Skip to contentCCrowdStrike Falcon MCP Server MCP Server
Connects AI agents with CrowdStrike Falcon for security analysis and automation.
45FairInstall
~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"crowdstrike-falcon-mcp": {
"command": "uvx",
"args": [
"falcon-mcp"
],
"env": {
"FALCON_CLIENT_ID": "YOUR_FALCON_CLIENT_ID",
"FALCON_CLIENT_SECRET": "YOUR_FALCON_CLIENT_SECRET",
"FALCON_BASE_URL": "https://api.crowdstrike.com",
"FALCON_MEMBER_CID": "",
"FALCON_MCP_MODULES": "",
"FALCON_MCP_TRANSPORT": "stdio",
"FALCON_MCP_DEBUG": "false",
"FALCON_MCP_HOST": "127.0.0.1",
"FALCON_MCP_PORT": "8000",
"FALCON_MCP_USER_AGENT_COMMENT": "",
"FALCON_MCP_STATELESS_HTTP": "false",
"FALCON_MCP_API_KEY": "YOUR_FALCON_MCP_API_KEY"
}
}
}
}
Related servers
XReal-time data-breach lookup and analytics for emails and domains from XposedOrNot.
Environment
| Name | Required | Notes |
|---|
| FALCON_CLIENT_ID | Yes | CrowdStrike API client ID Secret. |
| FALCON_CLIENT_SECRET | Yes | CrowdStrike API client secret Secret. |
| FALCON_BASE_URL | No | CrowdStrike API region URL |
| FALCON_MEMBER_CID | No | Child CID for Flight Control (MSSP) support |
| FALCON_MCP_MODULES | No | Comma-separated list of modules to enable |
| FALCON_MCP_TRANSPORT | No | Transport protocol to use |
| FALCON_MCP_DEBUG | No | Enable debug logging |
| FALCON_MCP_HOST | No | Host to bind to for HTTP transports |
| FALCON_MCP_PORT | No | Port to listen on for HTTP transports |
| FALCON_MCP_USER_AGENT_COMMENT | No | Additional information to include in the User-Agent comment section |
| FALCON_MCP_STATELESS_HTTP | No | Enable stateless HTTP mode for scalable deployments |
| FALCON_MCP_API_KEY | No | API key for HTTP transport authentication (x-api-key header) Secret. |
Tools show up when the registry metadata or the repository README lists them. GitHub enrichment fills this in when a token is configured.
About
Connect AI agents to CrowdStrike Falcon for automated security analysis and threat hunting
FAQ
- What is CrowdStrike Falcon MCP Server?
- Connects AI agents with CrowdStrike Falcon for security analysis and automation.
- How do I install CrowdStrike Falcon MCP Server?
- Pick a client above and copy the generated config. Cursor and VS Code also have a deep link when the server can run locally or remotely.
- Is CrowdStrike Falcon MCP Server official?
- No. Registry-listed is not the same as vendor-official. Read the methodology for the difference.
- How is the trust score calculated?
- This listing scores 45 (Fair). The formula is published on the methodology page.
Reviews
0 published · no average
Sign in to review this server.
Good
GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more.
NReact Native and Expo health check: upgrade blockers, store rules, crash risks, security findings
FFederated messaging with your fmsg hosting provider. Connect with OAuth or an API key.
SDeterministic security scan of MCP servers, agent skills and npm/PyPI packages. Runs locally.
MCompact MCP server for SAP ABAP ADT over HTTP, RFC or SNC: one tool per operation, object in args