falcon-mcp is a Model Context Protocol (MCP) server that connects AI agents with the CrowdStrike Falcon platform, powering intelligent security analysis in your agentic workflows. It delivers programmatic access to essential security capabilities—including detections, incidents, and behaviors—establishing the foundation for advanced security operations and automation.

• API Credentials & Required Scopes
  • Setting Up CrowdStrike API Credentials
  • Required API Scopes by Module
• Available Modules, Tools & Resources
  • Core Functionality (Built into Server)
  • Detections Module
  • Incidents Module
  • Intel Module
  • Hosts Module
  • Spotlight Module
  • Cloud Security Module
  • Identity Protection Module
• Installation & Setup
  • Prerequisites
  • Environment Configuration
  • Running
• Usage
  • Command Line
  • Module Configuration
  • Additional Command Line Options
  • As a Library
  • Running Examples
• Container Usage
  • Using Pre-built Image (Recommended)
  • Building Locally (Development)
• Editor/Assitant Integration
• Additional Deployment Options
  • Amazon Bedrock AgentCore
• Contributing
  • Getting Started for Contributors
  • Running Tests
  • Developer Documentation
• License
• Support

Before using the Falcon MCP Server, you need to create API credentials in your CrowdStrike console:

1. Log into your CrowdStrike console
2. Navigate to Support > API Clients and Keys
3. Click "Add new API client"
4. Configure your API client:
   • Client Name: Choose a descriptive name (e.g., "Falcon MCP Server")
   • Description: Optional description for your records
   • API Scopes: Select the scopes based on which modules you plan to use (see below)

The Falcon MCP Server supports different modules, each requiring specific API scopes:

About Tools & Resources: This server provides both tools (actions you can perform) and resources (documentation and context). Tools execute operations like searching for detections or analyzing threats, while resources provide comprehensive documentation like FQL query guides that AI assistants can reference for context without requiring tool calls.

API Scopes: None required beyond basic API access

The server provides core tools for interacting with the Falcon API:

• falcon_check_connectivity: Check connectivity to the Falcon API
• falcon_get_available_modules: Get information about available modules

API Scopes Required: Alerts:read

Provides tools for accessing and analyzing CrowdStrike Falcon detections:

• falcon_search_detections: Find and analyze detections to understand malicious activity in your environment
• falcon_get_detection_details: Get comprehensive detection details for specific detection IDs to understand security threats

Resources:

• falcon://detections/search/fql-guide: Comprehensive FQL documentation and examples for detection searches

Use Cases: Threat hunting, security analysis, incident response, malware investigation

API Scopes Required: Incidents:read

Provides tools for accessing and analyzing CrowdStrike Falcon incidents:

• falcon_show_crowd_score: View calculated CrowdScores and security posture metrics for your environment
• falcon_search_incidents: Find and analyze security incidents to understand coordinated activity in your environment
• falcon_get_incident_details: Get comprehensive incident details to understand attack patterns and coordinated activities
• falcon_search_behaviors: Find and analyze behaviors to understand suspicious activity in your environment
• falcon_get_behavior_details: Get detailed behavior information to understand attack techniques and tactics

Resources:

• falcon://incidents/crowd-score/fql-guide: Comprehensive FQL documentation for CrowdScore queries
• falcon://incidents/search/fql-guide: Comprehensive FQL documentation and examples for incident searches
• falcon://incidents/behaviors/fql-guide: Comprehensive FQL documentation and examples for behavior searches

Use Cases: Incident management, threat assessment, attack pattern analysis, security posture monitoring

API Scopes Required:

• Actors (Falcon Intelligence):read
• Indicators (Falcon Intelligence):read
• Reports (Falcon Intelligence):read

Provides tools for accessing and analyzing CrowdStrike Intelligence:

• falcon_search_actors: Research threat actors and adversary groups tracked by CrowdStrike intelligence
• falcon_search_indicators: Search for threat indicators and indicators of compromise (IOCs) from CrowdStrike intelligence
• falcon_search_reports: Access CrowdStrike intelligence publications and threat reports

Resources:

• falcon://intel/actors/fql-guide: Comprehensive FQL documentation and examples for threat actor searches
• falcon://intel/indicators/fql-guide: Comprehensive FQL documentation and examples for indicator searches
• falcon://intel/reports/fql-guide: Comprehensive FQL documentation and examples for intelligence report searches

Use Cases: Threat intelligence research, adversary tracking, IOC analysis, threat landscape assessment

API Scopes Required: Hosts:read

Provides tools for accessing and managing CrowdStrike Falcon hosts/devices:

