How to Use the CrowdSec MCP in LlamaIndex

Index CrowdSec threat intelligence directly into LlamaIndex to build searchable security graphs.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect CrowdSec MCP to LlamaIndex

Create your Vinkius account to connect CrowdSec to LlamaIndex and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup CrowdSec with LlamaIndex

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Index global threat data via MCP Server

The `get_cti_smoke` tool queries the global database for an IP address. Your agent receives the current reputation score and known malicious behaviors associated with that host. LlamaIndex takes this JSON output and embeds it into your vector store. Security analysts can then ask questions like which IPs showed SSH brute-force behavior last week and get answers grounded in real data.

Vectorize local security decisions

Running `get_decisions` pulls active bans from your Local API. The response from this MCP tool includes the blocked IP, the scenario that triggered the ban, and the expiration time. Feeding this into a Document object allows your RAG application to cross-reference local blocks with documentation. You build an internal wiki that knows exactly what your firewalls are doing right now.

Maintain real-time threat contexts

Executing `get_decisions_stream` returns newly added and recently expired bans since the last poll. This keeps your RAG index fresh without doing full API pulls every five minutes. The FunctionAgent updates the vector store in the background using the MCP connection. When a developer asks why a specific service is unreachable, the system checks the live index and confirms if an active block is responsible.

Setup guide

Set up CrowdSec MCP in LlamaIndex

Prerequisites

Python 3.10+ installed
llama-index-tools-mcp package
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run pip install llama-index-tools-mcp llama-index-llms-openai. The MCP tools package provides BasicMCPClient and McpToolSpec.
2

Connect with BasicMCPClient
Point BasicMCPClient to your Vinkius endpoint URL. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. Supports SSE and Streamable HTTP transports.
3

Convert to LlamaIndex tools
Call mcp_tool_spec.to_tool_list_async() to convert all CrowdSec MCP tools into native FunctionTool objects that any LlamaIndex agent can use.
4

Run with any LLM
Create a FunctionAgent with the tools and your preferred LLM. Swap OpenAI for Anthropic, Gemini, or any LlamaIndex-supported provider.

agent.py

from llama_index.tools.mcp import BasicMCPClient, McpToolSpec
from llama_index.core.agent.workflow import FunctionAgent
from llama_index.llms.openai import OpenAI

# Connect to the MCP
mcp_client = BasicMCPClient(
    "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
)
mcp_tool_spec = McpToolSpec(client=mcp_client)

# Convert MCP tools to LlamaIndex tools
tools = await mcp_tool_spec.to_tool_list_async()

# Create and run the agent
agent = FunctionAgent(
    tools=tools,
    llm=OpenAI(model="gpt-4o"),
    system_prompt="You have access to CrowdSec tools.",
)
response = await agent.run("List recent CrowdSec data")

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by CrowdSec. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect CrowdSec now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about CrowdSec MCP in LlamaIndex

Install llama-index-tools-mcp and set up a BasicMCPClient. Call mcp_tool_spec.to_tool_list_async to convert the endpoints into callable functions for your agent.

The local API only returns currently active decisions. If you want historical analysis, you need to poll the stream and store those records in your own vector database.

Vinkius handles the authentication layer for the managed MCP Server. You just provide your single endpoint token when initializing the client.

The LLM extracts the IP address from your prompt or surrounding documents. It then passes that string as the required argument to the tool.

IP addresses and local ban scenarios process through ephemeral containers. Vinkius destroys the zero-trust environment after each request, ensuring your LlamaIndex workflow leaves no residual data on the server.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript