CrowdStrike Falcon MCP Server

Name: CrowdStrike Falcon MCP Server
Author: CrowdStrike

Investigate and manage a CrowdStrike Falcon tenant: detections, hosts, intel, SIEM and policies

Official · CrowdStrike Python Local · stdio Security DevOps and monitoring Cloud platforms

GitHub PyPI Website

75 popularity score ★ 277 ↓ 47k/mo

Connect your client

Local (PyPI)

Add in one click

Add to Cursor Add to VS Code Add to LM Studio Add to Goose

Opens the app, which asks before it adds the server. Then replace each <NAME> in its settings with your value.

Or add it by command or config

It needs FALCON_CLIENT_ID, FALCON_CLIENT_SECRET. Replace each <NAME> with your value.

Claude CodeTerminal

claude mcp add crowdstrike-falcon -e FALCON_CLIENT_ID=<FALCON_CLIENT_ID> -e FALCON_CLIENT_SECRET=<FALCON_CLIENT_SECRET> -- uvx falcon-mcp

Claude Desktopclaude_desktop_config.json

{
  "mcpServers": {
    "crowdstrike-falcon": {
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<FALCON_CLIENT_SECRET>"
      }
    }
  }
}

Cursor~/.cursor/mcp.json

{
  "mcpServers": {
    "crowdstrike-falcon": {
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<FALCON_CLIENT_SECRET>"
      }
    }
  }
}

VS Code.vscode/mcp.json

{
  "servers": {
    "crowdstrike-falcon": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<FALCON_CLIENT_SECRET>"
      }
    }
  }
}

Codex~/.codex/config.toml

[mcp_servers.crowdstrike-falcon]
command = "uvx"
args = ["falcon-mcp"]

[mcp_servers.crowdstrike-falcon.env]
FALCON_CLIENT_ID = "<FALCON_CLIENT_ID>"
FALCON_CLIENT_SECRET = "<FALCON_CLIENT_SECRET>"

Gemini CLITerminal

gemini mcp add --scope user -e FALCON_CLIENT_ID=<FALCON_CLIENT_ID> -e FALCON_CLIENT_SECRET=<FALCON_CLIENT_SECRET> crowdstrike-falcon uvx -- falcon-mcp

Local (container)

Add in one click

Add to Cursor Add to VS Code Add to LM Studio Add to Goose

Opens the app, which asks before it adds the server. Then replace each <NAME> in its settings with your value.

Or add it by command or config

It needs FALCON_CLIENT_ID, FALCON_CLIENT_SECRET. Replace each <NAME> with your value.

Claude CodeTerminal

claude mcp add crowdstrike-falcon -e FALCON_CLIENT_ID=<FALCON_CLIENT_ID> -e FALCON_CLIENT_SECRET=<FALCON_CLIENT_SECRET> -- docker run -i --rm -e FALCON_CLIENT_ID -e FALCON_CLIENT_SECRET quay.io/crowdstrike/falcon-mcp:latest

Claude Desktopclaude_desktop_config.json

{
  "mcpServers": {
    "crowdstrike-falcon": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "FALCON_CLIENT_ID",
        "-e",
        "FALCON_CLIENT_SECRET",
        "quay.io/crowdstrike/falcon-mcp:latest"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<FALCON_CLIENT_SECRET>"
      }
    }
  }
}

Cursor~/.cursor/mcp.json

{
  "mcpServers": {
    "crowdstrike-falcon": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "FALCON_CLIENT_ID",
        "-e",
        "FALCON_CLIENT_SECRET",
        "quay.io/crowdstrike/falcon-mcp:latest"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<FALCON_CLIENT_SECRET>"
      }
    }
  }
}

VS Code.vscode/mcp.json

{
  "servers": {
    "crowdstrike-falcon": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "FALCON_CLIENT_ID",
        "-e",
        "FALCON_CLIENT_SECRET",
        "quay.io/crowdstrike/falcon-mcp:latest"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<FALCON_CLIENT_SECRET>"
      }
    }
  }
}

Codex~/.codex/config.toml

[mcp_servers.crowdstrike-falcon]
command = "docker"
args = ["run", "-i", "--rm", "-e", "FALCON_CLIENT_ID", "-e", "FALCON_CLIENT_SECRET", "quay.io/crowdstrike/falcon-mcp:latest"]

