Home › Other › CrowdStrike Falcon MCP Server

CrowdStrike Falcon MCP Server

Connects AI agents with CrowdStrike Falcon for security analysis and automation.

Python

★ 257 stars Last pushed 2026-09-17 License: MIT

View repository →

Connect

Review any command before running it. Package names and URLs come from the server's own registry entry.

Package (pypi 0.19.0)

uvx falcon-mcp

Or add to your MCP client config:

{
  "mcpServers": {
    "falcon-mcp": {
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<YOUR_VALUE>",
        "FALCON_CLIENT_SECRET": "<YOUR_VALUE>",
        "FALCON_BASE_URL": "<YOUR_VALUE>",
        "FALCON_MEMBER_CID": "<YOUR_VALUE>",
        "FALCON_MCP_MODULES": "<YOUR_VALUE>",
        "FALCON_MCP_TRANSPORT": "<YOUR_VALUE>",
        "FALCON_MCP_DEBUG": "<YOUR_VALUE>",
        "FALCON_MCP_HOST": "<YOUR_VALUE>",
        "FALCON_MCP_PORT": "<YOUR_VALUE>",
        "FALCON_MCP_USER_AGENT_COMMENT": "<YOUR_VALUE>",
        "FALCON_MCP_STATELESS_HTTP": "<YOUR_VALUE>",
        "FALCON_MCP_API_KEY": "<YOUR_VALUE>"
      }
    }
  }
}

FALCON_CLIENT_ID required secret — CrowdStrike API client ID
FALCON_CLIENT_SECRET required secret — CrowdStrike API client secret
FALCON_BASE_URL — CrowdStrike API region URL
FALCON_MEMBER_CID — Child CID for Flight Control (MSSP) support
FALCON_MCP_MODULES — Comma-separated list of modules to enable
FALCON_MCP_TRANSPORT — Transport protocol to use
FALCON_MCP_DEBUG — Enable debug logging
FALCON_MCP_HOST — Host to bind to for HTTP transports
FALCON_MCP_PORT — Port to listen on for HTTP transports
FALCON_MCP_USER_AGENT_COMMENT — Additional information to include in the User-Agent comment section
FALCON_MCP_STATELESS_HTTP — Enable stateless HTTP mode for scalable deployments
FALCON_MCP_API_KEY secret — API key for HTTP transport authentication (x-api-key header)