# CrowdStrike Falcon MCP Server Wires your AI agent into the CrowdStrike Falcon platform: detections, threat intel, host management. Handy when you want to triage incidents without leaving the chat. - MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 273 - Author: CrowdStrike - License: MIT · policy=link-only · description only; the file stays with the author - Source: https://github.com/CrowdStrike/falcon-mcp - Updated: 2026-10-22 - HTML: https://affpapa.org/en/nevibecode/mcp/crowdstrike-falcon-mcp-server ## What it does The server gives an agent programmatic access to Falcon modules. Detections, Intel, Hosts, IOC, NGSIEM, Spotlight, Cloud Security, Identity Protection, Quarantine and Real Time Response are among them. You can search and aggregate detections, research threat actors, pull vulnerability data and asset inventory, or run CQL queries against Next-Gen SIEM. It runs as a standard MCP server: `uvx falcon-mcp` starts it over stdio, and Claude picks it up with a single `claude mcp add` call. You need Falcon credentials — `FALCON_CLIENT_ID` and `FALCON_CLIENT_SECRET` — plus `FALCON_MCP_API_KEY`. Individual modules are switched on through `FALCON_MCP_MODULES`, and multi-tenant setups use `FALCON_MEMBER_CID` with `FALCON_BASE_URL`. This is a pre-1.0 release. Tool names, parameters and response shapes still shift between minor versions, so an unpinned upgrade can break a working workflow. Pin a version and read the changelog first. CrowdStrike maintains the project and takes questions through GitHub Issues. ## Requirements - Needs: Python and uv (commands run via uvx) - Environment variables: `FALCON_CLIENT_ID`, `FALCON_CLIENT_SECRET`, `FALCON_BASE_URL`, `FALCON_MEMBER_CID`, `FALCON_MCP_MODULES`, `FALCON_MCP_TRANSPORT`, `FALCON_MCP_DEBUG`, `FALCON_MCP_HOST`, `FALCON_MCP_PORT`, `FALCON_MCP_USER_AGENT_COMMENT` — keys and tokens: ask the human for the values, never commit them or put them in shared files. ## Install ### Claude Code (native platform) **Platform CLI** ```bash claude mcp add --env FALCON_CLIENT_ID= --env FALCON_CLIENT_SECRET= --env FALCON_BASE_URL= --env FALCON_MEMBER_CID= --env FALCON_MCP_MODULES= --transport stdio crowdstrike-falcon-mcp-server -- uvx falcon-mcp ``` Replace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from falcon-mcp ### Codex **Platform CLI** ```bash codex mcp add crowdstrike-falcon-mcp-server --env FALCON_CLIENT_ID= --env FALCON_CLIENT_SECRET= --env FALCON_BASE_URL= --env FALCON_MEMBER_CID= --env FALCON_MCP_MODULES= -- uvx falcon-mcp ``` Replace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from falcon-mcp ### Cursor **Config file** File `.cursor/mcp.json`: ```json { "mcpServers": { "crowdstrike-falcon-mcp-server": { "command": "uvx", "args": [ "falcon-mcp" ], "env": { "FALCON_CLIENT_ID": "", "FALCON_CLIENT_SECRET": "", "FALCON_BASE_URL": "", "FALCON_MEMBER_CID": "", "FALCON_MCP_MODULES": "" } } } } ``` Replace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from falcon-mcp ### GitHub Copilot **Config file** File `.vscode/mcp.json`: ```json { "servers": { "crowdstrike-falcon-mcp-server": { "type": "stdio", "command": "uvx", "args": [ "falcon-mcp" ], "env": { "FALCON_CLIENT_ID": "", "FALCON_CLIENT_SECRET": "", "FALCON_BASE_URL": "", "FALCON_MEMBER_CID": "", "FALCON_MCP_MODULES": "" } } } } ``` Replace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from falcon-mcp ### Gemini CLI **Platform CLI** ```bash gemini mcp add -e FALCON_CLIENT_ID= -e FALCON_CLIENT_SECRET= -e FALCON_BASE_URL= -e FALCON_MEMBER_CID= -e FALCON_MCP_MODULES= crowdstrike-falcon-mcp-server uvx falcon-mcp ``` Replace <…> with your own values. 7 more environment variables are in the server README. uvx runs the command named after the package; if the README names another one, use uvx --from falcon-mcp ## When to use it - pull and triage detections for a single host - check an indicator against threat intel - collect vulnerability data from Spotlight - run a CQL query against Next-Gen SIEM - review what AI agents did in Guardian sessions ## Example prompts - show me detections from the last day, grouped by host - look up this hash in Intel and tell me the malware family - run a CQL query over the logs from the past hour ## Similar - [dependency-checker](https://affpapa.org/en/nevibecode/hooks/dependency-checker.md) — hook · 2314 installs - [security-scanner](https://affpapa.org/en/nevibecode/hooks/security-scanner.md) — hook · 2256 installs - [secrets-in-git-history](https://affpapa.org/en/nevibecode/skills/secrets-in-git-history.md) — skill · 1900 installs - [dependencies-audit](https://affpapa.org/en/nevibecode/skills/dependencies-audit.md) — skill · 1900 installs - [what-an-email-reveals](https://affpapa.org/en/nevibecode/skills/what-an-email-reveals.md) — skill · 1800 installs - [endor-setup](https://affpapa.org/en/nevibecode/skills/endor-setup.md) — skill · 1200 installs --- NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md