[mcp_servers.crowdstrike-falcon.env]
FALCON_CLIENT_ID = "<FALCON_CLIENT_ID>"
FALCON_CLIENT_SECRET = "<FALCON_CLIENT_SECRET>"

Gemini CLITerminal

gemini mcp add --scope user -e FALCON_CLIENT_ID=<FALCON_CLIENT_ID> -e FALCON_CLIENT_SECRET=<FALCON_CLIENT_SECRET> crowdstrike-falcon docker -- run -i --rm -e FALCON_CLIENT_ID -e FALCON_CLIENT_SECRET quay.io/crowdstrike/falcon-mcp:latest

Settings 12

`FALCON_CLIENT_ID`	Required: Client ID of a Falcon API client; the server exits without it.
`FALCON_CLIENT_SECRET` secret	Required: Secret of that API client.
`FALCON_BASE_URL`	Optional: API address for your Falcon cloud region. Default `https://api.crowdstrike.com`.
`FALCON_MCP_MODULES`	Optional: Comma-separated modules to load, all when unset; the old name dataprotection loads datasecurity.
`FALCON_MCP_READ_ONLY`	Optional: true registers only tools that change nothing in the tenant.
`FALCON_MCP_TOOLS`	Optional: Comma-separated tool names to add on top of the enabled modules.
`FALCON_MCP_EXCLUDE_TOOLS`	Optional: Comma-separated tool names to withhold; an unknown name stops startup.
`FALCON_MCP_DYNAMIC`	Optional: true swaps the full tool list for search and run tools. For dynamic mode.
`FALCON_MEMBER_CID`	Optional: Child CID to work in under Flight Control (MSSP).
`FALCON_PROXY_URL`	Optional: HTTP or HTTPS proxy for outbound API calls.
`FALCON_MCP_TRANSPORT`	Optional: stdio, sse or streamable-http. Default `stdio`.
`FALCON_MCP_API_KEY` secret	Optional: Key clients must send when an HTTP transport is used. For HTTP transports.

In a container, a setting goes in with -e NAME=value after docker run.

What it does

falcon-mcp is CrowdStrike's own MCP server for the Falcon platform. It runs on your machine, signs in to the Falcon API with an API client ID and secret, and turns the tenant's security data and controls into tools. They cover detections, hosts and host groups, threat intelligence, Next-Gen SIEM queries in CQL, Spotlight and cloud vulnerabilities, identity protection, cases, policies, exclusions, firewall rules, quarantine, Fusion SOAR workflows, Real Time Response triage, Data Security objects and more, in 28 modules.

With every module loaded the code registers 170 tools: 167 from the modules plus three core tools that check the connection and list what is enabled. Many tools change tenant state, so the server has its own filters. --modules picks whole modules and --read-only drops every tool that writes. --tools adds single tools while --exclude-tools removes them. A dynamic mode swaps the long list for a pair of tools that find the others and run them, which keeps a client's context small.

The project is now in maintenance mode. Its makers moved new work to CrowdStrike MCP, a hosted server inside the Falcon platform, and this one gets security and dependency fixes only. The hosted one is offered in the US-1, US-2 and EU-1 clouds. It follows Falcon roles and keeps most falcon_* tool names. The docs list Fusion SOAR, Zero Trust Assessment, Real Time Response and the cloud insights tools as found only here. The Data Security module was renamed from Data Protection, and the old name dataprotection still loads it with a warning.

What it needs

Runtime	Python 3.11+Docker
Runs on	macOS, Windows, Linux
CrowdStrike Falcon	Paid planAn API client made in the Falcon console, with read or write scopes for each module you load

Run it with uvx (needs uv) or pip, or with Docker using the quay.io image. Create an API client in the Falcon console with the scopes the Module Overview lists for each module you load. Set FALCON_BASE_URL when your tenant is not in US-1. A .env file in the working folder is read at start, and the uvx client config can pass one with --env-file.

