What is the current status of falcon-mcp?
It is in **public preview** under active development. Features may change before the stable 1.0 release, so production deployments are not recommended.
Crowdstrike Falcon MCP Server
@CrowdStrike
基本信息
关于 Crowdstrike Falcon MCP Server
Connects AI agents with the CrowdStrike Falcon platform for intelligent security analysis, providing programmatic access to detections, incidents, behaviors, threat intelligence, hosts, vulnerabilities, and identity protection capabilities.
Crowdstrike Falcon MCP Server 配置
使用下面的配置,将此服务器添加到你的 MCP 客户端。
{
"mcpServers": {
"falcon-mcp": {
"command": "uvx",
"args": [
"falcon-mcp"
],
"env": {
"FALCON_CLIENT_ID": "your-client-id",
"FALCON_CLIENT_SECRET": "your-client-secret",
"FALCON_BASE_URL": "https://api.crowdstrike.com"
}
}
}
}Crowdstrike Falcon MCP Server 工具
工具列表暂未提供
当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。
点击上方按钮,在临时沙箱中运行此服务器并实时获取工具列表。
概览
What is Crowdstrike Falcon?
Crowdstrike Falcon is a Model Context Protocol (MCP) server that connects AI agents with the CrowdStrike Falcon platform for security analysis. It provides programmatic access to detections, incidents, behaviors, threat intelligence, and other security capabilities.
How to use Crowdstrike Falcon?
Install the server with pip install falcon-mcp (requires Python 3.11+). Configure CrowdStrike API credentials via environment variables (FALCON_CLIENT_ID, FALCON_CLIENT_SECRET), then run falcon-mcp on the command line or integrate with an MCP client like Claude Desktop. Modules can be enabled or disabled using command-line flags.
Key features of Crowdstrike Falcon
- Detection search and analysis
- Incident investigation and CrowdScore monitoring
- Threat actor and IOC intelligence research
- Host/device inventory and management
- Vulnerability search and management
- Identity protection entity investigation
Use cases of Crowdstrike Falcon
- Threat hunting: Search detections to uncover malicious activity.
- Incident response: Analyze incidents, behaviors, and CrowdScore.
- Threat intelligence: Research adversaries, indicators, and reports.
- Asset management: Query host inventory and device details.
- Vulnerability management: Search and assess vulnerabilities.
常见问题
What API scopes are required?
Scopes depend on the modules you enable. For example, Detections needs `Alerts:read`, Incidents needs `Incidents:read`, and Intel needs multiple Falcon Intelligence scopes. See the README for the full list.
Can I trust AI-generated FQL queries?
FQL has nuanced syntax. AI-generated filters should be tested and validated before production use. Start with simple queries and gradually build complexity.
How do I install and configure falcon-mcp?
Install via `pip install falcon-mcp` with Python 3.11+. Copy `.env.example` to `.env` and set `FALCON_CLIENT_ID` and `FALCON_CLIENT_SECRET` from your CrowdStrike API credentials.
其他 分类下的更多 MCP 服务器
MaxKB
1Panel-dev🔥 MaxKB is an open-source platform for building enterprise-grade agents. 强大易用的开源企业级智能体平台。
22.0K
Blender
ahujasidOpen-source MCP to use Blender with any LLM
23.6K
P
PickFu MCP
PickFu MCP is a Model Context Protocol (MCP) server that connects AI assistants, developers, marketers, product managers, and AI agents to PickFu's consumer research platform. It enables users to create surveys, conduct
Maestro
mobile-dev-incPainless E2E Automation for Mobile and Web
14.8K
Lemon.io
lemon-ioRequest dedicated senior developers to work on your project, write job descriptions, and prep technical interviews — all without leaving your Claude chat. Just describe what you need, and Lemon.io MCP does the rest. 1–3
评论