Falcon MCP

falcon-mcp-extended

[!NOTE]

This is a community extension of CrowdStrike's official [falcon-mcp](https://github.com/CrowdStrike/falcon-mcp) server (MIT licensed). It adds 106 auto-generated API wrapper modules (~904 additional tools) on top of the official curated tool set, for near-complete CrowdStrike Falcon API coverage. This project is not affiliated with, maintained by, or endorsed by CrowdStrike. If you only need the curated SOC workflows, use the official server; use this project when you need API surface the official server doesn't expose yet.

For SOC analysts and security engineers: Stop tab-switching between CrowdStrike, your ticketing system, and your notes. Ask Claude to triage the alert, pull the process tree, check if the hash ran on other hosts, and draft the IR note — all in one conversation.

falcon-mcp-extended is a Model Context Protocol (MCP) server that gives AI agents — including Claude — direct, structured access to the CrowdStrike Falcon platform for intelligent security operations.

What It Does

This server bridges AI assistants and the CrowdStrike Falcon platform, enabling SOC analysts to ask natural-language questions and get answers backed by live Falcon data. It exposes Falcon's detection, investigation, response, and intelligence capabilities as MCP tools, so an AI agent can search detections, pivot through behaviors, contain hosts, and query threat intelligence — all from a single conversation. Designed for both interactive SOC workflows and automated security pipelines, it supports MSSP Flight Control so multi-tenant environments can be queried without switching consoles.

What This Adds Over the Official Server

The default mode exposes the curated layer (~392 tools), which covers every major SOC workflow with well-described, ergonomic tools. The full generated layer (total ~1,296 tools) can be enabled with FALCON_MCP_ENABLE_GENERATED=1 for complete API surface coverage — including Message Center, ODS scans, response/content/device-control policies, installation tokens, MalQuery, FalconX Sandbox, QuickScan Pro, sample uploads, FileVantage, Falcon Complete Dashboard, cloud registration (AWS/Azure/GCP/OCI), Kubernetes admission control, container images/alerts/detections, network scanning, NGSIEM administration, knowledge bases, and much more.

Features

• EDR Telemetry — Search detections, behaviors, and incidents; drill into process execution trees and command-line activity
• Real Time Response (RTR) — Initialize RTR sessions, run read-only triage commands (ps, netstat, filehash, reg query), and execute active responder and admin commands with configurable safety gates
• Threat Intelligence — Research threat actors, query CrowdStrike indicators, retrieve MITRE ATT&CK reports, and search intelligence reports
• Custom IOC Management — Search, create, and delete custom indicators of compromise; manage IOC watchlists
• Vulnerability Management (Spotlight) — Query CVE exposure by host, filter by severity or CVE ID, and surface vulnerability assessments
• Cloud Security — Kubernetes container visibility, container image vulnerabilities, CSPM asset inventory, and serverless function vulnerability scanning
• Identity Protection (IDP) — Entity investigation and identity-based threat analysis
• MSSP / Flight Control — List and target child CIDs; pass a per-tool member_cid to scope any query to a specific managed tenant
• Next-Gen SIEM (NGSIEM) — Execute CQL queries against the Falcon NGSIEM for log-based investigation
• Host Management — Query host inventory, login history, network address history, device groups, and online state
• Firewall & Custom IOA — Search and manage firewall rules and behavioral detection rule groups
• Incident Management — Correlate incidents across hosts, update status, and annotate with investigative notes
• Scheduled Reports — List, manage, and download Falcon scheduled report outputs
• Safety Gates — Read-only mode suppresses all mutating tools at registration time; a separate destructive policy controls host containment, RTR execution, and account-level deletes

Prerequisites

• Python 3.11 or later
• CrowdStrike Falcon API credentials (Client ID and Client Secret) with appropriate scopes for the modules you intend to use
• uv (recommended) or pip

Installation

[!IMPORTANT]

The correct package name is `falcon-mcp-extended`. Do not pip install falcon-mcp — that is CrowdStrike's official package, which does not include the extended module layer.

From PyPI (recommended)

pip install falcon-mcp-extended

Or with uv:

uv pip install falcon-mcp-extended

From source

git clone https://github.com/rijul170/falcon-mcp.git

cd falcon-mcp uv sync --all-extras uv run falcon-mcp

Via uvx directly from GitHub (no clone required)

uvx --from git+https://github.com/rijul170/falcon-mcp falcon-mcp

Via pip from GitHub

pip install git+https://github.com/rijul170/falcon-mcp

Configuration

All configuration is driven by environment variables (or a .env file in the working directory). CLI flags mirror every env var and take precedence when both are set.

Region base URLs:

Claude Code Integration

HTTP mode (streamable-http) is recommended for Claude Code and other AI development environments that support persistent server connections.

Step 1 — Start the server:

FALCON_CLIENT_ID=your-client-id \

FALCON_CLIENT_SECRET=your-client-secret \ FALCON_BASE_URL=https://api.crowdstrike.com \ FALCON_MCP_TRANSPORT=streamable-http \ uv run falcon-mcp

Step 2 — Add to `.claude/settings.json` (project) or `~/.claude/settings.json` (global):

{

"mcpServers": { "falcon-mcp": { "type": "http", "url": "http://localhost:8000/mcp" } } }

For API key-protected deployments, add the header:

{

"mcpServers": { "falcon-mcp": { "type": "http", "url": "http://localhost:8000/mcp", "headers": { "x-api-key": "your-api-key" } } } }

Claude Desktop Integration

Stdio mode works best for Claude Desktop. Credentials are passed directly in the MCP server configuration.

{

"mcpServers": { "falcon-mcp": { "command": "uvx", "args": ["--from", "git+https://github.com/rijul170/falcon-mcp", "falcon-mcp"], "env": { "FALCON_CLIENT_ID": "your-client-id", "FALCON_CLIENT_SECRET": "your-client-secret", "FALCON_BASE_URL": "https://api.crowdstrike.com" } } } }

To load credentials from a .env file instead of embedding them in the config:

{

"mcpServers": { "falcon-mcp": { "command": "uvx", "args": ["--env-file", "/path/to/.env", "--from", "git+https://github.com/rijul170/falcon-mcp", "falcon-mcp"] } } }

Docker

Build the image locally from the included Dockerfile:

git clone https://github.com/rijul170/falcon-mcp.git

cd falcon-mcp docker build -t falcon-mcp-extended .

Run with a .env file (stdio transport)

docker run -i --rm --env-file /path/to/.env falcon-mcp-extended

Run with streamable-http transport

docker run --rm -p 8000:8000 --env-file /path/to/.env \ falcon-mcp-extended --transport streamable-http --host 0.0.0.0

MSSP / Multi-Tenant Usage

The server has first-class support for CrowdStrike Flight Control environments.

Default tenant targeting: Set FALCON_MEMBER_CID to route all queries to a specific child CID without changing anything else:

export FALCON_MEMBER_CID="CHILD_CID_HERE"

Per-request tenant targeting: Every tool that accepts a member_cid parameter can override the default at call time. This lets an AI agent query multiple child tenants in a single session without restarting the server:

"Search for critical detections in tenant ABC123 and compare with tenant XYZ789."

Flight Control module: The flight_control module provides tools to enumerate all child accounts, list CID groups and user groups, query MSSP role assignments, and manage group membership.

MSSP API scopes: The parent CID must have Flight Control API scopes enabled. Child CID API keys are not required when querying through the parent.

Available Modules

| detections | Find and