Add the CrowdStrike Falcon MCP server to Claude Code

claude mcp add crowdstrike-falcon -e FALCON_CLIENT_ID=YOUR_VALUE -e FALCON_CLIENT_SECRET=YOUR_VALUE -- uvx falcon-mcp

Scopes, env vars, OAuth and limits: Claude Code MCP config guide

Run /mcp inside Claude Code to sign in to remote servers that use OAuth. CrowdStrike Falcon runs locally and needs FALCON_CLIENT_ID, FALCON_CLIENT_SECRET. Replace the placeholder values above with your own before starting Claude Code.

Ask Claude Code for something CrowdStrike Falcon can do. Investigate detections, hosts, vulnerabilities, threat intel and more on the CrowdStrike Falcon platform. Approve the first tool call and check the result before allowing write actions automatically.

• · Add --scope project to share a server with your team through .mcp.json in the repo.
• · Use claude mcp list to see what is connected and claude mcp remove <name> to drop one.

How do I add the CrowdStrike Falcon MCP server to Claude Code?

Run: claude mcp add crowdstrike-falcon -e FALCON_CLIENT_ID=YOUR_VALUE -e FALCON_CLIENT_SECRET=YOUR_VALUE -- uvx falcon-mcp. Run /mcp inside Claude Code to sign in to remote servers that use OAuth.

Is this the official CrowdStrike Falcon MCP server?

Yes. It is published by CrowdStrike as io.github.CrowdStrike/falcon-mcp in the official MCP registry.

Does the CrowdStrike Falcon MCP server need an API key?

Yes. It runs locally and requires FALCON_CLIENT_ID, FALCON_CLIENT_SECRET.