CrowdStrike Falcon MCP Server

falcon-mcp

falcon-mcp is a Model Context Protocol (MCP) server that connects AI agents with the CrowdStrike Falcon platform, powering intelligent security analysis in your agentic workflows. It delivers programmatic access to essential security capabilities—including detections, threat intelligence, and host management—establishing the foundation for advanced security operations and automation.

[!IMPORTANT]

falcon-mcp is now in maintenance mode. Development continues in CrowdStrike MCP, CrowdStrike's hosted MCP server, and we recommend moving to it. falcon-mcp stays supported and will keep getting security fixes, but new features will only ship in CrowdStrike MCP. See Moving to CrowdStrike MCP for what this means for you.

Documentation

Full docs are available at [developer.crowdstrike.com/falcon-mcp](https://developer.crowdstrike.com/falcon-mcp/).

Moving to CrowdStrike MCP

falcon-mcp started as an open source project to work out how AI agents should use Falcon. A lot of what we built here, including fixes and ideas from your issues and pull requests, carries forward into CrowdStrike MCP. CrowdStrike MCP is a CrowdStrike product rather than an open source project, so new development won't happen in this repository. Thanks to everyone who filed issues and sent pull requests.

For most teams, CrowdStrike MCP is the better choice now:

• It runs inside the Falcon platform, so there's nothing to install, host, or upgrade.
• Most tools keep the same falcon_* names, so prompts and agent instructions written for falcon-mcp carry over.
• Tool access follows the Falcon roles and permissions you already manage, and activity is recorded in the Falcon audit log.
• New tools and improvements ship there.

What happens to falcon-mcp:

• The same CrowdStrike team that builds CrowdStrike MCP maintains it, and it's supported through the same channels.
• Existing installs keep working. Future releases carry security and dependency fixes only.
• We're no longer accepting feature requests or feature pull requests.
• CrowdStrike MCP is available in US-1, US-2, and EU-1. If your tenant is in another cloud, or you depend on a tool that only falcon-mcp has (see Differences from CrowdStrike MCP), keep using falcon-mcp for now.
• We'll announce an end-of-life date here before the repository is archived.

Modules

See the Module Overview for required API scopes, available tools, and FQL resources.

[!NOTE]

The Guardian module reads the /aidr API, whose route and parameter surface is not

yet uniform across Falcon deployments. Some tools return HTTP 400 or 404 where an

older surface is live. See the Guardian module docs for the details.

Quick Start

Install

Using uv (recommended)

uv tool install falcon-mcp

Using pip

pip install falcon-mcp

Configure

Set the required environment variables (or use a .env file — see the Configuration Guide):

export FALCON_CLIENT_ID="your-client-id"

export FALCON_CLIENT_SECRET="your-client-secret" export FALCON_BASE_URL="https://api.crowdstrike.com"

Run

falcon-mcp

See the Getting Started guide for full installation and configuration details.

Editor Integration

Using uvx (recommended)

{

"mcpServers": { "falcon-mcp": { "command": "uvx", "args": [ "--env-file", "/path/to/.env", "falcon-mcp" ] } } }

With Module Selection

{

"mcpServers": { "falcon-mcp": { "command": "uvx", "args": [ "--env-file", "/path/to/.env", "falcon-mcp", "--modules", "detections,hosts,intel" ] } } }

Docker

{

"mcpServers": { "falcon-mcp-docker": { "command": "docker", "args": [ "run", "-i", "--rm", "--env-file", "/full/path/to/.env", "quay.io/crowdstrike/falcon-mcp:latest" ] } } }

See the Usage guide for all command line options, module configuration, and library usage.

Container Usage

# Pull the latest image

docker pull quay.io/crowdstrike/falcon-mcp:latest

Run with .env file (stdio transport)

docker run -i --rm --env-file /path/to/.env quay.io/crowdstrike/falcon-mcp:latest

Run with streamable-http transport (add --api-key when the port is reachable beyond localhost)

docker run --rm -p 8000:8000 --env-file /path/to/.env \ quay.io/crowdstrike/falcon-mcp:latest \ --transport streamable-http --host 0.0.0.0 --api-key your-secret-key

[!CAUTION]

HTTP transports have no authentication by default. Binding to a non-loopback address (--host 0.0.0.0)

exposes an unauthenticated server that anyone who can reach the port can drive with your CrowdStrike

credentials. Keep the default loopback bind for local use and set --api-key whenever you bind wider.

Managed runtimes such as AWS Bedrock AgentCore and Google Cloud Run sit behind their own network

security layer, so this does not apply to them. See the

Configuration guide.

See the Docker Deployment guide for building locally, custom ports, and advanced configurations.

Dynamic Mode

Running many modules at once inflates the context window every AI client must hold. Dynamic mode replaces the full tool surf