Advertise
MCP.so
Sign In

Crowdstrike Falcon MCP Server

@CrowdStrike

Repository

Basic information

Category

Other

Last updated

Transports

stdio

Author

CrowdStrike

Submitted by

Rom Ashkenazi

About Crowdstrike Falcon MCP Server

Connects AI agents with the CrowdStrike Falcon platform for intelligent security analysis, providing programmatic access to detections, incidents, behaviors, threat intelligence, hosts, vulnerabilities, and identity protection capabilities.

#crowdstrike#falcon#security-analysis

Crowdstrike Falcon MCP Server config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "falcon-mcp": {
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "your-client-id",
        "FALCON_CLIENT_SECRET": "your-client-secret",
        "FALCON_BASE_URL": "https://api.crowdstrike.com"
      }
    }
  }
}

Crowdstrike Falcon MCP Server tools

Tool list not available yet

This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.

Fetch the live tool list by running this server in a temporary sandbox using the button above.

Overview

What is Crowdstrike Falcon?

Crowdstrike Falcon is a Model Context Protocol (MCP) server that connects AI agents with the CrowdStrike Falcon platform for security analysis. It provides programmatic access to detections, incidents, behaviors, threat intelligence, and other security capabilities.

How to use Crowdstrike Falcon?

Install the server with pip install falcon-mcp (requires Python 3.11+). Configure CrowdStrike API credentials via environment variables (FALCON_CLIENT_ID, FALCON_CLIENT_SECRET), then run falcon-mcp on the command line or integrate with an MCP client like Claude Desktop. Modules can be enabled or disabled using command-line flags.

Key features of Crowdstrike Falcon

  • Detection search and analysis
  • Incident investigation and CrowdScore monitoring
  • Threat actor and IOC intelligence research
  • Host/device inventory and management
  • Vulnerability search and management
  • Identity protection entity investigation

Use cases of Crowdstrike Falcon

  • Threat hunting: Search detections to uncover malicious activity.
  • Incident response: Analyze incidents, behaviors, and CrowdScore.
  • Threat intelligence: Research adversaries, indicators, and reports.
  • Asset management: Query host inventory and device details.
  • Vulnerability management: Search and assess vulnerabilities.

Frequently asked questions

1

What is the current status of falcon-mcp?

It is in **public preview** under active development. Features may change before the stable 1.0 release, so production deployments are not recommended.

2

What API scopes are required?

Scopes depend on the modules you enable. For example, Detections needs `Alerts:read`, Incidents needs `Incidents:read`, and Intel needs multiple Falcon Intelligence scopes. See the README for the full list.

3

Can I trust AI-generated FQL queries?

FQL has nuanced syntax. AI-generated filters should be tested and validated before production use. Start with simple queries and gradually build complexity.

4

How do I install and configure falcon-mcp?

Install via `pip install falcon-mcp` with Python 3.11+. Copy `.env.example` to `.env` and set `FALCON_CLIENT_ID` and `FALCON_CLIENT_SECRET` from your CrowdStrike API credentials.

Comments

More Other MCP servers

Handl

Handl speaks the Model Context Protocol. Your whole billing operation — projects, invoices, clients, reports, approvals — as tools any AI assistant can call, inside your autonomy rules.

DeepMark

DeepMark helps teachers deliver rapid, consistent marking with meaningful feedback for every student — in a fraction of the time. What once took a week, now takes one free period.

Arsen MCP

Arsen Security

Run advanced phishing, voice phishing, deepfake fraud simulations, and cybersecurity awareness training from your AI assistant.

N

Next Generation Movers: free moving quotes (remote MCP)

Next Generation Movers

Free moving quotes for AI agents from Next Generation Movers, a licensed interstate mover (USDOT 3764697). US long-distance nationwide and local DC/MD/VA. Indicative ballpark price and booking options; optional $0.01 x40

Blender

ahujasid

Open-source MCP to use Blender with any LLM

23.6K
Advertise