Falcon Mcp

Name: Falcon Mcp
Author: CrowdStrike

by CrowdStrikecommunityv0.12.0

234

falcon-mcp is an MCP server that connects AI agents to the CrowdStrike Falcon platform. It provides programmatic access to security workflows such as detections, threat intelligence, host management, case management, vulnerability analysis, and related Falcon modules.

From the registry: Connects AI agents with CrowdStrike Falcon for security analysis and automation.

GitHub Repository

Install & configure

Prerequisites

optional
Install uv
Install the uv Python package manager/runtime to run the recommended portable command via uvx.
https://docs.astral.sh/uv/
required
CrowdStrike Falcon API credentials
Create or obtain CrowdStrike Falcon API credentials and note the base URL for your Falcon tenant.
https://crowdstrike.github.io/falcon-mcp/getting-started/configuration/

Install in your client

Paste into the AI you're chatting with — it will figure out the rest

Please install the `falcon-mcp` MCP server into my current AI client (that's you).

Required prerequisites (do these first if not already done):
- **CrowdStrike Falcon API credentials** — Create or obtain CrowdStrike Falcon API credentials and note the base URL for your Falcon tenant. (https://crowdstrike.github.io/falcon-mcp/getting-started/configuration/)

Optional prerequisites:
- Install uv — Install the uv Python package manager/runtime to run the recommended portable command via uvx. (https://docs.astral.sh/uv/)

Canonical MCP server config (stdio transport):
- command: `uvx`
- args: ["falcon-mcp"]
- required environment variables:
  - `FALCON_CLIENT_ID`: CrowdStrike Falcon API client ID. (example: `<your-client-id>`)
  - `FALCON_CLIENT_SECRET`: CrowdStrike Falcon API client secret. (example: `<your-client-secret>`)
  - `FALCON_BASE_URL`: Base URL for your CrowdStrike Falcon API tenant. (example: `<your-falcon-base-url>`)
- optional environment variables:
  - `FALCON_MODULES`: Optional module selection if you want to limit enabled modules; README also shows this can be supplied as the CLI argument --modules detections,hosts,intel. (example: `<module1,module2,module3>`)

Note: Preferred portable setup is stdio via uvx. README also shows alternative stdio launch methods using the installed falcon-mcp binary or Docker. HTTP-style deployment exists only for containers using 'streamable-http', which is not one of the allowed transport enum values here, so the canonical extract uses stdio.

Add this MCP server to my current client's config in the correct format for you. If you need secrets or credentials I haven't provided, ASK me — do not invent values or leave raw placeholders. After adding it, tell me how to verify the server is connected.

Note: Preferred portable setup is stdio via uvx. README also shows alternative stdio launch methods using the installed falcon-mcp binary or Docker. HTTP-style deployment exists only for containers using 'streamable-http', which is not one of the allowed transport enum values here, so the canonical extract uses stdio.