Crowdsec CTI node

.github/workflows/ci.yml

@@ -0,0 +1,28 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
+      - name: Install dependencies
+        run: "npm ci"
+
+      - name: Run lint
+        run: "npm run lint"
+
+      - name: Run build
+        run: "npm run build"

.github/workflows/publish-npm.yml

@@ -0,0 +1,25 @@
+name: Publish Package
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  id-token: write # Required for OIDC
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+      - run: npm ci
+      - run: npm run build --if-present
+      - run: npm test
+      - run: npm publish

.gitignore

@@ -0,0 +1,2 @@
+node_modules
+dist

CHANGELOG.md

@@ -0,0 +1,7 @@
+# Changelog
+
+## [0.1.0] - 2026-02-13
+
+### Added
+
+- Initial release of the `Crowdsec CTI` n8n community node.

README.md

@@ -0,0 +1,73 @@
+# n8n-nodes-crowdsec-cti
+
+This is an n8n community node. It lets you query the CrowdSec CTI API in your n8n workflows.
+
+The node currently supports IP reputation lookups through CrowdSec's `smoke` endpoint.
+
+[n8n](https://n8n.io/) is a [fair-code licensed](https://docs.n8n.io/sustainable-use-license/) workflow automation platform.
+
+[Installation](#installation)
+[Operations](#operations)
+[Credentials](#credentials)
+[Compatibility](#compatibility)
+[Usage](#usage)
+[Resources](#resources)
+[Version history](#version-history)
+
+## Installation
+
+Follow the [installation guide](https://docs.n8n.io/integrations/community-nodes/installation/) in the n8n community nodes documentation.
+
+## Operations
+
+- `Smoke -> Get`
+- Calls `GET https://cti.api.crowdsec.net/v2/smoke/{ip}`
+- Returns reputation/intelligence data for the provided IP address
+- `Smoke -> Get Many`
+- Calls `GET https://cti.api.crowdsec.net/v2/smoke?ips=ip1,ip2,...`
+- Returns reputation/intelligence data for multiple IP addresses
+- `Smoke -> Search`
+- Calls `GET https://cti.api.crowdsec.net/v2/smoke/search`
+- Required query params: `query` (lucene-style), `since` (duration, for example `1h`)
+- Optional query params: `page`, `limit`
+- Optional n8n behavior: `Return All` to auto-paginate across pages
+
+## Credentials
+
+This node uses an API key sent as the `x-api-key` header.
+
+To configure:
+
+1. Create a CrowdSec CTI API key from your CrowdSec account. You can refer to [this documentation](https://docs.crowdsec.net/u/cti_api/api_getting_started)
+2. In n8n, create credentials of type `Crowdsec CTI API`.
+3. Paste the API key into the `API Key` field.
+
+## Compatibility
+
+Built with the official `@n8n/node-cli` template and `n8nNodesApiVersion: 1`.
+
+Compatibility depends on the n8n version supporting community nodes with API version 1.
+
+## Usage
+
+1. Add the `Crowdsec CTI` node to your workflow.
+2. Select resource `Smoke`.
+3. Choose operation `Get`, `Get Many`, or `Search`.
+4. Enter:
+   - `IP Address` for `Get`
+   - `IP Addresses` (comma-delimited) for `Get Many`
+   - `Query` and `Since` for `Search` (optionally tune `page` and `limit`, and enable `Return All`)
+5. Execute the node to retrieve the JSON reputation payload.
+
+> [!IMPORTANT]  
+> The `Search` operation can return a lot of results depending on the query (potentially thousands or tens of thousands). This means that enabling the `Return All` option can quickly consume your API key quota if the `limit` parameter is set to low.
+
+## Resources
+
+- [n8n community nodes documentation](https://docs.n8n.io/integrations/#community-nodes)
+- [CrowdSec CTI](https://app.crowdsec.net/cti)
+- [CrowdSec CTI API](https://docs.crowdsec.net/u/cti_api/intro)
+
+## Version history
+
+- `0.1.0`: Initial community node with `Smoke -> Get`, `Smoke -> Get Many`, and `Smoke -> Search`.

