All Skills
Coding & EngineeringClaude Plugins (Official)

crowdsec — Agent Skill

by crowdsecurity · Updated

Operational skill for installing, configuring, operating, and debugging CrowdSec (cscli, LAPI/CAPI, hub, bouncers, WAF/AppSec) across bare-metal, Docker, and Kubernetes.

At a glance

crowdsec is an Agent Skill by crowdsecurity in the Coding & Engineering category. In Claude Code it installs with `/plugin install crowdsec@claude-plugins-official` after adding the anthropics/claude-plugins-official marketplace; other assistants use its SKILL.md instructions as rules. Its source repository has 26 GitHub stars (as of Oct 28, 2026).

Source 26GitHub stars

How to install crowdsec in your AI client

Setup for Claude Code, Claude Desktop, Cursor, Codex, Windsurf, Cline and VS Code — copy-paste ready.

How to install crowdsec in Claude CodeAnthropic's agentic CLI

  1. Add the marketplace

    claude
    /plugin marketplace add anthropics/claude-plugins-official

  2. Install the skill

    claude
    /plugin install crowdsec@claude-plugins-official

  3. Use it

    These are slash commands for a Claude Code session, not your shell. Claude auto-invokes the skill when your request matches its description — or type its slash command if it exposes one.

Documentation

Full README

CrowdSec Skill for Claude Code & Codex

The official CrowdSec plugin for AI coding agents. It bundles two Agent Skills that let Claude Code, Codex, and Claude.ai install, configure, operate, and debug CrowdSec — the engine, cscli, bouncers, and the WAF/AppSec component — across bare-metal/systemd, Docker, pfSense/OPNsense, and Kubernetes/Helm.

This plugin bundles two [Agent Skills](https://docs.claude.com/en/docs/claude-code/skills):

  • `crowdsec` — a hands-on CrowdSec operator. Stand up an engine, wire a

bouncer, enable the WAF, or figure out why nothing's getting blocked. It knows the cscli commands, the config layout, the failure modes, and the safe way through each across bare-metal/systemd, Docker, pfSense/OPNsense and Kubernetes/Helm.

  • `crowdsec-service-api` — drives the premium Console Service API (cloud)

on your behalf with your API key: create and populate blocklists/allowlists, wire firewall/appliance integrations, pull remediation ROI metrics, and manage org-level decisions — every state change gated behind an explicit confirmation.

What it covers

`crowdsec` (operational):

| Area | Covered | |---|---| | Install | bare-metal/systemd · Docker · Kubernetes/Helm · pfSense/OPNsense · Console enrollment | | Bouncers | firewall (iptables/nftables/ipset) · nginx · traefik · caddy · apache · and more | | WAF / AppSec | deploy · configure · troubleshoot the AppSec component · bot detection | | Hub | install collections/parsers/scenarios · update · debug | | Configure | acquisition · profiles & ban durations · notifications · allowlists | | Operate | health checks & smoke tests · upgrades & rollback · multi-server / remote LAPI / mTLS | | Debug | logs not parsing · no alerts firing · bouncer not blocking · specific errors |

`crowdsec-service-api` (premium cloud API):

| Area | Covered | |---|---| | Blocklists | create · add/remove/bulk IPs (with expiry) · download · share across orgs · subscribe engines/bouncers | | Allowlists | create · items with expiry · subscribe by engine/tag/org | | Integrations | firewall/appliance feeds (Palo Alto, Fortinet, Cisco, F5, Sophos, pfSense/OPNsense…) · paginated Basic-auth content pull | | Metrics | remediation ROI (traffic dropped, bytes/egress saved, attacks prevented) | | Decisions | org-level decisions + aggregated (read/manage) |

Install

Excerpt — the full document is on GitHub.

More Coding & Engineering skills

Catalog data refreshed . Something wrong? Report it.