CrowdStrike Falcon MCP Server — Claude Code MCP server
Wires your AI agent into the CrowdStrike Falcon platform: detections, threat intel, host management. Handy when you want to triage incidents without leaving the chat.
claude mcp add --env FALCON_CLIENT_ID=<FALCON_CLIENT_ID> --env FALCON_CLIENT_SECRET=<FALCON_CLIENT_SECRET> --env FALCON_BASE_URL=<FALCON_BASE_URL> --env FALCON_MEMBER_CID=<FALCON_MEMBER_CID> --env FALCON_MCP_MODULES=<FALCON_MCP_MODULES> --transport stdio crowdstrike-falcon-mcp-server -- uvx falcon-mcpWhat CrowdStrike Falcon MCP Server does
The server gives an agent programmatic access to Falcon modules. Detections, Intel, Hosts, IOC, NGSIEM, Spotlight, Cloud Security, Identity Protection, Quarantine and Real Time Response are among them. You can search and aggregate detections, research threat actors, pull vulnerability data and asset inventory, or run CQL queries against Next-Gen SIEM.
It runs as a standard MCP server: uvx falcon-mcp starts it over stdio, and Claude picks it up with a single claude mcp add call. You need Falcon credentials — FALCON_CLIENT_ID and FALCON_CLIENT_SECRET — plus FALCON_MCP_API_KEY. Individual modules are switched on through FALCON_MCP_MODULES, and multi-tenant setups use FALCON_MEMBER_CID with FALCON_BASE_URL.
This is a pre-1.0 release. Tool names, parameters and response shapes still shift between minor versions, so an unpinned upgrade can break a working workflow. Pin a version and read the changelog first. CrowdStrike maintains the project and takes questions through GitHub Issues.
What it helps with
- pull and triage detections for a single host
- check an indicator against threat intel
- collect vulnerability data from Spotlight
- run a CQL query against Next-Gen SIEM
- review what AI agents did in Guardian sessions
Example prompts for the agent
- show me detections from the last day, grouped by host
- look up this hash in Intel and tell me the malware family
- run a CQL query over the logs from the past hour
How to install CrowdStrike Falcon MCP Server
Platform CLI
claude mcp add --env FALCON_CLIENT_ID=<FALCON_CLIENT_ID> --env FALCON_CLIENT_SECRET=<FALCON_CLIENT_SECRET> --env FALCON_BASE_URL=<FALCON_BASE_URL> --env FALCON_MEMBER_CID=<FALCON_MEMBER_CID> --env FALCON_MCP_MODULES=<FALCON_MCP_MODULES> --transport stdio crowdstrike-falcon-mcp-server -- uvx falcon-mcpReplace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from falcon-mcp <command>
Platform CLI
codex mcp add crowdstrike-falcon-mcp-server --env FALCON_CLIENT_ID=<FALCON_CLIENT_ID> --env FALCON_CLIENT_SECRET=<FALCON_CLIENT_SECRET> --env FALCON_BASE_URL=<FALCON_BASE_URL> --env FALCON_MEMBER_CID=<FALCON_MEMBER_CID> --env FALCON_MCP_MODULES=<FALCON_MCP_MODULES> -- uvx falcon-mcpReplace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from falcon-mcp <command>
Config file
{
"mcpServers": {
"crowdstrike-falcon-mcp-server": {
"command": "uvx",
"args": [
"falcon-mcp"
],
"env": {
"FALCON_CLIENT_ID": "<FALCON_CLIENT_ID>",
"FALCON_CLIENT_SECRET": "<FALCON_CLIENT_SECRET>",
"FALCON_BASE_URL": "<FALCON_BASE_URL>",
"FALCON_MEMBER_CID": "<FALCON_MEMBER_CID>",
"FALCON_MCP_MODULES": "<FALCON_MCP_MODULES>"
}
}
}
}Replace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from falcon-mcp <command>
Config file
{
"servers": {
"crowdstrike-falcon-mcp-server": {
"type": "stdio",
"command": "uvx",
"args": [
"falcon-mcp"
],
"env": {
"FALCON_CLIENT_ID": "<FALCON_CLIENT_ID>",
"FALCON_CLIENT_SECRET": "<FALCON_CLIENT_SECRET>",
"FALCON_BASE_URL": "<FALCON_BASE_URL>",
"FALCON_MEMBER_CID": "<FALCON_MEMBER_CID>",
"FALCON_MCP_MODULES": "<FALCON_MCP_MODULES>"
}
}
}
}Replace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from falcon-mcp <command>
Platform CLI
gemini mcp add -e FALCON_CLIENT_ID=<FALCON_CLIENT_ID> -e FALCON_CLIENT_SECRET=<FALCON_CLIENT_SECRET> -e FALCON_BASE_URL=<FALCON_BASE_URL> -e FALCON_MEMBER_CID=<FALCON_MEMBER_CID> -e FALCON_MCP_MODULES=<FALCON_MCP_MODULES> crowdstrike-falcon-mcp-server uvx falcon-mcpReplace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from falcon-mcp <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about CrowdStrike Falcon MCP Server
How do I install CrowdStrike Falcon MCP Server in Claude?
Run `claude mcp add falcon-mcp -e FALCON_CLIENT_ID=<FALCON_CLIENT_ID> -e FALCON_CLIENT_SECRET=<FALCON_CLIENT_SECRET> -e FALCON_MCP_API_KEY=<FALCON_MCP_API_KEY> -- uvx falcon-mcp`. Replace the placeholders with your own values first.
What does CrowdStrike Falcon MCP Server do?
It connects an AI agent to the Falcon platform and exposes detections, threat intel, hosts, vulnerabilities and other modules. The agent calls them as tools inside the conversation.
What do I need for it to work?
Falcon credentials: FALCON_CLIENT_ID, FALCON_CLIENT_SECRET and FALCON_MCP_API_KEY. Which modules load is set through FALCON_MCP_MODULES.
