PluginBench
MCP Server
Active
MIT

CrowdStrike Falcon MCP Server MCP Server

io.github.CrowdStrike/falcon-mcp

AI-powered security analysis and automation through CrowdStrike Falcon platform integration.

RepositoryRegistry

What is the CrowdStrike Falcon MCP Server MCP server?

The CrowdStrike Falcon MCP Server connects AI agents with the CrowdStrike Falcon platform to enable intelligent security analysis, threat intelligence, and host management. It provides programmatic access to detections, IOCs, policies, cloud security, identity protection, and other essential security capabilities for advanced security operations and automation.

This MCP server bridges AI agents with CrowdStrike Falcon's comprehensive security platform. It exposes 20+ modules covering detections, threat intelligence, host management, cloud security, firewall rules, policies, case management, and more. Use it to automate security investigations, manage hosts and policies, analyze threats, search IOCs, and orchestrate security responses—all through natural language commands in your AI workflow.

How to install CrowdStrike Falcon MCP Server

Copy-paste configuration for popular MCP clients.

transport: stdio
Config generated by PluginBench — verify against the source before use.
Environment / auth
  • FALCON_CLIENT_ID
    required
    secret

    CrowdStrike API client ID

  • FALCON_CLIENT_SECRET
    required
    secret

    CrowdStrike API client secret

  • FALCON_BASE_URL

    CrowdStrike API region URL

  • FALCON_MEMBER_CID

    Child CID for Flight Control (MSSP) support

  • FALCON_MCP_MODULES

    Comma-separated list of modules to enable

  • FALCON_MCP_TRANSPORT

    Transport protocol to use

  • FALCON_MCP_DEBUG

    Enable debug logging

  • FALCON_MCP_HOST

    Host to bind to for HTTP transports

  • FALCON_MCP_PORT

    Port to listen on for HTTP transports

  • FALCON_MCP_USER_AGENT_COMMENT

    Additional information to include in the User-Agent comment section

  • FALCON_MCP_STATELESS_HTTP

    Enable stateless HTTP mode for scalable deployments

  • FALCON_MCP_API_KEY
    secret

    API key for HTTP transport authentication (x-api-key header)