Limits

Limit In maintenance mode: security and dependency fixes only, no new features, and an end-of-life date will be announced before the repository is archived
Not covered Real Time Response tools run read-only commands only; there is no tool for write or remote shell commands
Limit Guardian tools read an /aidr API that differs between Falcon deployments, so some return HTTP 400 or 404
Limit --modules loads or skips whole modules; use --read-only or --exclude-tools to hold back single write tools
Limit An unknown tool name in --tools or --exclude-tools stops the server at start
Limit HTTP transports have no authentication unless --api-key is set
Cost falcon_invoke_agentworks_agent runs Charlotte AI agents, which can spend AgentWorks credits; it takes a credit limit
Limit Exits at start when the API client ID and secret are missing or sign-in fails

Pre-1.0 public preview: its makers ask that it not be used in production and say tool names, parameters and responses may change between minor releases. The Guardian module reads an /aidr API that differs between Falcon deployments, so some of its tools return HTTP 400 or 404. Real Time Response tools only run read-only commands; there is no write or remote-shell RTR tool. The Data Security create and update tools described in the main-branch README are not in 0.19.0, whose data_protection module has three search tools only. --modules is all-or-nothing per module, so use --read-only or --exclude-tools to hold back write tools. HTTP transports have no authentication unless --api-key is set.

Who it suits

Security teams on CrowdStrike Falcon who want an assistant to triage detections, look up hosts and intel, query NG-SIEM or run read-only RTR checks, with their own API client scopes as the boundary. Start with --read-only for investigation; enable write tools only where policy, exclusion or quarantine changes are wanted. Its makers now point most teams to the hosted CrowdStrike MCP, which needs no install and follows Falcon roles. Stay on this one if your tenant is outside US-1, US-2 and EU-1, or you need Fusion SOAR, Zero Trust Assessment, RTR or cloud insights. Not useful without a Falcon tenant.

Tools 60 of 170

50 only read, 10 change things. A ? marks an optional parameter.

