crowdsecurity/crowdsec-local-mcp

人生苦短，写YAML太短暂了，只要礼貌地请求！

一个模型上下文协议（MCP）服务器，用于生成、验证和部署 CrowdSec WAF 规则和场景。

特色

WAF规则特色

• WAF 规则生成：从用户输入或 CVE 引用生成 CrowdSec WAF 规则
• 验证：验证WAF规则的语法正确性
• 线条提示：获取警告和提示以改进你的WAF规则
• 部署指南：逐步部署说明
• Docker 测试工具箱：启动 CrowdSec + nginx + bouncer 以执行误报/误报规则
• 核心查找：快速跳转到官方projectdiscovery/nuclei-templates仓库中已有的模板，针对特定CVE

场景功能

• CrowdSec场景生成：生成CrowdSec场景
• 验证：验证情景的语法正确性
• Linting：获取警告和提示以改进你的情景
• 部署指南：逐步部署说明
• Docker 测试 Harness：启动 CrowdSec 以测试场景行为

演示

WAF规则的创建与测试

• 从自然语言创建规则
• 基于CVE引用的规则创建

Life is too short to write YAML, just ask nicely!

A Model Context Protocol (MCP) server to generate, validate, and deploy CrowdSec WAF rules & Scenarios.

Features

WAF Rules Features

• WAF Rule Generation: Generate CrowdSec WAF rules from user input or a CVE reference
• Validation: Validate syntaxical correctness of WAF rules
• Linting: Get warnings and hints to improve your WAF rules
• Deployment Guide: Step-by-step deployment instructions
• Docker Test Harness: Spin up CrowdSec + nginx + bouncer to exercise rules for false positives/negatives
• Nuclei Lookup: Quickly jump to existing templates in the official projectdiscovery/nuclei-templates repository for a given CVE

Scenarios Features

• CrowdSec Scenarios Generation: Generate CrowdSec scenarios
• Validation: Validate syntaxical correctness of scenarios
• Linting: Get warnings and hints to improve your scenarios
• Deployment Guide: Step-by-step deployment instructions
• Docker Test Harness: Spin up CrowdSec to test scenario behavior

Demo

WAF Rules Creation and testing

• Rule creation from natural language
• Rule creation from CVE reference

Scenario Creation and testing

• Rule creation on HTTP events
• Rule creation based on GeoLocation factors

Prerequisites

• uv 0.4 or newer, which provides the uvx runner used in the examples below.
• Docker with the Compose plugin (Compose v2).

Installation

You can install the MCP using uvx or use packaged .mcpb file for claude code.

Using .mcpb package

If you’re using claude desktop, you can configure the MCP directly by double-clicking the .mcpb file that accompanies the release.

[!IMPORTANT] On MacOS, configure uv path in the extension settings if uv isn’t installed in the standard path.

Using uvx

• Configure supported clients automatically with uvx --from crowdsec-local-mcp init , where `` is one of claude-desktop, claude-code, chatgpt, vscode, or stdio:

uvx --from crowdsec-local-mcp init --dry-run claude-code

Run uvx --from crowdsec-local-mcp init --help to see all flags and supported targets.

What init configures

The init helper writes the CrowdSec MCP server definition into the client’s JSON configuration:

• claude-desktop → claude_desktop_config.json in the Claude Desktop settings directory
• claude-code → invoke claude mcp command with needed args