Add the CrowdStrike Falcon MCP server to Cursor

{
  "mcpServers": {
    "crowdstrike-falcon": {
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<your FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<your FALCON_CLIENT_SECRET>"
      }
    }
  }
}

Scopes, env vars, OAuth and limits: Cursor MCP config guide

Cursor prompts you to sign in the first time a remote OAuth server is used. CrowdStrike Falcon runs locally and needs FALCON_CLIENT_ID, FALCON_CLIENT_SECRET. Replace the placeholder values above with your own before starting Cursor.

Ask Cursor for something CrowdStrike Falcon can do. Investigate detections, hosts, vulnerabilities, threat intel and more on the CrowdStrike Falcon platform. Approve the first tool call and check the result before allowing write actions automatically.

• · Remote servers take a url; local servers take command and args.
• · Values can reference ${env:NAME} so secrets stay out of the file.

How do I add the CrowdStrike Falcon MCP server to Cursor?

Run: { …. Cursor prompts you to sign in the first time a remote OAuth server is used.

Is this the official CrowdStrike Falcon MCP server?

Yes. It is published by CrowdStrike as io.github.CrowdStrike/falcon-mcp in the official MCP registry.

Does the CrowdStrike Falcon MCP server need an API key?

Yes. It runs locally and requires FALCON_CLIENT_ID, FALCON_CLIENT_SECRET.