crowdsec_status

What crowdsec_status does on Crow

AI agents call crowdsec_status to retrieve information from Crow without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why crowdsec_status is rated Low

The tool retrieves and reports on system status metrics (API reachability, decision counts, alert counts) without modifying any data, executing code, or triggering external operations. This is purely informational and falls clearly into the Read category. The low severity reflects that misuse would only expose operational metrics rather than cause damage or access sensitive user data.

From the tool's definition Tool provides status information: 'LAPI reachability, active decisions (bans in force), and alert counts'. These are read-only queries of monitoring/security state data with no side effects.

The rule that runs crowdsec_status safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Crow, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For crowdsec_status, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "crowdsec_status": {}
  }
}

Questions about crowdsec_status