v0.3.1

Container Image

ghcr.io/frli4797/crowdsec-ops-mcp:0.3.1

Install

See ONBOARDING.md for Docker and MCP client configuration.

What's Changed

Other Changes

• Fix CrowdSec alert inspection robustness by @frli4797 in #17
• Docs: clarify CrowdSec alert accounting by @frli4797 in #18
• Feature: Add scenario simulation intents by @frli4797 in #19
• Fix: improve CI cache reuse by @frli4797 in #20
• Release: v0.3.1 by @frli4797 in #21

Full Changelog: v0.3.0...v0.3.1

v0.3.0

Container Image

ghcr.io/frli4797/crowdsec-ops-mcp:0.3.0

Install

See ONBOARDING.md for Docker and MCP client configuration.

What's Changed

Documentation

• Docs: add Snort CrowdSec scenario examples by @frli4797 in #16

Other Changes

• Chore: add optional advisory agentic reviews by @frli4797 in #13
• CI/CD: fix advisory review workflow yaml by @frli4797 in #14
• Feature: add decision gap report by @frli4797 in #15

Full Changelog: v0.2.1...v0.3.0

v0.2.1

Release Notes: v0.2.1

Summary

v0.2.1 improves CI and release validation speed by caching the Python virtualenv and reusing the installed build environment.

Added

• No new MCP tools or runtime features.

Changed

• CI now caches .venv with a key derived from pyproject.toml.
• Release validation now caches .venv with the same dependency key.
• Package builds now use .venv/bin/python -m build --no-isolation in CI and release validation, avoiding repeated isolated build-environment installs when dependencies are already present.

Fixed

• No runtime fixes.

Security And Safety

• CrowdSec-only boundary is unchanged.
• Write actions remain single-IP, prepare-only, and audited.
• No MCP-executed CrowdSec mutations were added.

Upgrade Notes

• Update deployments to use ghcr.io/frli4797/crowdsec-ops-mcp:0.2.1 after the image is published.
• Existing configuration variables remain compatible.

Validation

• .venv/bin/pytest
• .venv/bin/python scripts/check_version.py v0.2.1
• .venv/bin/python -m build --no-isolation
• Docker image build

v0.2.0

Release Notes: v0.2.0

Summary

v0.2.0 expands the read-only CrowdSec operator workflow with health reporting and decision inventory, while keeping write actions prepare-only and audited.

Added

• crowdsec_health(include_sample_counts=false) reports backend mode, LAPI presence and reachability, cscli path diagnostics, default window, write audit path, and exposed capabilities without exposing secrets. Supported reads remain LAPI-backed; actual cscli reads or execution are not supported.
• decision_inventory(...) summarizes active CrowdSec decisions with filters, grouped counts, expiring-soon decisions, stale or long-lived decisions, and representative rows.
• Decision inventory examples in docs/decision-inventory-example.md.
• Project roadmap in docs/roadmap.md.
• Agent instructions in AGENTS.md, plus runtime agent guidance in docs/agent-usage.md.
• Local development workflow notes in docs/development.md.
• Worktree bootstrap helper for local runtime files.
• README contents and fuller project document index.

Changed

• Reorganized documentation by audience: user-facing README/onboarding, agent instructions, development workflow, roadmap, and release process.
• Clarified roadmap priorities around read-side tools before production write execution.
• Relaxed PR metadata validation for dependency-update automation.

Fixed

• IP write tools now remain prepare-only even if a legacy execute flag is sent.
• Improved MCP logging around client calls and startup capability reporting.
• Improved CrowdSec client behavior around backend health and LAPI JSON reads.
• Ignored local compose and write-audit files.

Security And Safety

• CrowdSec-only boundary is unchanged.
• Write actions remain single-IP, prepare-only, and audited.
• No MCP-executed CrowdSec mutations were added.
• No Docker socket, metrics, logs, dashboard, Snort, or reverse-proxy access was added.

Upgrade Notes

• Update deployments to use ghcr.io/frli4797/crowdsec-ops-mcp:0.2.0 after the image is published.
• Existing configuration variables remain compatible.

Validation

• .venv/bin/pytest
• .venv/bin/python scripts/check_version.py v0.2.0
• .venv/bin/python -m build
• Docker image build

v0.1.1

Release Notes: v0.1.1

Summary

v0.1.1 is a release automation and container publishing patch for the initial CrowdSec MCP release.

Added

• Main-branch and pull-request container image publishing workflow support.
• Multi-architecture container image publishing support.
• Documentation for pulling the private GHCR image.

Changed

• Updated CI/release workflow actions, including QEMU setup, to keep image builds working on GitHub Actions.

Fixed

• Reduced release friction around container builds and image availability after tags are published.

Security And Safety

• No MCP runtime tool changes.
• CrowdSec-only boundary is unchanged.
• No new write-action behavior was added.

Upgrade Notes

• Use ghcr.io/frli4797/crowdsec-ops-mcp:0.1.1 for the patched container publishing release.
• Private GHCR pulls require a GitHub token with package read access.

Validation

• GitHub Actions CI and release workflow updates.
• Container image publishing path updated for multi-architecture builds.

v0.1.0

Release Notes: v0.1.0

Summary

v0.1.0 is the initial release of crowdsec-ops-mcp, a CrowdSec-focused local MCP server for operator investigations and tightly scoped IP actions.

Added

• Initial MCP server package and stdio entry point.
• CrowdSec read tools: inspect_ip, security_summary, top_offenders, recent_crowdsec_decisions, and recent_crowdsec_alerts.
• Scenario proposal helper: suggest_scenario(window?) for repeated CrowdSec alert patterns.
• Single-IP operator action tools: ban_ip, allow_ip, and unban_ip, dry-run by default with explicit execute support in this release.
• CrowdSec LAPI decision reads and cscli alert/action integration.
• Dockerfile and Docker Compose example for local deployment.
• Initial CI, PR metadata validation, Dependabot configuration, and release automation.
• Onboarding, release, PR rule, and release-note template documentation.

Security And Safety

• The MCP boundary is CrowdSec-only; no metrics, logs, dashboard, reverse-proxy, Snort, or Docker socket integrations are included.
• Write actions are scoped to individual IP addresses.
• Read-only CrowdSec tools are the recommended default workflow.

Upgrade Notes

• Use ghcr.io/frli4797/crowdsec-ops-mcp:0.1.0 for the initial container image.
• Configure CrowdSec access with CROWDSEC_LAPI_URL, CROWDSEC_LAPI_KEY, CSCLI_PATH, and DEFAULT_WINDOW as needed.

Validation

• Initial unit test suite for analysis and client behavior.
• CI package/test workflow.