CrowdStrike Falcon MCP Server

io.github.CrowdStrike/falcon-mcp · v0.20.2

Connects AI agents with CrowdStrike Falcon for security analysis and automation.

Source code Set it up

Connect Runs on your machine

Terminal

claude mcp add falcon-mcp -e FALCON_CLIENT_ID=<FALCON_CLIENT_ID> -e FALCON_CLIENT_SECRET=<FALCON_CLIENT_SECRET> -e FALCON_BASE_URL=<FALCON_BASE_URL> -e FALCON_MEMBER_CID=<FALCON_MEMBER_CID> -e FALCON_MCP_MODULES=<FALCON_MCP_MODULES> -e FALCON_MCP_TRANSPORT=<FALCON_MCP_TRANSPORT> -e FALCON_MCP_DEBUG=<FALCON_MCP_DEBUG> -e FALCON_MCP_HOST=<FALCON_MCP_HOST> -e FALCON_MCP_PORT=<FALCON_MCP_PORT> -e FALCON_MCP_USER_AGENT_COMMENT=<FALCON_MCP_USER_AGENT_COMMENT> -e FALCON_MCP_STATELESS_HTTP=<FALCON_MCP_STATELESS_HTTP> -e FALCON_MCP_API_KEY=<FALCON_MCP_API_KEY> -- uvx falcon-mcp==0.20.2

claude_desktop_config.json

{
  "mcpServers": {
    "falcon-mcp": {
      "command": "uvx",
      "args": [
        "falcon-mcp==0.20.2"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<FALCON_CLIENT_SECRET>",
        "FALCON_BASE_URL": "<FALCON_BASE_URL>",
        "FALCON_MEMBER_CID": "<FALCON_MEMBER_CID>",
        "FALCON_MCP_MODULES": "<FALCON_MCP_MODULES>",
        "FALCON_MCP_TRANSPORT": "<FALCON_MCP_TRANSPORT>",
        "FALCON_MCP_DEBUG": "<FALCON_MCP_DEBUG>",
        "FALCON_MCP_HOST": "<FALCON_MCP_HOST>",
        "FALCON_MCP_PORT": "<FALCON_MCP_PORT>",
        "FALCON_MCP_USER_AGENT_COMMENT": "<FALCON_MCP_USER_AGENT_COMMENT>",
        "FALCON_MCP_STATELESS_HTTP": "<FALCON_MCP_STATELESS_HTTP>",
        "FALCON_MCP_API_KEY": "<FALCON_MCP_API_KEY>"
      }
    }
  }
}

~/.cursor/mcp.json

{
  "mcpServers": {
    "falcon-mcp": {
      "command": "uvx",
      "args": [
        "falcon-mcp==0.20.2"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<FALCON_CLIENT_SECRET>",
        "FALCON_BASE_URL": "<FALCON_BASE_URL>",
        "FALCON_MEMBER_CID": "<FALCON_MEMBER_CID>",
        "FALCON_MCP_MODULES": "<FALCON_MCP_MODULES>",
        "FALCON_MCP_TRANSPORT": "<FALCON_MCP_TRANSPORT>",
        "FALCON_MCP_DEBUG": "<FALCON_MCP_DEBUG>",
        "FALCON_MCP_HOST": "<FALCON_MCP_HOST>",
        "FALCON_MCP_PORT": "<FALCON_MCP_PORT>",
        "FALCON_MCP_USER_AGENT_COMMENT": "<FALCON_MCP_USER_AGENT_COMMENT>",
        "FALCON_MCP_STATELESS_HTTP": "<FALCON_MCP_STATELESS_HTTP>",
        "FALCON_MCP_API_KEY": "<FALCON_MCP_API_KEY>"
      }
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "falcon-mcp": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "falcon-mcp==0.20.2"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<FALCON_CLIENT_SECRET>",
        "FALCON_BASE_URL": "<FALCON_BASE_URL>",
        "FALCON_MEMBER_CID": "<FALCON_MEMBER_CID>",
        "FALCON_MCP_MODULES": "<FALCON_MCP_MODULES>",
        "FALCON_MCP_TRANSPORT": "<FALCON_MCP_TRANSPORT>",
        "FALCON_MCP_DEBUG": "<FALCON_MCP_DEBUG>",
        "FALCON_MCP_HOST": "<FALCON_MCP_HOST>",
        "FALCON_MCP_PORT": "<FALCON_MCP_PORT>",
        "FALCON_MCP_USER_AGENT_COMMENT": "<FALCON_MCP_USER_AGENT_COMMENT>",
        "FALCON_MCP_STATELESS_HTTP": "<FALCON_MCP_STATELESS_HTTP>",
        "FALCON_MCP_API_KEY": "<FALCON_MCP_API_KEY>"
      }
    }
  }
}

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools

This server runs locally, so its tools are listed by your MCP client once it starts.

Environment variables

Name	Description
`FALCON_CLIENT_ID` Required, secret	CrowdStrike API client ID
`FALCON_CLIENT_SECRET` Required, secret	CrowdStrike API client secret
`FALCON_BASE_URL` Optional	CrowdStrike API region URL
`FALCON_MEMBER_CID` Optional	Child CID for Flight Control (MSSP) support
`FALCON_MCP_MODULES` Optional	Comma-separated list of modules to enable
`FALCON_MCP_TRANSPORT` Optional	Transport protocol to use
`FALCON_MCP_DEBUG` Optional	Enable debug logging
`FALCON_MCP_HOST` Optional	Host to bind to for HTTP transports
`FALCON_MCP_PORT` Optional	Port to listen on for HTTP transports
`FALCON_MCP_USER_AGENT_COMMENT` Optional	Additional information to include in the User-Agent comment section
`FALCON_MCP_STATELESS_HTTP` Optional	Enable stateless HTTP mode for scalable deployments
`FALCON_MCP_API_KEY` Optional, secret	API key for HTTP transport authentication (x-api-key header)

Details

Package	`[email protected]` (PYPI, stdio)
First published	3 Nov 2026
Last updated	3 Nov 2026
Registry name	`io.github.CrowdStrike/falcon-mcp`

More ai and media servers See all

Live status

Local install

Installed and run on your own machine, so there is no public endpoint to check.

Pair it with live search

Agents that use CrowdStrike Falcon MCP Server often also need current facts. NestDaddy MCP gives your AI today's internet: web search, real-time breaking news and full page reading in one connector.

See NestDaddy MCP

For maintainers

[![NestDaddy MCP](https://nestdaddy.com/mcp/servers/io-github-crowdstrike-falcon-mcp/badge.svg)](https://nestdaddy.com/mcp/servers/io-github-crowdstrike-falcon-mcp)

Add the badge to your README. It turns green while your server passes our daily check. Listing details come from the official MCP registry; update them there.

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.