• ANALYSIS
  • AUDIT
  • REPORTING
  • HUMAN

How to audit local security decisions with your AI

Connect CrowdSec to your AI client to turn raw block data into actionable security intelligence.

Ask AI about this page

Short answer

How can I audit my local security decisions with AI?

Your AI uses the get_decisions tool to pull a list of all active IP blocks from your CrowdSec LAPI. You can then ask your agent to find patterns, identify high-frequency attackers, or summarize recent blocking activity.

What you get from the data.

Security insights at your fingertips.

Once the connection is live, your AI handles the heavy lifting of data retrieval and analysis.

ANALYSIS

Identify attack patterns

The AI scans the list of blocked IPs to find commonalities in source networks or behaviors. You get a clear picture of what's hitting your perimeter.

AUDIT

Verify active blocks

Your agent pulls the current decision set to confirm exactly which IPs are being throttled or blocked. This ensures your local security state matches your expectations.

REPORTING

Summarize threat activity

Instead of digging through logs, you ask your agent for a summary of the most active offenders. It turns raw LAPI data into a readable briefing.

HUMAN

Manual intervention

The AI identifies the threats, but you decide if a block should be lifted or if a new rule is needed. The agent provides the context, you make the call.

The workflow

What your AI does when the data arrives.

The AI acts as a bridge between your CrowdSec LAPI and your chat interface.

  1. Fetch block data

    The agent reaches into your local CrowdSec instance to grab the current list of active decisions.

    get_decisions

  2. Filter and group

    Your AI organizes the retrieved IP addresses by reason, duration, or frequency.

    get_decisions

  3. Detect anomalies

    The agent looks for spikes in blocking activity that might indicate a coordinated attack.

    get_decisions

  4. Draft summaries

    The AI prepares a concise overview of the current security posture based on the decision data.

    get_decisions

Try it

Copy these to start.

Use these prompts to begin auditing your CrowdSec decisions.

Starting points

These are starting points. You can swap out specific IP ranges or timeframes to get more precise answers.

CrowdSec Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_2elfrol73nICZiMR18YQg2LgVuwctPXwaxqoZfA4/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — CrowdSec capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "crowdsec-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_2elfrol73nICZiMR18YQg2LgVuwctPXwaxqoZfA4/mcp"
    }
  }
}
Copy into chat04

  • List all the IP addresses currently blocked in my CrowdSec environment.

  • Which IP addresses have been blocked most frequently in the last hour?

  • Summarize the recent security decisions from my CrowdSec LAPI.

  • Are there any specific IP ranges that are responsible for most of my current blocks?

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect CrowdSec once, then ask.

Add your CrowdSec credentials to Vinkius. Your connection is encrypted, and you can start querying your LAPI immediately.

Connect CrowdSec to your AI

FAQ

How this task behaves.

  • 01

    Can the AI unblock an IP address?

    No. This Connector only has the capability to read decisions. You must manually unblock IPs through your local CrowdSec configuration.

  • 02

    Does the AI see my full system logs?

    No. The AI only sees the specific decision data retrieved via the get_decisions tool.

  • 03

    Can I ask for decisions from a specific timeframe?

    Yes, you can ask your agent to look for patterns or specific activity within the data it retrieves from the LAPI.

  • 04

    Will the AI change my CrowdSec configuration?

    No. The AI cannot modify, delete, or add any decisions or rules in your environment.

  • 05

    How often does the AI refresh the data?

    The AI fetches fresh data from your LAPI every time you run a command or ask a question about current decisions.

  • More questions about CrowdSec? See everything the CrowdSec Connector can do

Connect CrowdSec to Claude, Cursor, ChatGPT & more