An astronaut overseeing a futuristic data hub
Download PDFMarkdown Version

Connect CrowdSec to ChatGPT, Claude and Gemini

Set it up once and it works in ChatGPT, Claude, Cursor, and any other client you love. It all runs safely in the background, so you can relax and focus on what really matters. Turn your AI agent into a real-time security analyst.

Ask AI about this Connector

Developed, maintained, and hosted by Vinkius.

MCP VERIFIED · PRODUCTION READY · VINKIUS GUARANTEED

Waiting for input…

Works with modern AI clients that support MCP, including ChatGPT, Claude, Cursor, and more.

ChatGPTClaudeCursorPerplexityGeminiMicrosoft CopilotRaycastMeta AI

Your AI does the work. We keep it safe and sound.

No other AI tool gives you this. Your workflow runs in the client you already love, your account stays protected, and you decide what the agent can and cannot do. It is the whole reason to make the switch.

Each Connector lives inside our infrastructure, the same place where your workflow runs. The three things below are already part of it, working quietly in the background so you never have to think about them. Nothing to add, nothing to set up, nothing to worry about.

A futuristic MCP client docking bay
V8 Isolate01

Each Connector runs inside its own sealed environment.

Each Connector runs inside its own sealed V8 runtime — no access to your files, your system, or other servers. A Connector never sees past its own request.

Kill Switch02

One switch stops every agent. Instantly.

One action deactivates every Connector, revokes every token, and ends every session at once. AI Governance keeps the record.

FinOps per User03

Spending limits that pause instead of surprise.

Every user keeps their own connections and credentials, isolated from everyone else. Anything that would cross your spending limit is held for your approval, not billed.

Three controls, built into the layer your AI connects through.

Curated set · 3 capabilities

We ship only the actions that matter.

Capability set01 / 01

01-03

3 capabilities in this set.

Part of 3 available through CrowdSec.

  1. 01

    Get decisions stream

    Polls your Local API for any new or deleted decisions. Use this to keep your AI agent updated on real-time security changes.

  2. 02

    Get cti smoke

    Fetches global reputation data for a specific IP. This capability pulls classifications and behaviors from the CrowdSec Community Threat Intelligence network.

  3. 03

    Get decisions

    Queries your CrowdSec Local API for existing decisions. It lets your agent see active blocks or specific IP ranges currently under scrutiny.

Real work

What teams actually run

01

Incident Response

An engineer asks the agent to verify if a suspicious IP hitting the web server has a high global reputation score.

02

Real-time Monitoring

A DevOps engineer uses the agent to poll for new bans occurring on the network.

03

Security Auditing

A system admin asks the agent to list all active decisions for a specific IP range.

04

Threat Intelligence Gathering

A security professional uses the agent to fetch classifications for suspicious actors from the CTI network.

Automate a task

Put CrowdSec to work on one thing.

Step-by-step automations your AI runs through this Connector: the workflow, the prompts to start with, and the exact capabilities behind each move.

One connector, every AI

CrowdSec works with the most popular AI clients.

These are the most popular clients, each with a step-by-step guide: one link, set up once, with governance and visibility built in. And because everything runs on the MCP standard, the same connection also works in any other compatible client — nothing to rebuild.

ClaudeClaudeChatGPTChatGPTGeminiGeminiPerplexityPerplexityGrokGrokMicrosoft CopilotMicrosoft CopilotCursorCursorVS CodeVS CodeWindsurfWindsurfJetBrainsJetBrainsClineClineLangChainLangChainVercel AI SDKVercel AI SDKLovableLovableZ.aiZ.aiRaycastRaycastQwen CodeQwen CodeKimi CodeKimi CodeLe ChatLe Chat

Building your own app? The connector is yours to use.

You don't need a client to put CrowdSec to work: the same hosted connection plugs into your own applications and agent code, with the same governance on every request. Build with it, chat with it — one connection for both.

Observed, not estimated

946ms average. Fast in production.

CrowdSec is checked daily against the live service.

Daily averagePeak 1070ms
Oct 3Today
Fastest day
746ms
Slowest day
1070ms
14-day trend
Slowing+7%

Connect your client

One URL. Every client.

Activate the Connector, copy your link, and paste it into the client you already use. 3 capabilities arrive ready to run.

Preview access · not provider authentication

The vk_preview_* token belongs to Vinkius preview infrastructure. It lets Claude discover and display the capabilities of CrowdSec, so you can see the experience inside your AI.

It does not authenticate your account with CrowdSec. Actions requiring credentials or live account data may not run until you activate the Connector and authorize the service.

CrowdSec Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_2elfrol73nICZiMR18YQg2LgVuwctPXwaxqoZfA4/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — CrowdSec capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "crowdsec-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_2elfrol73nICZiMR18YQg2LgVuwctPXwaxqoZfA4/mcp"
    }
  }
}
  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Step-by-step instructions for each client are in the guide. How to connect

Guided setup for Claude? Set up CrowdSec in Claude and other AIs

See all the AI clients this connector works with ↑

Who it's for

Built for the work CrowdSec owners hand off.

Security and operations professionals who want to integrate threat intelligence into their existing development or monitoring workflows.

  • 01

    Security Engineers

    They hand off the task of retrieving local decision statuses and global reputation metrics to their agent.

  • 02

    DevOps Teams

    They use the agent to monitor security streams and verify IP behaviors while working in their IDE.

  • 03

    System Administrators

    They delegate the auditing of blocked ranges and suspicious network activity to their AI client.

FAQ

Questions CrowdSec owners ask.

  • 01

    How do I connect my CrowdSec data to my AI client?

    You subscribe to the MCP on Vinkius and enter your LAPI URL, LAPI Key, and CTI Key. Once connected, your AI client can immediately start using the capabilities.

  • 02

    Which AI clients can use this MCP?

    This MCP works with any compatible client, including Claude, Cursor, and Windsurf.

  • 03

    Can I check global IP reputation through my agent?

    Yes, the agent uses the get_cti_smoke capability to pull reputation, behaviors, and classifications from the CrowdSec Community Threat Intelligence network.

  • 04

    Does this replace the CrowdSec CLI?

    It doesn't replace it, but it provides a way to perform the same checks through natural language within your existing workspace.

  • 05

    How does the agent stay updated on new blocks?

    The agent can use the get_decisions_stream capability to poll for new or deleted decisions from your Local API.

  • 06

    Can I check if a specific IP address is currently blocked in my local CrowdSec instance?

    Yes! Use the get_decisions capability providing the IP address. Your agent will query your Local API and return any active decisions, including the reason and duration of the block.

  • 07

    How do I see the latest security threats detected by my server in real-time?

    You can use the get_decisions_stream capability. This allows your agent to poll for new and deleted decisions, giving you a clear view of recent security activity on your infrastructure.

  • 08

    Can I verify an IP's global reputation even if it hasn't attacked my server yet?

    Absolutely. The get_cti_smoke capability queries the global CrowdSec CTI network. It provides background information, attack behaviors, and risk scores for any IP based on community data.

Explore

More in Fort Knox

Suggestions

Connect CrowdSec to Claude, Cursor, ChatGPT & more