falcon_check_connectivity: Checks that the configured API credentials can reach Falcon
falcon_list_enabled_modules: Lists the modules loaded in this server
falcon_list_enabled_tools: Lists every tool the server currently offers, with any filters in force
falcon_search_tools: Dynamic mode: finds tools by keyword and returns a chosen tool's parameter schemaquery?: stringmodule?: stringlimit?: integertool_names?: array
falcon_execute_tool changes: Dynamic mode: runs a tool found with the search tooltool_name: stringparameters?: object
falcon_search_detections: Finds detections (alerts) with an FQL filterfilter?: stringlimit?: integeroffset?: integerq?: stringsort?: stringinclude_hidden?: boolean
falcon_search_hosts: Finds managed hosts with an FQL filterfilter?: stringlimit?: integeroffset?: integersort?: string
falcon_search_host_groups: Finds host groupsfilter?: stringlimit?: integeroffset?: integersort?: string
falcon_perform_host_group_action changes: Adds hosts to or removes hosts from a groupaction_name: stringids: arrayfilter: string
falcon_search_actors: Looks up threat actor profiles in Falcon Intelligencefilter?: stringlimit?: integeroffset?: integersort?: stringq?: string
falcon_search_indicators: Looks up threat intelligence indicatorsfilter?: stringlimit?: integeroffset?: integersort?: stringq?: stringinclude_deleted?: booleaninclude_relations?: boolean
falcon_search_reports: Looks up intelligence reportsfilter?: stringlimit?: integeroffset?: integersort?: stringq?: string
falcon_search_iocs: Finds custom indicators of compromisefilter?: stringlimit?: integersort?: stringafter?: stringfrom_parent?: boolean
falcon_search_ngsiem: Runs a CQL query against Next-Gen SIEMquery_string: stringstart: stringrepository?: stringend?: string
falcon_search_vulnerabilities: Finds Spotlight vulnerability recordsfilter?: stringlimit?: integersort?: stringafter?: stringfacet?: string
falcon_search_serverless_vulnerabilities: Finds vulnerabilities in serverless functionsfilter: stringlimit?: integeroffset?: integersort?: string
falcon_search_kubernetes_containers: Finds Kubernetes containers in the cloud inventoryfilter?: stringlimit?: integeroffset?: integersort?: string
falcon_search_cspm_assets: Searches the cloud asset inventoryfilter?: stringlimit?: integerafter?: stringsort?: string
falcon_search_iom_findings: Finds cloud misconfiguration (IOM) findingsfilter?: stringlimit?: integeroffset?: integersort?: string
falcon_search_cloud_risks: Finds cloud risksfilter?: stringlimit?: integeroffset?: integersort?: string
falcon_search_applications: Searches the Discover application inventoryfilter: stringfacet?: stringlimit?: integersort?: string
falcon_search_unmanaged_assets: Finds devices that run no Falcon sensorfilter?: stringlimit?: integeroffset?: integersort?: string
falcon_search_policies: Finds prevention, firewall, sensor update and other policiespolicy_type: stringfilter?: stringlimit?: integeroffset?: integersort?: string
falcon_update_policy changes: Changes a policy's settingspolicy_type: stringid?: stringname?: stringdescription?: stringsettings?: any
falcon_perform_policy_action changes: Enables or disables a policy or changes its host-group assignmentpolicy_type: stringaction_name: stringids: arraygroup_id?: string
falcon_search_exclusions: Finds IOA, ML, sensor visibility or certificate exclusionsexclusion_type: stringfilter?: stringlimit?: integersort?: stringoffset?: integer
falcon_create_exclusion changes: Creates an exclusionexclusion_type: stringname?: stringvalue?: stringpattern_id?: stringifn_regex?: stringcl_regex?: stringparent_ifn_regex?: stringparent_cl_regex?: stringgrandparent_ifn_regex?: stringgrandparent_cl_regex?: stringcertificate?: objectstatus?: stringexcluded_from?: arrayis_descendant_process?: booleanhost_groups?: arrayapplied_globally?: booleandescription?: stringcomment?: string
falcon_create_ioa_rule changes: Creates a Custom IOA detection rulerulegroup_id: stringname: stringruletype_id: stringdisposition_id: integerpattern_severity: stringfield_values: arraydescription?: stringcomment?: string
falcon_search_cases: Finds casesfilter?: stringlimit?: integeroffset?: integerq?: stringsort?: string
falcon_search_data_security_entities: Searches Data Security classifications, policies, patterns and similar objectsentity_type: stringfilter?: stringlimit?: integeroffset?: integersort?: stringplatform_name?: string
falcon_execute_workflow changes: Starts an on-demand Fusion SOAR workflowdefinition_id?: stringname?: stringparameters?: objectkey?: stringdepth?: integersource_event_url?: string
falcon_init_rtr_session changes: Opens a Real Time Response session on a hostdevice_id: stringorigin?: stringqueue_offline?: booleantimeout?: integertimeout_duration?: string
falcon_execute_rtr_read_only_command changes: Runs a read-only RTR command such as ls, ps or cat on a hostsession_id: stringbase_command: stringcommand_string?: stringpersist?: boolean
falcon_search_zta_assessments: Finds Zero Trust Assessment scores for hostsmin_score?: integermax_score?: integerlimit?: integerafter?: stringsort_order?: string
falcon_search_recon_notifications: Finds Recon alerts about dark web and leaked-data exposurefilter?: stringq?: stringlimit?: integeroffset?: integersort?: string
falcon_invoke_agentworks_agent changes: Calls a Charlotte AI agent in AgentWorks, which can spend creditsprompt: stringagent_id: stringversion_id?: stringdeadline_seconds?: integercredit_cents_limit?: integer
falcon_get_cases: Fetches full case records by idids: array
falcon_search_workflow_definitions: Finds Fusion SOAR workflow definitionsfilter?: stringlimit?: integeroffset?: integersort?: string
falcon_get_workflow_execution_results: Reads the results of a Fusion SOAR workflow runids: arrayskip_fields?: array
falcon_search_images_vulnerabilities: Finds vulnerabilities in container imagesfilter?: stringlimit?: integeroffset?: integersort?: string
falcon_search_recon_exposed_data_records: Finds exposed data records such as leaked credentialsfilter?: stringq?: stringlimit?: integeroffset?: integersort?: string
falcon_preview_recon_rule: Estimates how many alerts a planned Recon rule would raisetopic: enumfilter: stringlookback_days?: enum
falcon_get_zta_assessments: Fetches Zero Trust Assessment details for given hostsids: array
falcon_get_ioa_rule_types: Lists the rule types Custom IOA supportslimit?: integeroffset?: string
falcon_search_rtr_sessions: Finds Real Time Response sessionsfilter?: stringlimit?: integeroffset?: integersort?: string
falcon_search_host_group_members: Lists the hosts in a host groupid: stringfilter?: stringlimit?: integeroffset?: integersort?: string
falcon_search_managed_assets: Searches Discover's inventory of hosts that run a sensorfilter?: stringlimit?: integeroffset?: integersort?: string
falcon_search_cloud_insights: Searches cloud insights about assetsfilter?: stringlimit?: integerafter?: stringsort?: string
falcon_search_cspm_suppression_rules: Finds rules that suppress cloud findingslimit?: integeroffset?: integer
falcon_search_workflow_executions: Finds Fusion SOAR workflow runsfilter?: stringlimit?: integeroffset?: integersort?: string
falcon_search_correlation_rules: Finds NG-SIEM correlation rulesfilter?: stringlimit?: integeroffset?: integersort?: string
falcon_search_ioa_rule_groups: Finds Custom IOA rule groupsfilter?: stringlimit?: integeroffset?: stringsort?: stringq?: string
falcon_get_certificate_details: Reads signing certificate details used for certificate exclusionssha256: string
falcon_search_rtr_audit_sessions: Audits past Real Time Response sessionsfilter?: stringlimit?: integeroffset?: integersort?: stringwith_command_info?: boolean
falcon_check_rtr_command_status: Fetches the result of a running RTR commandcloud_request_id: stringsequence_id?: integer
falcon_search_scheduled_reports: Finds scheduled reportsfilter?: stringlimit?: integeroffset?: integersort?: stringq?: string
falcon_download_report_execution: Downloads a finished report fileid: string
falcon_search_sensor_usage: Reads sensor usage figuresfilter?: string
falcon_search_agentworks_agents: Lists AgentWorks agentsfilter?: stringlimit?: integeroffset?: integersort?: string
falcon_search_cloud_groups: Finds cloud groupsfilter?: stringlimit?: integeroffset?: integersort?: string

