CrowdStrike · Official

CrowdStrike Falcon MCP server

Investigate detections, hosts, vulnerabilities, threat intel and more on the CrowdStrike Falcon platform.

Verified publisher namespaceLocalSecurity & code quality
Registry name
io.github.CrowdStrike/falcon-mcp
Latest version
0.20.0 · updated 2026-10-22
Links
Vendor docsSource

Install

Commands are generated from the registry record. Remote servers usually ask you to sign in with OAuth on first use.

Step-by-step guides
Add to CursorAdd to VS CodeAdd to KiroAdd to LM StudioBundle with other servers

Claude Code

claude mcp add crowdstrike-falcon -e FALCON_CLIENT_ID=YOUR_VALUE -e FALCON_CLIENT_SECRET=YOUR_VALUE -- uvx falcon-mcp

Codex

# ~/.codex/config.toml
[mcp_servers.crowdstrike_falcon]
command = "uvx"
args = ["falcon-mcp"]

[mcp_servers.crowdstrike_falcon.env]
FALCON_CLIENT_ID = "<your FALCON_CLIENT_ID>"
FALCON_CLIENT_SECRET = "<your FALCON_CLIENT_SECRET>"

Gemini CLI

gemini mcp add -e FALCON_CLIENT_ID=YOUR_VALUE -e FALCON_CLIENT_SECRET=YOUR_VALUE crowdstrike-falcon uvx falcon-mcp

Cursor

{
  "mcpServers": {
    "crowdstrike-falcon": {
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<your FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<your FALCON_CLIENT_SECRET>"
      }
    }
  }
}

VS Code (GitHub Copilot)

code --add-mcp '{"name":"crowdstrike-falcon","command":"uvx","args":["falcon-mcp"],"env":{"FALCON_CLIENT_ID":"<your FALCON_CLIENT_ID>","FALCON_CLIENT_SECRET":"<your FALCON_CLIENT_SECRET>"}}'
Step-by-step for Claude CodeStep-by-step for CodexStep-by-step for Gemini CLIStep-by-step for CursorStep-by-step for VS Code (GitHub Copilot)

What the CrowdStrike Falcon MCP server can do

From CrowdStrike's own MCP documentation.

Authentication

Falcon API client: FALCON_CLIENT_ID and FALCON_CLIENT_SECRET, plus FALCON_BASE_URL for your cloud region.

Options

  • Run with uvx falcon-mcp (recommended for editors), or install with uv tool install or pip. Needs Python 3.11 or later.
  • Modules include Detections, Hosts, Spotlight, Intel, Cloud Security, Identity Protection, NGSIEM, IOC, Firewall Management and Real Time Response.
  • Dynamic mode exposes falcon_search_tools, falcon_execute_tool and falcon_list_enabled_tools instead of every tool.
  • Docker deployment and other transports are covered on separate doc pages.

Tools (Not listed in full. 28 modules are documented, each with its own tools.)

falcon_check_connectivityfalcon_search_toolsfalcon_execute_toolfalcon_list_enabled_tools

Good to know

  • Each module needs matching API scopes on the client. Start with at least Hosts READ and Alerts READ.
  • Copy the base URL from your Falcon console rather than assuming api.crowdstrike.com.
  • Use an absolute path for the .env file, since editors may not launch from your working directory.
CrowdStrike MCP docs

Packages

  • pypi falcon-mcp

More security & code quality

SnykSonarQubeSonatype GuideCheckmarx One

Get the weekly agent stack update

New official MCP servers, spec changes and harness releases, checked against the source. One email a week, no fluff.

Work at CrowdStrike?

Feature CrowdStrike Falcon at the top of the security & code quality category and the MCP directory from $49/month.

Feature this server

Add an install badge to the CrowdStrike Falcon README

Free. One link that installs the server in Cursor, VS Code, Kiro, LM Studio or Goose with one click, and gives Claude Code, Codex, Gemini CLI and 10 more agents their exact config.

Install in any agent (Markdown)

[![Install with AgentAtlas](https://img.shields.io/badge/install-15_agents-111111)](https://agentatlas.dev/tools/setup-kit?servers=crowdstrike-falcon)

Listed on AgentAtlas (Markdown)

[![Listed on AgentAtlas](https://img.shields.io/badge/listed_on-AgentAtlas-111111)](https://agentatlas.dev/mcp/crowdstrike-falcon)

Reviewed Oct 21, 2026. Official means published under CrowdStrike's namespace in the MCP registry. It is not a security audit.