• falcon_search_hosts: Search for hosts in your CrowdStrike environment
• falcon_get_host_details: Retrieve detailed information for specified host device IDs

Resources:

• falcon://hosts/search/fql-guide: Comprehensive FQL documentation and examples for host searches

Use Cases: Asset management, device inventory, host monitoring, compliance reporting

API Scopes Required: Vulnerabilities:read

Provides tools for accessing and managing CrowdStrike Spotlight vulnerabilities:

• falcon_search_vulnerabilities: Search for vulnerabilities in your CrowdStrike environment

Resources:

• falcon://spotlight/vulnerabilities/fql-guide: Comprehensive FQL documentation and examples for vulnerability searches

Use Cases: Vulnerability management, security assessments, compliance reporting, risk analysis, patch prioritization

API Scopes Required:

• Falcon Container Image:read

Provides tools for accessing and analyzing CrowdStrike Cloud Security resources:

• falcon_search_kubernetes_containers: Search for containers from CrowdStrike Kubernetes & Containers inventory
• falcon_count_kubernetes_containers: Count for containers by filter criteria from CrowdStrike Kubernetes & Containers inventory
• falcon_search_images_vulnerabilities: Search for images vulnerabilities from CrowdStrike Image Assessments

Resources:

• falcon://cloud/kubernetes-containers/fql-guide: Comprehensive FQL documentation and examples for kubernetes containers searches
• falcon://cloud/images-vulnerabilities/fql-guide: Comprehensive FQL documentation and examples for images vulnerabilities searches

Use Cases: Manage kubernetes containers inventory, container images vulnerabilities analysis

API Scopes Required: Identity Protection GraphQL:write

Provides tools for accessing and managing CrowdStrike Falcon Identity Protection capabilities:

• idp_investigate_entity: Entity investigation tool for analyzing users, endpoints, and other entities with support for timeline analysis, relationship mapping, and risk assessment

Use Cases: Entity investigation, identity protection analysis, user behavior analysis, endpoint security assessment, relationship mapping, risk assessment

• Python 3.11 or higher
• uv
• CrowdStrike Falcon API credentials (see above)

Copy the example environment file and configure your credentials:

cp .env.example .env

Then edit .env with your CrowdStrike API credentials:

Required Configuration:

• FALCON_CLIENT_ID: Your CrowdStrike API client ID
• FALCON_CLIENT_SECRET: Your CrowdStrike API client secret
• FALCON_BASE_URL: Your CrowdStrike API region URL (see options in .env.example)

Optional Configuration:

• FALCON_MCP_MODULES: Comma-separated list of modules to enable (default: all modules)
• FALCON_MCP_TRANSPORT: Transport method - stdio, sse, or streamable-http (default: stdio)
• FALCON_MCP_DEBUG: Enable debug logging - true or false (default: false)
• FALCON_MCP_HOST: Host for HTTP transports (default: 127.0.0.1)
• FALCON_MCP_PORT: Port for HTTP transports (default: 8000)

Alternatively, you can set these as environment variables instead of using a .env file.

Important: Ensure your API client has the necessary scopes for the modules you plan to use. You can always update scopes later in the CrowdStrike console.

uvx falcon-mcp

Run the server with default settings (stdio transport):

falcon-mcp

Run with SSE transport:

falcon-mcp --transport sse

Run with streamable-http transport:

falcon-mcp --transport streamable-http

Run with streamable-http transport on custom port:

falcon-mcp --transport streamable-http --host 0.0.0.0 --port 8080

The Falcon MCP Server supports multiple ways to specify which modules to enable:

Specify modules using comma-separated lists:

# Enable specific modules
falcon-mcp --modules detections,incidents,intel,spotlight,idp
# Enable only one module
falcon-mcp --modules detections

Set the FALCON_MCP_MODULES environment variable:

# Export environment variable
export FALCON_MCP_MODULES=detections,incidents,intel,spotlight,idp
falcon-mcp
# Or set inline
FALCON_MCP_MODULES=detections,incidents,intel,spotlight,idp falcon-mcp

If no modules are specified via command line or environment variable, all available modules are enabled by default.

