CrowdStrike Falcon MCP Server

Official CrowdStrike MCP server connecting AI agents to the Falcon platform for detections, threat intel, hosts, vulnerabilities, and security automation.

Security by CrowdStrike API Key active

GitHub Docs

Overview

falcon-mcp is the official CrowdStrike Model Context Protocol server that connects AI agents to the CrowdStrike Falcon platform for security analysis, threat hunting, and SecOps automation. It exposes Falcon platform capabilities as MCP tools so an LLM agent can investigate detections, query threat intelligence, manage hosts, search vulnerabilities, run NGSIEM queries, and more through a single uniform interface.

The server is organized into roughly 17 functional modules including Detections, Hosts, Intel, Spotlight (vulnerabilities), IOC, Custom IOA, Identity Protection, Cloud Security, Discover, Firewall Management, NGSIEM, Real Time Response (read-only triage), Scheduled Reports, Sensor Usage, Serverless, and Shield. Operators can enable a subset of modules via the --modules flag, and the server supports stdio, streamable-http, and SSE transports for different deployment patterns.

The project is published by CrowdStrike on GitHub, PyPI, and as a container image on Quay. It is currently in public preview, and CrowdStrike notes that features may change before the v1.0 release. Authentication uses CrowdStrike OAuth2 API credentials (client ID and secret) scoped to the modules you enable.

Tools

Tool	Description
`falcon_check_connectivity`	Core module: verifies that the server can authenticate and reach the Falcon API.
`falcon_list_modules`	Core module: lists all available modules and their enabled status.
`falcon_search_detections`	Detections module: finds detections by criteria like severity, status, hostname, and returns behaviors, device context, and threat info.
`falcon_get_detection_details`	Detections module: retrieves detailed information for known detection IDs.
`falcon_search_hosts`	Hosts module: searches host/device inventory in your environment.
`falcon_search_incidents`	Incidents capability: finds and analyzes security incidents to understand coordinated activity.
`falcon_search_indicators`	Intel module: research threat actors and indicators of compromise.
`search_ioa_rule_groups`	Custom IOA module: search behavioral detection rule groups.
`create_ioa_rule_group`	Custom IOA module: create a new IOA rule group.
`create_ioa_rule`	Custom IOA module: create a new behavioral detection rule.
`falcon_search_vulnerabilities`	Spotlight module: query vulnerability and security assessment data for hosts.
`falcon_run_ngsiem_query`	NGSIEM module: execute a CQL query against Falcon NGSIEM.

Setup Guide

Prerequisites

CrowdStrike Falcon API credentials (Client ID and Client Secret) with API scopes for the modules you plan to use
Python 3.x with uv or pip, or Docker for container-based deployment

Install

Using uv (recommended):

uv tool install falcon-mcp

Using pip:

pip install falcon-mcp

Environment variables

Create a .env file:

FALCON_CLIENT_ID=your_client_id
FALCON_CLIENT_SECRET=your_client_secret
FALCON_BASE_URL=https://api.crowdstrike.com

Use the correct regional base URL for your tenant (api.us-2.crowdstrike.com, api.eu-1.crowdstrike.com, etc.).

MCP client configuration

Using uvx:

{
  "mcpServers": {
    "falcon-mcp": {
      "command": "uvx",
      "args": [
        "--env-file",
        "/path/to/.env",
        "falcon-mcp"
      ]
    }
  }
}

Enable only specific modules:

{
  "mcpServers": {
    "falcon-mcp": {
      "command": "uvx",
      "args": [
        "--env-file",
        "/path/to/.env",
        "falcon-mcp",
        "--modules",
        "detections,hosts,intel,spotlight"
      ]
    }
  }
}

Docker:

{
  "mcpServers": {
    "falcon-mcp-docker": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "--env-file",
        "/full/path/to/.env",
        "quay.io/crowdstrike/falcon-mcp:latest"
      ]
    }
  }
}

For remote deployment, the server can be launched with --transport streamable-http --host 0.0.0.0.

Use Cases

Triage active detections by asking the agent to summarize unresolved high-severity detections, group them by host, and pull related behaviors and process trees.
Investigate a suspicious IOC by pivoting from a hash or domain into Falcon Intel for attribution, then searching detections and hosts that have observed it.
Build a daily vulnerability report by querying Spotlight for unpatched critical CVEs across managed hosts and grouping by business unit.
Run NGSIEM CQL queries from chat to hunt for specific TTPs without context-switching into the Falcon console.
Auto-respond to phishing or malware tickets by looking up the affected host in Falcon, checking detections, and creating or updating custom IOA rules and IOCs.

Example Prompts

"List all unresolved Falcon detections with severity high or critical from the last 24 hours and group them by hostname."
"Look up host WIN-DC01 in Falcon and show me its sensor status, OS, last seen time, and any open detections."
"Search Falcon Intel for the actor FANCY BEAR and return recent reports plus associated indicators."
"Run an NGSIEM CQL query to find all PowerShell executions with encoded commands in the last 12 hours."
"Show me all critical Spotlight vulnerabilities on Linux hosts that have an available patch."

Pros

Official CrowdStrike-maintained server with broad coverage across the Falcon platform (17 modules spanning detections, intel, hosts, vulnerabilities, NGSIEM, cloud, identity, and more).
Granular module selection via --modules flag so you can scope the server to least-privilege API capabilities.
Multiple deployment options: PyPI package, uvx, and an official Quay container image, plus stdio, SSE, and streamable-http transports.
Active development with documentation site at crowdstrike.github.io/falcon-mcp and examples for ADK and Amazon Bedrock AgentCore.

Limitations

In public preview; CrowdStrike explicitly notes features may change before v1.0 and discourages production use.
Real Time Response module is limited to read-only triage commands, so containment and remediation actions are not exposed.
Requires a paid CrowdStrike Falcon tenant and properly scoped API credentials; some modules (like NGSIEM) depend on specific Falcon SKUs.

Alternatives

Microsoft Defender / Sentinel MCP server for Microsoft security stack equivalents.
VirusTotal MCP server for indicator and threat enrichment without an EDR backend.
Community CrowdStrike wrappers such as josh-thurston/MCP-CrowdStrikeFalcon, though the official CrowdStrike/falcon-mcp is preferable.