credentials/CrowdsecCtiApi.credentials.ts

@@ -0,0 +1,44 @@
+import type {
+	IAuthenticateGeneric,
+	Icon,
+	ICredentialTestRequest,
+	ICredentialType,
+	INodeProperties,
+} from 'n8n-workflow';
+
+export class CrowdsecCtiApi implements ICredentialType {
+	name = 'crowdsecCtiApi';
+	icon: Icon = 'file:../icons/crowdsecCti.svg';
+
+	displayName = 'Crowdsec CTI API';
+
+	// Link to your community node's README
+	documentationUrl = 'https://github.com/crowdsecurity/n8n-nodes-crowdsec-cti?tab=readme-ov-file#credentials';
+
+	properties: INodeProperties[] = [
+		{
+			displayName: 'API Key',
+			name: 'apiKey',
+			type: 'string',
+			typeOptions: { password: true },
+			required: true,
+			default: '',
+		},
+	];
+
+	authenticate: IAuthenticateGeneric = {
+		type: 'generic',
+		properties: {
+			headers: {
+				'x-api-key': '={{$credentials.apiKey}}',
+			},
+		},
+	};
+
+	test: ICredentialTestRequest = {
+		request: {
+			baseURL: 'https://cti.api.crowdsec.net/v2/',
+			url: 'smoke/1.1.1.1',
+		},
+	};
+}

eslint.config.mjs

@@ -0,0 +1,3 @@
+import { config } from '@n8n/node-cli/eslint';
+
+export default config;

nodes/CrowdsecCti/CrowdsecCti.node.json

@@ -0,0 +1,18 @@
+{
+	"node": "n8n-nodes-crowdsec-cti",
+	"nodeVersion": "1.0",
+	"codexVersion": "1.0",
+	"categories": ["Development", "Developer Tools"],
+	"resources": {
+		"credentialDocumentation": [
+			{
+				"url": "https://github.com/crowdsecurity/n8n-nodes-crowdsec-cti?tab=readme-ov-file#credentials"
+			}
+		],
+		"primaryDocumentation": [
+			{
+				"url": "https://github.com/crowdsecurity/n8n-nodes-crowdsec-cti?tab=readme-ov-file"
+			}
+		]
+	}
+}

nodes/CrowdsecCti/CrowdsecCti.node.ts

@@ -0,0 +1,44 @@
+import { NodeConnectionTypes, type INodeType, type INodeTypeDescription } from 'n8n-workflow';
+import { smokeDescription } from './resources/smoke';
+
+export class CrowdsecCti implements INodeType {
+	description: INodeTypeDescription = {
+		displayName: 'Crowdsec CTI',
+		name: 'crowdsecCti',
+		icon: 'file:../../icons/crowdsecCti.svg',
+		group: ['transform'],
+		version: 1,
+		subtitle: '={{$parameter["operation"] + ": " + $parameter["resource"]}}',
+		description: 'Interact with the Crowdsec CTI API',
+		defaults: {
+			name: 'Crowdsec CTI',
+		},
+		usableAsTool: true,
+		inputs: [NodeConnectionTypes.Main],
+		outputs: [NodeConnectionTypes.Main],
+		credentials: [{ name: 'crowdsecCtiApi', required: true }],
+		requestDefaults: {
+			baseURL: 'https://cti.api.crowdsec.net/v2/',
+			headers: {
+				Accept: 'application/json',
+				'Content-Type': 'application/json',
+			},
+		},
+		properties: [
+			{
+				displayName: 'Resource',
+				name: 'resource',
+				type: 'options',
+				noDataExpression: true,
+				options: [
+					{
+						name: 'Smoke',
+						value: 'smoke',
+					},
+				],
+				default: 'smoke',
+			},
+			...smokeDescription,
+		],
+	};
+}