Module Priority Order:

1. Command line --modules argument (overrides all)
2. FALCON_MCP_MODULES environment variable (fallback)
3. All modules (default when none specified)

For all available options:

falcon-mcp --help

from falcon_mcp.server import FalconMCPServer
# Create and run the server
server = FalconMCPServer(
    base_url="https://api.us-2.crowdstrike.com",  # Optional, defaults to env var
    debug=True,  # Optional, enable debug logging
    enabled_modules=["detections", "incidents", "spotlight", "idp"]  # Optional, defaults to all modules
)
# Run with stdio transport (default)
server.run()
# Or run with SSE transport
server.run("sse")
# Or run with streamable-http transport
server.run("streamable-http")
# Or run with streamable-http transport on custom host/port
server.run("streamable-http", host="0.0.0.0", port=8080)

# Run with stdio transport
python examples/basic_usage.py
# Run with SSE transport
python examples/sse_usage.py
# Run with streamable-http transport
python examples/streamable_http_usage.py

The Falcon MCP Server is available as a pre-built container image for easy deployment:

# Pull the latest pre-built image
docker pull quay.io/crowdstrike/falcon-mcp:latest
# Run with .env file (recommended)
docker run --rm --env-file /path/to/.env quay.io/crowdstrike/falcon-mcp:latest
# Run with .env file and SSE transport
docker run --rm -p 8000:8000 --env-file /path/to/.env \
  quay.io/crowdstrike/falcon-mcp:latest --transport sse --host 0.0.0.0
# Run with .env file and streamable-http transport
docker run --rm -p 8000:8000 --env-file /path/to/.env \
  quay.io/crowdstrike/falcon-mcp:latest --transport streamable-http --host 0.0.0.0
# Run with .env file and custom port
docker run --rm -p 8080:8080 --env-file /path/to/.env \
  quay.io/crowdstrike/falcon-mcp:latest --transport streamable-http --host 0.0.0.0 --port 8080
# Run with .env file and specific modules
docker run --rm --env-file /path/to/.env \
  quay.io/crowdstrike/falcon-mcp:latest --modules detections,incidents,spotlight,idp
# Use a specific version instead of latest
docker run --rm --env-file /path/to/.env \
  quay.io/crowdstrike/falcon-mcp:1.2.3
# Alternative: Individual environment variables
docker run --rm -e FALCON_CLIENT_ID=your_client_id -e FALCON_CLIENT_SECRET=your_secret \
  quay.io/crowdstrike/falcon-mcp:latest

For development or customization purposes, you can build the image locally:

# Build the Docker image
docker build -t falcon-mcp .
# Run the locally built image
docker run --rm -e FALCON_CLIENT_ID=your_client_id -e FALCON_CLIENT_SECRET=your_secret falcon-mcp

Note: When using HTTP transports in Docker, always set --host 0.0.0.0 to allow external connections to the container.

You can integrate the Falcon MCP server with your editor or AI assistant in a few ways:

{
  "servers": [
    {
      "name": "falcon-stdio",
      "transport": {
        "type": "stdio",
        "command": "python -m falcon_mcp.server"
      }
    },
    {
      "name": "falcon-stdio-docker",
      "transport": {
        "type": "stdio",
        "command": "docker",
        "args": [
          "run",
          "-i",
          "--rm",
          "--env-file",
          "/full/path/to/.env",
          "quay.io/crowdstrike/falcon-mcp:latest"
        ]
      }
    },
    {
      "name": "falcon-sse",
      "transport": {
        "type": "sse",
        "url": "https://127.0.0.1:8000/sse"
      }
    },
    {
      "name": "falcon-streamable-http",
      "transport": {
        "type": "streamable-http",
        "url": "https://127.0.0.1:8000/mcp"
      }
    }
  ]
}

To deploy the MCP Server as a tool in Amazon Bedrock AgentCore, please refer to the following document.

1. Clone the repository:

   git clone https://github.com/CrowdStrike/falcon-mcp.git
   cd falcon-mcp

2. Install in development mode:

   # Install dependencies and create .venv
   uv sync
   # Activate the venv
   source .venv/bin/activate
   # Install development dependencies
   uv pip install -e ".[dev]"

# Run all tests
pytest
# Run end-to-end tests
pytest --run-e2e tests/e2e/
# Run end-to-end tests with verbose output (note: -s is required to see output)
pytest --run-e2e -v -s tests/e2e/

Note: The -s flag is required to see detailed output from E2E tests.

• Module Development Guide: Instructions for implementing new modules
• Resource Development Guide: Instructions for implementing resources
• End-to-End Testing Guide: Guide for running and understanding E2E tests

This project is licensed under the MIT License - see the LICENSE file for details.

This is a community-driven, open source project. While it is not an official CrowdStroke product, it is actively maintained by CrowdStrike and supported in collaboration with the open source developer community.

For more information, please see our SUPPORT file.