falcon-mcp
falcon-mcp is a Model Context Protocol (MCP) server that connects AI agents with the CrowdStrike Falcon platform, powering intelligent security analysis in your agentic workflows. It delivers programmatic access to essential security capabilities—including detections, threat intelligence, and host management—establishing the foundation for advanced security operations and automation.
[!IMPORTANT] 🚧 Public Preview: This project is currently in public preview and under active development. Features and functionality may change before the stable 1.0 release. While we encourage exploration and testing, please avoid production deployments. We welcome your feedback through GitHub Issues to help shape the final release.
Documentation
Full docs are available at developer.crowdstrike.com/falcon-mcp.
Modules
| Module | Description |
|---|---|
| Core | Basic connectivity and system information |
| AgentWorks | Call, list, and observe Charlotte AI agents and their execution traces |
| Case Management | Case lifecycle management, evidence attachment, tagging, and templates |
| Cloud Security | Kubernetes containers, image vulnerabilities, CSPM asset inventory, IOM findings, suppression rules, cloud risks, cloud insights, and cloud groups |
| Correlation Rules | Search, create, update, and manage NG-SIEM correlation rules |
| Custom IOA | Create and manage Custom IOA behavioral detection rules and rule groups |
| Data Protection | Search Data Protection classifications, policies, and content patterns |
| Detections | Find, aggregate, and analyze detections to understand malicious activity |
| Discover | Search application inventory and managed/unmanaged assets, including drive encryption and system-insights posture |
| Exclusions | Search, create, update, and delete IOA, machine learning, sensor visibility, and certificate-based exclusions |
| Firewall Management | Search and manage firewall rules and rule groups |
| Fusion SOAR | Search Fusion SOAR workflow definitions and executions, read execution results, and run on-demand workflows |
| Host Groups | Search, create, update, and delete host groups; manage group membership |
| Hosts | Manage and query host/device information |
| Identity Protection | Entity investigation and identity protection analysis |
| Intel | Research threat actors, IOCs, and intelligence reports |
| IOC | Search, create, and remove custom indicators of compromise |
| NGSIEM | Execute CQL queries against Next-Gen SIEM |
| Policies | Search, create, update, and delete prevention, sensor update, firewall, device control, response, and content update policies; manage host-group assignment, enable/disable, and precedence |
| Quarantine | Search quarantine records, preview action counts, and release, unrelease, or delete quarantined files |
| Real Time Response | Audit, summarize, and run read-only RTR triage workflows |
| Recon | Search and aggregate Falcon Intelligence Recon notifications (recon alerts), monitoring rules, and exposed-data records for dark web, leaked credentials, and typosquatting, and preview prospective rule noise |
| Scheduled Reports | Manage scheduled reports and download report files |
| Sensor Usage | Access and analyze sensor usage data |
| Serverless | Search for vulnerabilities in serverless functions |
| Shield | SaaS security posture, checks, alerts, and app inventory |
| Spotlight | Manage and analyze vulnerability data and security assessments |
| Zero Trust Assessment | Retrieve Zero Trust Assessment posture scores and sensor and OS hardening signals for hosts |
See the Module Overview for required API scopes, available tools, and FQL resources.
Quick Start
Install
Using uv (recommended)
uv tool install falcon-mcp
Using pip
pip install falcon-mcp
Configure
Set the required environment variables (or use a .env file — see the Configuration Guide):
export FALCON_CLIENT_ID="your-client-id"
export FALCON_CLIENT_SECRET="your-client-secret"
export FALCON_BASE_URL="https://api.crowdstrike.com"
Run
falcon-mcp
See the Getting Started guide for full installation and configuration details.
Editor Integration
Using uvx (recommended)
{
"mcpServers": {
"falcon-mcp": {
"command": "uvx",
"args": [
"--env-file",
"/path/to/.env",
"falcon-mcp"
]
}
}
}
With Module Selection
{
"mcpServers": {
"falcon-mcp": {
"command": "uvx",
"args": [
"--env-file",
"/path/to/.env",
"falcon-mcp",
"--modules",
"detections,hosts,intel"
]
}
}
}
Docker
{
"mcpServers": {
"falcon-mcp-docker": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"--env-file",
"/full/path/to/.env",
"quay.io/crowdstrike/falcon-mcp:latest"
]
}
}
}
See the Usage guide for all command line options, module configuration, and library usage.
Container Usage
# Pull the latest image
docker pull quay.io/crowdstrike/falcon-mcp:latest
# Run with .env file (stdio transport)
docker run -i --rm --env-file /path/to/.env quay.io/crowdstrike/falcon-mcp:latest
# Run with streamable-http transport (add --api-key when the port is reachable beyond localhost)
docker run --rm -p 8000:8000 --env-file /path/to/.env \
quay.io/crowdstrike/falcon-mcp:latest \
--transport streamable-http --host 0.0.0.0 --api-key your-secret-key
[!CAUTION] HTTP transports have no authentication by default. Binding to a non-loopback address (
--host 0.0.0.0) exposes an unauthenticated server that anyone who can reach the port can drive with your CrowdStrike credentials. Keep the default loopback bind for local use and set--api-keywhenever you bind wider. Managed runtimes such as AWS Bedrock AgentCore and Google Cloud Run sit behind their own network security layer, so this does not apply to them. See the Configuration guide.
See the Docker Deployment guide for building locally, custom ports, and advanced configurations.
Dynamic Mode
Running many modules at once inflates the context window every AI client must hold. Dynamic mode
replaces the full tool surface with three tools — falcon_list_enabled_tools to see every tool the
server has available, falcon_search_tools to find candidate tools by keyword and then fetch the parameter
schema for