack using get_decisions_stream.

### Reputation Checking
A team checks "What's the reputation of this Tor exit node?" before deciding on a firewall rule using get_cti_smoke.

## Benefits

- Stop digging through logs by using get_decisions to see exactly why an IP was blocked in seconds.
- Get instant context on external threats using get_cti_smoke to verify global IP reputation.
- Stay ahead of attacks with get_decisions_stream providing a live feed of new security events.
- Reduce response time for incident response by asking your agent for security metadata instead of manual lookups.
- Simplify security auditing for your whole team by using natural language to query complex local API data.

## How It Works

The bottom line is you get a conversational interface for your entire CrowdSec security engine.

1. Enter your CrowdSec LAPI URL, LAPI Key, and CTI Key into your client settings.
2. Subscribe to the Connector via the Vinkius marketplace to link the connection.
3. Ask your agent to query reputations, stream live events, or check specific blocks.

## Frequently Asked Questions

**What is the CrowdSec MCP?**
It's a way to let your AI agent talk directly to your CrowdSec security engine to check blocks and reputation.

**Can I use CrowdSec MCP to see why an IP was blocked?**
Yes, it lets your agent query your local API to show the exact reason and metadata for any decision.

**Does CrowdSec MCP work with my local LAPI?**
It's designed specifically to connect to your local API so you can manage your own security data.

**How does CrowdSec MCP help with incident response?**
It speeds things up by letting you ask questions about active threats and IP reputations in plain English.

**Can I get real-time updates with CrowdSec MCP?**
Yes, you can poll for a live stream of new and deleted decisions to keep your agent's context current.

**Is CrowdSec MCP for global threat intelligence?**
It connects to the CrowdSec CTI network to give you global reputation and behavior data for any IP.

**Can I check if a specific IP address is currently blocked in my local CrowdSec instance?**
Yes! Use the `get_decisions` tool providing the IP address. Your agent will query your Local API and return any active decisions, including the reason and duration of the block.

**How do I see the latest security threats detected by my server in real-time?**
You can use the `get_decisions_stream` tool. This allows your agent to poll for new and deleted decisions, giving you a clear view of recent security activity on your infrastructure.

**Can I verify an IP's global reputation even if it hasn't attacked my server yet?**
Absolutely. The `get_cti_smoke` tool queries the global CrowdSec CTI network. It provides background information, attack behaviors, and risk scores for any IP based on community data.