Claude Desktop
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "falcon-mcp": {
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<YOUR_FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<YOUR_FALCON_CLIENT_SECRET>",
        "FALCON_BASE_URL": "<YOUR_FALCON_BASE_URL>",
        "FALCON_MEMBER_CID": "<YOUR_FALCON_MEMBER_CID>",
        "FALCON_MCP_MODULES": "<YOUR_FALCON_MCP_MODULES>",
        "FALCON_MCP_TRANSPORT": "<YOUR_FALCON_MCP_TRANSPORT>",
        "FALCON_MCP_DEBUG": "<YOUR_FALCON_MCP_DEBUG>",
        "FALCON_MCP_HOST": "<YOUR_FALCON_MCP_HOST>",
        "FALCON_MCP_PORT": "<YOUR_FALCON_MCP_PORT>",
        "FALCON_MCP_USER_AGENT_COMMENT": "<YOUR_FALCON_MCP_USER_AGENT_COMMENT>",
        "FALCON_MCP_STATELESS_HTTP": "<YOUR_FALCON_MCP_STATELESS_HTTP>",
        "FALCON_MCP_API_KEY": "<YOUR_FALCON_MCP_API_KEY>"
      }
    }
  }
}
Cursor
~/.cursor/mcp.json
{
  "mcpServers": {
    "falcon-mcp": {
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<YOUR_FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<YOUR_FALCON_CLIENT_SECRET>",
        "FALCON_BASE_URL": "<YOUR_FALCON_BASE_URL>",
        "FALCON_MEMBER_CID": "<YOUR_FALCON_MEMBER_CID>",
        "FALCON_MCP_MODULES": "<YOUR_FALCON_MCP_MODULES>",
        "FALCON_MCP_TRANSPORT": "<YOUR_FALCON_MCP_TRANSPORT>",
        "FALCON_MCP_DEBUG": "<YOUR_FALCON_MCP_DEBUG>",
        "FALCON_MCP_HOST": "<YOUR_FALCON_MCP_HOST>",
        "FALCON_MCP_PORT": "<YOUR_FALCON_MCP_PORT>",
        "FALCON_MCP_USER_AGENT_COMMENT": "<YOUR_FALCON_MCP_USER_AGENT_COMMENT>",
        "FALCON_MCP_STATELESS_HTTP": "<YOUR_FALCON_MCP_STATELESS_HTTP>",
        "FALCON_MCP_API_KEY": "<YOUR_FALCON_MCP_API_KEY>"
      }
    }
  }
}
Windsurf
~/.codeium/windsurf/mcp_config.json
{
  "mcpServers": {
    "falcon-mcp": {
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<YOUR_FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<YOUR_FALCON_CLIENT_SECRET>",
        "FALCON_BASE_URL": "<YOUR_FALCON_BASE_URL>",
        "FALCON_MEMBER_CID": "<YOUR_FALCON_MEMBER_CID>",
        "FALCON_MCP_MODULES": "<YOUR_FALCON_MCP_MODULES>",
        "FALCON_MCP_TRANSPORT": "<YOUR_FALCON_MCP_TRANSPORT>",
        "FALCON_MCP_DEBUG": "<YOUR_FALCON_MCP_DEBUG>",
        "FALCON_MCP_HOST": "<YOUR_FALCON_MCP_HOST>",
        "FALCON_MCP_PORT": "<YOUR_FALCON_MCP_PORT>",
        "FALCON_MCP_USER_AGENT_COMMENT": "<YOUR_FALCON_MCP_USER_AGENT_COMMENT>",
        "FALCON_MCP_STATELESS_HTTP": "<YOUR_FALCON_MCP_STATELESS_HTTP>",
        "FALCON_MCP_API_KEY": "<YOUR_FALCON_MCP_API_KEY>"
      }
    }
  }
}
VS Code
.vscode/mcp.json
{
  "servers": {
    "falcon-mcp": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<YOUR_FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<YOUR_FALCON_CLIENT_SECRET>",
        "FALCON_BASE_URL": "<YOUR_FALCON_BASE_URL>",
        "FALCON_MEMBER_CID": "<YOUR_FALCON_MEMBER_CID>",
        "FALCON_MCP_MODULES": "<YOUR_FALCON_MCP_MODULES>",
        "FALCON_MCP_TRANSPORT": "<YOUR_FALCON_MCP_TRANSPORT>",
        "FALCON_MCP_DEBUG": "<YOUR_FALCON_MCP_DEBUG>",
        "FALCON_MCP_HOST": "<YOUR_FALCON_MCP_HOST>",
        "FALCON_MCP_PORT": "<YOUR_FALCON_MCP_PORT>",
        "FALCON_MCP_USER_AGENT_COMMENT": "<YOUR_FALCON_MCP_USER_AGENT_COMMENT>",
        "FALCON_MCP_STATELESS_HTTP": "<YOUR_FALCON_MCP_STATELESS_HTTP>",
        "FALCON_MCP_API_KEY": "<YOUR_FALCON_MCP_API_KEY>"
      }
    }
  }
}
Claude Code
claude mcp add falcon-mcp --env FALCON_CLIENT_ID=<YOUR_FALCON_CLIENT_ID> --env FALCON_CLIENT_SECRET=<YOUR_FALCON_CLIENT_SECRET> --env FALCON_BASE_URL=<YOUR_FALCON_BASE_URL> --env FALCON_MEMBER_CID=<YOUR_FALCON_MEMBER_CID> --env FALCON_MCP_MODULES=<YOUR_FALCON_MCP_MODULES> --env FALCON_MCP_TRANSPORT=<YOUR_FALCON_MCP_TRANSPORT> --env FALCON_MCP_DEBUG=<YOUR_FALCON_MCP_DEBUG> --env FALCON_MCP_HOST=<YOUR_FALCON_MCP_HOST> --env FALCON_MCP_PORT=<YOUR_FALCON_MCP_PORT> --env FALCON_MCP_USER_AGENT_COMMENT=<YOUR_FALCON_MCP_USER_AGENT_COMMENT> --env FALCON_MCP_STATELESS_HTTP=<YOUR_FALCON_MCP_STATELESS_HTTP> --env FALCON_MCP_API_KEY=<YOUR_FALCON_MCP_API_KEY> -- uvx falcon-mcp

Tools & capabilities

Tools this server exposes to the agent.

  • Case Management — Manage case lifecycle, attach evidence, add tags, and use case templates
  • Cloud Security — Query Kubernetes containers, image vulnerabilities, CSPM assets, IOM findings, and suppression rules
  • Correlation Rules — Search, create, update, and manage NG-SIEM correlation rules
  • Custom IOA — Create and manage Custom IOA behavioral detection rules and rule groups
  • Data Protection — Search Data Protection classifications, policies, and content patterns
  • Detections — Find and analyze detections to understand malicious activity
  • Discover — Search application inventory and discover unmanaged assets
  • Exclusions — Search, create, update, and delete IOA, ML, sensor visibility, and certificate-based exclusions
  • Firewall Management — Search and manage firewall rules and rule groups
  • Host Groups — Search, create, update, delete host groups and manage membership
  • Hosts — Manage and query host/device information
  • Identity Protection — Entity investigation and identity protection analysis
  • Intel — Research threat actors, IOCs, and intelligence reports
  • IOC — Search, create, and remove custom indicators of compromise
  • NGSIEM — Execute CQL queries against Next-Gen SIEM
  • Policies — Search, create, update, delete prevention, sensor update, firewall, device control, response, and content update policies
  • Quarantine — Search quarantine records and release, unrelease, or delete quarantined files
  • Real Time Response — Audit, summarize, and run read-only RTR triage workflows
  • Recon — Search Falcon Intelligence Recon notifications, monitoring rules, and exposed-data records
  • Scheduled Reports — Manage scheduled reports and download report files

