CrowdStrike Falcon MCP Server
Connects AI agents with CrowdStrike Falcon for security analysis and automation.
Power your agent
Add this server
The publisher's own command. Not a PlugMCP endpoint.
Local command
uvx falcon-mcp==0.19.0
Credentials from the publisher
- FALCON_CLIENT_ID — CrowdStrike API client ID
- FALCON_CLIENT_SECRET — CrowdStrike API client secret
- FALCON_BASE_URL — CrowdStrike API region URL
- FALCON_MEMBER_CID — Child CID for Flight Control (MSSP) support
- FALCON_MCP_MODULES — Comma-separated list of modules to enable
- FALCON_MCP_TRANSPORT — Transport protocol to use
- FALCON_MCP_DEBUG — Enable debug logging
- FALCON_MCP_HOST — Host to bind to for HTTP transports
- FALCON_MCP_PORT — Port to listen on for HTTP transports
- FALCON_MCP_USER_AGENT_COMMENT — Additional information to include in the User-Agent comment section
- FALCON_MCP_STATELESS_HTTP — Enable stateless HTTP mode for scalable deployments
- FALCON_MCP_API_KEY — API key for HTTP transport authentication (x-api-key header)
Provider
Claude Code
FALCON_CLIENT_ID=<secret> FALCON_CLIENT_SECRET=<secret> FALCON_BASE_URL=<value> FALCON_MEMBER_CID=<value> FALCON_MCP_MODULES=<value> FALCON_MCP_TRANSPORT=<value> FALCON_MCP_DEBUG=<value> FALCON_MCP_HOST=<value> FALCON_MCP_PORT=<value> FALCON_MCP_USER_AGENT_COMMENT=<value> FALCON_MCP_STATELESS_HTTP=<value> FALCON_MCP_API_KEY=<secret> claude mcp add io.github.crowdstrike-falcon-mcp -- uvx falcon-mcp==0.19.0
Run in a terminal.
Claude Desktop
{
"mcpServers": {
"io.github.crowdstrike-falcon-mcp": {
"command": "uvx",
"args": [
"falcon-mcp==0.19.0"
],
"env": {
"FALCON_CLIENT_ID": "<secret>",
"FALCON_CLIENT_SECRET": "<secret>",
"FALCON_BASE_URL": "<value>",
"FALCON_MEMBER_CID": "<value>",
"FALCON_MCP_MODULES": "<value>",
"FALCON_MCP_TRANSPORT": "<value>",
"FALCON_MCP_DEBUG": "<value>",
"FALCON_MCP_HOST": "<value>",
"FALCON_MCP_PORT": "<value>",
"FALCON_MCP_USER_AGENT_COMMENT": "<value>",
"FALCON_MCP_STATELESS_HTTP": "<value>",
"FALCON_MCP_API_KEY": "<secret>"
}
}
}
}claude_desktop_config.json
Remote URL or a command on your machine? How the two installs differ
Run on PlugMCP
Host a copy with our keys and logs.
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
LaunchRelated MCP
View more- Firecrawl🔥 Official Firecrawl MCP Server - Adds powerful web scraping and search to Cursor, Claude and any other LLM clients.
- NNotionToken-auth Notion MCP: pages, databases, blocks, comments, files. Runs headless in CI and agents.
- Context7Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors
Related skills
View all- reaReverse engineer anything with agents, from app behavior down to native binaries.
- rea-changelog-updatePrepare or rewrite REA release changelogs and GitHub release notes from pinned Git history, with verified contributor thanks and Release Please synchronization.
- rea-tool-designDesign or change REA investigation tools, CLI/MCP contracts, provider capabilities, and Evidence semantics.
Connects AI agents with CrowdStrike Falcon for security analysis and automation.
README is not crawled yet. Open the repository
- How do I install CrowdStrike Falcon MCP Server?
- Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.
- Does CrowdStrike Falcon MCP Server need an API key?
- The publisher lists these environment variables: FALCON_CLIENT_ID, FALCON_CLIENT_SECRET, FALCON_BASE_URL, FALCON_MEMBER_CID, FALCON_MCP_MODULES, FALCON_MCP_TRANSPORT, FALCON_MCP_DEBUG, FALCON_MCP_HOST, FALCON_MCP_PORT, FALCON_MCP_USER_AGENT_COMMENT, FALCON_MCP_STATELESS_HTTP, FALCON_MCP_API_KEY.
- What transport does CrowdStrike Falcon MCP Server use?
- CrowdStrike Falcon MCP Server runs locally over stdio.
- When was CrowdStrike Falcon MCP Server last checked?
- Last checked 2026-10-16. Connects AI agents with CrowdStrike Falcon for security analysis and automation.
No tool list yet. Remote servers get one after the first health check.