CrowdStrike Falcon MCP

Name: CrowdStrike Falcon MCP
Author: CrowdStrike

CrowdStrikeOfficial

Get started Repository

Connects agents to CrowdStrike Falcon for detections, incidents, hosts, vulnerabilities and threat intelligence.

Setup

Choose your client, copy the config, then fill in any required environment variables.

Add to Cursor Add to VS Code

claude mcp add crowdstrike-falcon --env FALCON_CLIENT_ID='<FALCON_CLIENT_ID>' --env FALCON_CLIENT_SECRET='<FALCON_CLIENT_SECRET>' --env FALCON_MCP_API_KEY='<FALCON_MCP_API_KEY>' -- uvx falcon-mcp

~/.codex/config.toml

[mcp_servers.crowdstrike-falcon]
command = "uvx"
args = ["falcon-mcp"]
env = { FALCON_CLIENT_ID = "<FALCON_CLIENT_ID>", FALCON_CLIENT_SECRET = "<FALCON_CLIENT_SECRET>", FALCON_MCP_API_KEY = "<FALCON_MCP_API_KEY>" }

# codex mcp add crowdstrike-falcon --env FALCON_CLIENT_ID='<FALCON_CLIENT_ID>' --env FALCON_CLIENT_SECRET='<FALCON_CLIENT_SECRET>' --env FALCON_MCP_API_KEY='<FALCON_MCP_API_KEY>' -- uvx falcon-mcp

~/.cursor/mcp.json

{
  "mcpServers": {
    "crowdstrike-falcon": {
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<FALCON_CLIENT_SECRET>",
        "FALCON_MCP_API_KEY": "<FALCON_MCP_API_KEY>"
      }
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "crowdstrike-falcon": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<FALCON_CLIENT_SECRET>",
        "FALCON_MCP_API_KEY": "<FALCON_MCP_API_KEY>"
      }
    }
  }
}

~/.gemini/settings.json

{
  "mcpServers": {
    "crowdstrike-falcon": {
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<FALCON_CLIENT_SECRET>",
        "FALCON_MCP_API_KEY": "<FALCON_MCP_API_KEY>"
      }
    }
  }
}

claude_desktop_config.json

{
  "mcpServers": {
    "crowdstrike-falcon": {
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<FALCON_CLIENT_SECRET>",
        "FALCON_MCP_API_KEY": "<FALCON_MCP_API_KEY>"
      }
    }
  }
}

.trae/mcp.json

{
  "mcpServers": {
    "crowdstrike-falcon": {
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<FALCON_CLIENT_SECRET>",
        "FALCON_MCP_API_KEY": "<FALCON_MCP_API_KEY>"
      }
    }
  }
}

Environment variables

FALCON_CLIENT_ID
FALCON_CLIENT_SECRET
FALCON_MCP_API_KEY

Replace the placeholders with your own credentials and keep them out of version control.

Setup

Environment variables

Related