Use cases

  • Automate security investigations by querying detections and analyzing malicious activity in real-time
  • Manage host groups, policies, and firewall rules programmatically to enforce security controls
  • Search and manage custom indicators of compromise (IOCs) and threat intelligence
  • Investigate identity threats and perform entity analysis through identity protection tools
  • Execute CQL queries against Next-Gen SIEM and correlate security events across your environment

CrowdStrike Falcon MCP Server MCP server FAQ

What is the CrowdStrike Falcon MCP Server?

It's an MCP server that connects AI agents with CrowdStrike Falcon, providing programmatic access to detections, threat intelligence, host management, cloud security, policies, and 20+ other security modules for automated security analysis and operations.

Is it free to use?

The server itself is open-source (MIT licensed) and free. You need a valid CrowdStrike Falcon subscription and API credentials (Client ID and Secret) to connect and use the platform's capabilities.

How do I install it in Cursor or Claude?

Install via pip (`pip install falcon-mcp`) or uv (`uv tool install falcon-mcp`), then configure your editor's MCP settings with the command and your CrowdStrike API credentials in a .env file. See the Getting Started guide for full instructions.

What authentication is required?

You need CrowdStrike Falcon API credentials: FALCON_CLIENT_ID, FALCON_CLIENT_SECRET, and FALCON_BASE_URL (typically https://api.crowdstrike.com). Set these as environment variables or in a .env file.

Can I run it in Docker?

Yes, Docker images are available at `quay.io/crowdstrike/falcon-mcp:latest`. Run with `docker run -i --rm --env-file /path/to/.env quay.io/crowdstrike/falcon-mcp:latest` for stdio transport or with `--transport streamable-http` for HTTP.

What is Dynamic Mode?

Dynamic Mode reduces context window overhead by replacing full tool schemas with three discovery tools: `falcon_list_enabled_modules`, `falcon_search_tools`, and `falcon_execute_tool`. Enable it with `--dynamic` flag or `FALCON_MCP_DYNAMIC=true` environment variable.

README (reference)

Source of truth, from the repository.

CrowdStrike Logo (Light) CrowdStrike Logo (Dark)

<!-- mcp-name: io.github.CrowdStrike/falcon-mcp -->

falcon-mcp

PyPI version PyPI - Python Version License: MIT MCP Registry GitHub MCP Gemini CLI Extension

falcon-mcp is a Model Context Protocol (MCP) server that connects AI agents with the CrowdStrike Falcon platform, powering intelligent security analysis in your agentic workflows. It delivers programmatic access to essential security capabilities—including detections, threat intelligence, and host management—establishing the foundation for advanced security operations and automation.

[!IMPORTANT] 🚧 Public Preview: This project is currently in public preview and under active development. Features and functionality may change before the stable 1.0 release. While we encourage exploration and testing, please avoid production deployments. We welcome your feedback through GitHub Issues to help shape the final release.

Documentation

Full docs are available at developer.crowdstrike.com/falcon-mcp.

Modules

ModuleDescription
CoreBasic connectivity and system information
Case ManagementCase lifecycle management, evidence attachment, tagging, and templates
Cloud SecurityKubernetes containers, image vulnerabilities, CSPM asset inventory, IOM findings, and suppression rules
Correlation RulesSearch, create, update, and manage NG-SIEM correlation rules
Custom IOACreate and manage Custom IOA behavioral detection rules and rule groups
Data ProtectionSearch Data Protection classifications, policies, and content patterns
DetectionsFind and analyze detections to understand malicious activity
DiscoverSearch application inventory and discover unmanaged assets
ExclusionsSearch, create, update, and delete IOA, machine learning, sensor visibility, and certificate-based exclusions
Firewall ManagementSearch and manage firewall rules and rule groups
Host GroupsSearch, create, update, and delete host groups; manage group membership
HostsManage and query host/device information
Identity ProtectionEntity investigation and identity protection analysis
IntelResearch threat actors, IOCs, and intelligence reports
IOCSearch, create, and remove custom indicators of compromise
NGSIEMExecute CQL queries against Next-Gen SIEM
PoliciesSearch, create, update, and delete prevention, sensor update, firewall, device control, response, and content update policies; manage host-group assignment, enable/disable, and precedence
QuarantineSearch quarantine records, preview action counts, and release, unrelease, or delete quarantined files
Real Time ResponseAudit, summarize, and run read-only RTR triage workflows
ReconSearch Falcon Intelligence Recon notifications (recon alerts), monitoring rules, and exposed-data records for dark web, leaked credentials, and typosquatting
Scheduled ReportsManage scheduled reports and download report files
Sensor UsageAccess and analyze sensor usage data
ServerlessSearch for vulnerabilities in serverless functions
ShieldSaaS security posture, checks, alerts, and app inventory
SpotlightManage and analyze vulnerability data and security assessments

See the Module Overview for required API scopes, available tools, and FQL resources.

