CrowdStrike · Gemini CLI

Add the CrowdStrike Falcon MCP server to Gemini CLI

Investigate detections, hosts, vulnerabilities, threat intel and more on the CrowdStrike Falcon platform.

Official serverLocalSecurity & code quality

1. Add the server

Run in your terminal

gemini mcp add -e FALCON_CLIENT_ID=YOUR_VALUE -e FALCON_CLIENT_SECRET=YOUR_VALUE crowdstrike-falcon uvx falcon-mcp

Scopes, env vars, OAuth and limits: Gemini CLI MCP config guide

2. Sign in

Run /mcp auth <name> inside Gemini CLI to sign in to an OAuth server. CrowdStrike Falcon runs locally and needs FALCON_CLIENT_ID, FALCON_CLIENT_SECRET. Replace the placeholder values above with your own before starting Gemini CLI.

3. Try it

Ask Gemini CLI for something CrowdStrike Falcon can do. Investigate detections, hosts, vulnerabilities, threat intel and more on the CrowdStrike Falcon platform. Approve the first tool call and check the result before allowing write actions automatically.

  • · In settings.json, streamable HTTP servers use httpUrl, SSE servers use url, local servers use command.
  • · includeTools and excludeTools limit which tools the model sees.

Get the weekly agent stack update

New official MCP servers, spec changes and harness releases, checked against the source. One email a week, no fluff.

FAQ

How do I add the CrowdStrike Falcon MCP server to Gemini CLI?
Run: gemini mcp add -e FALCON_CLIENT_ID=YOUR_VALUE -e FALCON_CLIENT_SECRET=YOUR_VALUE crowdstrike-falcon uvx falcon-mcp. Run /mcp auth <name> inside Gemini CLI to sign in to an OAuth server.
Is this the official CrowdStrike Falcon MCP server?
Yes. It is published by CrowdStrike as io.github.CrowdStrike/falcon-mcp in the official MCP registry.
Does the CrowdStrike Falcon MCP server need an API key?
Yes. It runs locally and requires FALCON_CLIENT_ID, FALCON_CLIENT_SECRET.

Links

CrowdStrike MCP docsGemini CLI MCP docsCrowdStrike Falcon server details

CrowdStrike Falcon in other clients

Claude CodeCodexCursorVS Code (GitHub Copilot)

More security & code quality for Gemini CLI

SnykSonarQubeSonatype GuideCheckmarx One

Work at CrowdStrike?

Feature CrowdStrike Falcon across the directory and its category from $49/month.

Feature this server

Reviewed Oct 21, 2026. Command generated from the registry record and checked against Gemini CLI's documented syntax.