• Cloud Security Module
• Core Functionality (Built into Server)
• Custom IOA Module
• Detections Module
• Discover Module
• Hosts Module
• Identity Protection Module
• Incidents Module
• Real Time Response Module
• NGSIEM Module
• Intel Module
• IOC Module
• Firewall Management Module
• Scheduled Reports Module
• Sensor Usage Module
• Serverless Module
• Spotlight Module

API Credentials & Required Scopes

Setting Up CrowdStrike API Credentials

Before using the Falcon MCP Server, you need to create API credentials in your CrowdStrike console:

1. Log into your CrowdStrike console
2. Navigate to Support > API Clients and Keys
3. Click "Add new API client"
4. Configure your API client:
   • Client Name: Choose a descriptive name (e.g., "Falcon MCP Server")
   • Description: Optional description for your records
   • API Scopes: Select the scopes based on which modules you plan to use (see below)

Important: Ensure your API client has the necessary scopes for the modules you plan to use. You can always update scopes later in the CrowdStrike console.

Required API Scopes by Module

The Falcon MCP Server supports different modules, each requiring specific API scopes:

| Module | Required API Scopes | Purpose | | - | - | - | | Cloud Security | Falcon Container Image:readCloud Security API Assets:Read | Find and analyze kubernetes containers inventory, container images vulnerabilities, and CSPM cloud asset inventory | | Core | No additional scopes | Basic connectivity and system information | | Custom IOA | Custom IOA Rules:readCustom IOA Rules:write | Create and manage Custom IOA behavioral detection rules and rule groups | | Detections | Alerts:read | Find and analyze detections to understand malicious activity | | Discover | Assets:read | Search and analyze application inventory across your environment | | Hosts | Hosts:read | Manage and query host/device information | | Identity Protection | Identity Protection Entities:readIdentity Protection Timeline:readIdentity Protection Detections:readIdentity Protection Assessment:readIdentity Protection GraphQL:write | Comprehensive entity investigation and identity protection analysis | | Incidents | Incidents:read | Analyze security incidents and coordinated activities | | Real Time Response | Real time response:readReal time response:write | Initialize RTR sessions, execute read-only triage commands, inspect command output, and review RTR session artifacts | | NGSIEM | NGSIEM:readNGSIEM:write | Execute CQL queries against Next-Gen SIEM | | Intel | Actors (Falcon Intelligence):readIndicators (Falcon Intelligence):readReports (Falcon Intelligence):read | Research threat actors, IOCs, and intelligence reports | | IOC | IOC Management:readIOC Management:write | Search, create, and remove custom IOCs using IOC Service Collection endpoints | | Firewall Management | Firewall Management:readFirewall Management:write | Search and manage firewall rules and rule groups | | Scheduled Reports | Scheduled Reports:read | Get details about scheduled reports and searches, run reports on demand, and download report files | | Sensor Usage | Sensor Usage:read | Access and analyze sensor usage data | | Serverless | Falcon Container Image:read | Search for vulnerabilities in serverless functions across cloud service providers | | Spotlight | Vulnerabilities:read | Manage and analyze vulnerability data and security assessments |

Available Modules, Tools & Resources

[!IMPORTANT] ⚠️ Important Note on FQL Guide Resources: Several modules include FQL (Falcon Query Language) guide resources that provide comprehensive query documentation and examples. While these resources are designed to assist AI assistants and users with query construction, FQL has nuanced syntax requirements and field-specific behaviors that may not be immediately apparent. AI-generated FQL filters should be tested and validated before use in production environments. We recommend starting with simple queries and gradually building complexity while verifying results in a test environment first.

About Tools & Resources: This server provides both tools (actions you can perform) and resources (documentation and context). Tools execute operations like searching for detections or analyzing threats, while resources provide comprehensive documentation like FQL query guides that AI assistants can reference for context without requiring tool calls.

Cloud Security Module

API Scopes Required:

• Falcon Container Image:read (for Kubernetes containers and image vulnerabilities)
• Cloud Security API Assets:Read (for CSPM asset inventory)

Provides tools for accessing and analyzing CrowdStrike Cloud Security resources:

• falcon_search_kubernetes_containers: Search for containers from CrowdStrike Kubernetes & Containers inventory
• falcon_count_kubernetes_containers: Count for containers by filter criteria from CrowdStrike Kubernetes & Containers inventory
• falcon_search_images_vulnerabilities: Search for images vulnerabilities from CrowdStrike Image Assessments
• falcon_search_cspm_assets: Search cloud assets in CSPM inventory with comprehensive FQL filtering (resource types, tags, compliance, security posture)

Resources:

• falcon://cloud/kubernetes-containers/fql-guide: Comprehensive FQL documentation and examples for kubernetes containers searches
• falcon://cloud/images-vulnerabilities/fql-guide: Comprehensive FQL documentation and examples for images vulnerabilities searches
• falcon://cloud/cspm-assets/fql-guide: Comprehensive FQL documentation and examples for CSPM asset searches with filtering by resource type, tags, compliance, and security posture

Use Cases: Manage kubernetes containers inventory, container images vulnerabilities analysis, cloud asset inventory with tag-based filtering for compliance and cost management

Core Functionality (Built into Server)

API Scopes: None required beyond basic API access

The server provides core tools for interacting with the Falcon API:

• falcon_check_connectivity: Check connectivity to the Falcon API
• falcon_list_enabled_modules: Lists enabled modules in the falcon-mcp server

  These modules are determined by the --modules [flag](#module-configurati