Quick Start

Install

Using uv (recommended)

uv tool install falcon-mcp

Using pip

pip install falcon-mcp

Configure

Set the required environment variables (or use a .env file — see the Configuration Guide):

export FALCON_CLIENT_ID="your-client-id"
export FALCON_CLIENT_SECRET="your-client-secret"
export FALCON_BASE_URL="https://api.crowdstrike.com"

Run

falcon-mcp

See the Getting Started guide for full installation and configuration details.

Editor Integration

Using uvx (recommended)

{
  "mcpServers": {
    "falcon-mcp": {
      "command": "uvx",
      "args": [
        "--env-file",
        "/path/to/.env",
        "falcon-mcp"
      ]
    }
  }
}

With Module Selection

{
  "mcpServers": {
    "falcon-mcp": {
      "command": "uvx",
      "args": [
        "--env-file",
        "/path/to/.env",
        "falcon-mcp",
        "--modules",
        "detections,hosts,intel"
      ]
    }
  }
}

Docker

{
  "mcpServers": {
    "falcon-mcp-docker": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "--env-file",
        "/full/path/to/.env",
        "quay.io/crowdstrike/falcon-mcp:latest"
      ]
    }
  }
}

See the Usage guide for all command line options, module configuration, and library usage.

Container Usage

# Pull the latest image
docker pull quay.io/crowdstrike/falcon-mcp:latest

# Run with .env file (stdio transport)
docker run -i --rm --env-file /path/to/.env quay.io/crowdstrike/falcon-mcp:latest

# Run with streamable-http transport
docker run --rm -p 8000:8000 --env-file /path/to/.env \
  quay.io/crowdstrike/falcon-mcp:latest --transport streamable-http --host 0.0.0.0

See the Docker Deployment guide for building locally, custom ports, and advanced configurations.

Dynamic Mode

Running many modules at once inflates the context window every AI client must hold. Dynamic mode replaces the full tool surface with three tools — falcon_list_enabled_modules to see which modules are loaded, falcon_search_tools to discover the right tool on demand, and falcon_execute_tool to run it — so agents only load the schemas they actually need.

falcon-mcp --dynamic
# or: FALCON_MCP_DYNAMIC=true

See the Dynamic Mode guide for the full discover → execute workflow and trade-offs.

Deployment Options

Contributing

# Clone and install
git clone https://github.com/CrowdStrike/falcon-mcp.git
cd falcon-mcp
uv sync --all-extras

# Run tests
uv run pytest

[!IMPORTANT] This project uses Conventional Commits for automated releases. Please follow the commit message format outlined in our Contributing Guide.

Developer Documentation

Registries

falcon-mcp is published to public MCP catalogs for discovery and one-click setup in compatible clients:

License

This project is licensed under the MIT License - see the LICENSE file for details.

Support

This is a community-driven, open source project. While it is not an official CrowdStrike product, it is actively maintained by CrowdStrike and supported in collaboration with the open source developer community.

For more information, please see our SUPPORT file.

Related MCP servers

Scrapling MCP Server

Active

Give your AI agent stealth web scraping with Cloudflare bypass and CSS selection, powered by Scrapling.

67k
Python
BSD-3-Clause
View repository →

Chrome DevTools MCP

Active

Give your AI coding agent full control of a live Chrome browser for automation, debugging, and performance analysis.

45k
TypeScript
Apache-2.0
View repository →

com.puter/mcp-server

Active

Let AI agents manage your Puter files, websites, and serverless workers over MCP.

43k
TypeScript
AGPL-3.0
View repository →

io.github.bytedance/mcp-server-browser

Active

Browser automation for AI agents via MCP, powering ByteDance's Agent TARS hybrid GUI/DOM browser control.

37k
TypeScript
Apache-2.0
View repository →

io.github.bytedance/mcp-server-commands

Active

Run arbitrary shell commands from an MCP-connected AI agent.

37k
TypeScript
Apache-2.0
View repository →

io.github.bytedance/mcp-server-filesystem

Active

Filesystem access MCP server from ByteDance's UI-TARS/Agent TARS ecosystem.

37k
TypeScript
Apache-2.0
View repository →
CrowdStrike Falcon MCP Server MCP Server | PluginBench