This repository hosts several packages, listed below with examples.
- Guides and usage documentation: authentication, bouncer/watcher setup, performance notes and the glossary.
- API reference: generated technical documentation (Typedoc).
- AI agent setup guide: configure the HTTP middleware with an AI agent.
- llms.txt: index for agents and LLM tooling.
- Full CrowdSec client : watcher & bouncer clients for the CrowdSec LAPI (alerts, decisions, stream, watcher registration/self-delete...).
- High-performance bouncer : decisions are streamed from the LAPI and indexed locally by CIDR (numeric prefix lookup). Checking an IP costs ~µs with a negligible event loop impact, even with hundreds of thousands of decisions.
- Live mode (optional) : unknown IPs are checked against the LAPI in the background, closing the freshness gap of the stream poll. A malicious unknown IP passes at most once.
- Configurable trust scope :
subnetLevellets you choose how far up the prefix hierarchy to consider as malicious (resident/company/country), so a whole country block is never banned by accident. - Watcher scenarios : bundled scenarios (user-agent, ip-extraction...) to detect and alert on malicious requests, with a pluggable scenario system.
- MCP server : expose decisions, alerts and allowlists to an LLM through the Model Context Protocol, read-only by default.
An alpha HTTP middleware that allows you to use CrowdSec to protect your HTTP server.
AI agent setup guide: docs/agent-setup-guide.md.
Optional scenarios to use with the middleware.
A Model Context Protocol server for CrowdSec: exposes decisions, alerts and allowlists to an LLM, with read-only mode by default.
- express-bouncer : an example using crowdsec-client to create an Express bouncer
- express-bouncer-cjs : the same example written in CommonJS
- express-web-parser : a watcher example that reports clients using a bad user-agent
This repository provides a Node.js client for the CrowdSec REST API, an HTTP middleware, detection scenarios and an MCP server. Node.js >= 24 is required.
Report vulnerabilities privately: see SECURITY.md.
See CONTRIBUTING.md.
This project follows the Contributor Covenant.
- Crowdsec team for the crowdsec tool
- University of Delaware