Popularity

75 popularity score, on our list (the bar is 36)

★ 277 ↓ 47k/mo

GitHub stars	277	29.3 points
Stars in 30 days	+11	5.4 points
PyPI downloads, last month	47,475	32.6 points
Official server	Yes	8 points

Measured 2026-11-07. How the score works.

Where it is published

Code	crowdstrike/falcon-mcp ★ 277
PyPI	falcon-mcp 0.20.2, 2026-11-03, the one the command runs
Container	`quay.io/crowdstrike/falcon-mcp`

What it can reach

Runs	On your machine
Reaches	The internet, Your account at a service, Cloud resources
Changes things	Yes: it can write, send, create or delete
Sign-in	An API key or token
Licence	MIT (GitHub)
Last code change	2026-11-03

Runs on your machine and calls the CrowdStrike Falcon API in your cloud region with an API client ID and secret. What it can do is bounded by that client's scopes. Many tools write: they update detections, create and delete policies, exclusions, IOCs, host groups, firewall and IOA rules, change Data Security objects, release or delete quarantined files, start Fusion SOAR workflows, invoke AgentWorks agents and open RTR sessions that run read-only commands on managed endpoints. --read-only registers only tools that change nothing. Default transport is stdio. HTTP transports bind 127.0.0.1 by default and have no authentication unless --api-key is given, so binding 0.0.0.0 without it lets anyone on the network use your credentials. Intel and detection content goes to the model.

Over time

GitHub stars 277 +11 (+4 %)

278266

10 Oct 20267 Nov 2026

PyPI downloads a month 47k +34k (+260 %)

51k13k

12 May 20267 Nov 2026

Before the site measured it, read from pypistats' daily download counts.

Popularity score 75 +14 (+22 %)

7662

10 Oct 20267 Nov 2026

What is rising across the directory

Sources

Page checked 2026-11-07.

Badge for your README

Shows this server's rank in its category, and stars for a server that runs on your machine. It updates every hour.

MarkdownREADME.md

[![CrowdStrike Falcon MCP Server on EveryMCPServer](https://everymcpserver.com/badge/crowdstrike-falcon-mcp-server.svg)](https://everymcpserver.com/servers/crowdstrike-falcon-mcp-server)

Connect your client

Add in one click

Or add it by command or config

Add in one click

Or add it by command or config

Settings 12

What it does

What it needs

Limits

Who it suits

Tools 60 of 170

Similar servers

Kubernetes MCP Server

GKE MCP Server

Argo CD MCP Server

GitGuardian MCP Server

Coolify MCP Server

Render MCP Server