Add the CrowdStrike Falcon MCP server to VS Code (GitHub Copilot)

code --add-mcp '{"name":"crowdstrike-falcon","command":"uvx","args":["falcon-mcp"],"env":{"FALCON_CLIENT_ID":"<your FALCON_CLIENT_ID>","FALCON_CLIENT_SECRET":"<your FALCON_CLIENT_SECRET>"}}'

Scopes, env vars, OAuth and limits: VS Code (GitHub Copilot) MCP config guide

VS Code opens the sign-in flow when Copilot first calls a remote OAuth server. CrowdStrike Falcon runs locally and needs FALCON_CLIENT_ID, FALCON_CLIENT_SECRET. Replace the placeholder values above with your own before starting VS Code (GitHub Copilot).

Ask VS Code (GitHub Copilot) for something CrowdStrike Falcon can do. Investigate detections, hosts, vulnerabilities, threat intel and more on the CrowdStrike Falcon platform. Approve the first tool call and check the result before allowing write actions automatically.

• · mcp.json uses a top-level servers key, not mcpServers.
• · code --add-mcp installs a server into your user profile from the terminal.

How do I add the CrowdStrike Falcon MCP server to VS Code (GitHub Copilot)?

Run: code --add-mcp '{"name":"crowdstrike-falcon","command":"uvx","args":["falcon-mcp"],"env":{"FALCON_CLIENT_ID":"<your FALCON_CLIENT_ID>","FALCON_CLIENT_SECRET":"<your FALCON_CLIENT_SECRET>"}}'. VS Code opens the sign-in flow when Copilot first calls a remote OAuth server.

Is this the official CrowdStrike Falcon MCP server?

Yes. It is published by CrowdStrike as io.github.CrowdStrike/falcon-mcp in the official MCP registry.

Does the CrowdStrike Falcon MCP server need an API key?

Yes. It runs locally and requires FALCON_CLIENT_ID, FALCON_CLIENT_SECRET.