CrowdStrike · Codex
Add the CrowdStrike Falcon MCP server to Codex
Investigate detections, hosts, vulnerabilities, threat intel and more on the CrowdStrike Falcon platform.
1. Add the server
Run in your terminal
# ~/.codex/config.toml [mcp_servers.crowdstrike_falcon] command = "uvx" args = ["falcon-mcp"] [mcp_servers.crowdstrike_falcon.env] FALCON_CLIENT_ID = "<your FALCON_CLIENT_ID>" FALCON_CLIENT_SECRET = "<your FALCON_CLIENT_SECRET>"
Scopes, env vars, OAuth and limits: Codex MCP config guide
2. Sign in
Run codex mcp login <name> to complete OAuth for a remote server. CrowdStrike Falcon runs locally and needs FALCON_CLIENT_ID, FALCON_CLIENT_SECRET. Replace the placeholder values above with your own before starting Codex.
3. Try it
Ask Codex for something CrowdStrike Falcon can do. Investigate detections, hosts, vulnerabilities, threat intel and more on the CrowdStrike Falcon platform. Approve the first tool call and check the result before allowing write actions automatically.
- · Each server is a [mcp_servers.<name>] table in config.toml.
- · Use enabled_tools or disabled_tools to keep the tool list short.
Get the weekly agent stack update
New official MCP servers, spec changes and harness releases, checked against the source. One email a week, no fluff.
FAQ
- How do I add the CrowdStrike Falcon MCP server to Codex?
- Run: # ~/.codex/config.toml …. Run codex mcp login <name> to complete OAuth for a remote server.
- Is this the official CrowdStrike Falcon MCP server?
- Yes. It is published by CrowdStrike as io.github.CrowdStrike/falcon-mcp in the official MCP registry.
- Does the CrowdStrike Falcon MCP server need an API key?
- Yes. It runs locally and requires FALCON_CLIENT_ID, FALCON_CLIENT_SECRET.
Links
CrowdStrike Falcon in other clients
More security & code quality for Codex
Work at CrowdStrike?
Feature CrowdStrike Falcon across the directory and its category from $49/month.
Reviewed Oct 21, 2026. Command generated from the registry record and checked against Codex's documented syntax.