CrowdStrike Falcon MCP Server

falcon-mcp is a Model Context Protocol (MCP) server that connects AI agents with the CrowdStrike Falcon platform, powering intelligent security analysis in your agentic workflows. It delivers programmatic access to essential security capabilities - including detections, threat intelligence, and host management - establishing the foundation for advanced security operations and automation.

People connecting security tools to Claude, Cursor, VS Code, or another MCP client. The project is written in Python.

VERIFIED ACTIVE

LAST COMMIT 2026-08-24 · ★ 239 · #3 OF 182 MAINTAINED SECURITY · VERIFIED 2026-08-25

MIT · Python servers · how we verify → /methodology

01 · Install CrowdStrike Falcon MCP Server

before you install - you'll need

Set FALCON_CLIENT_ID, FALCON_CLIENT_SECRET, FALCON_BASE_URL before connecting.

Claude Code

claude mcp add crowdstrike-falcon-mcp -- uvx falcon-mcp

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "crowdstrike-falcon-mcp": {
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license MIT - declared in the repository

pypi package falcon-mcp - check the name against the project README before installing (PyPI has no namespace ownership)

registry namespace io.github.CrowdStrike is GitHub-verified and matches the repo owner

03 · What CrowdStrike Falcon MCP Server can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

Latest releases

v0.17.0 · 2026-08-22

0.17.0 (2026-08-22) · modules/agentworks: add AgentWorks module for calling and observing Charlotte AI agents · modules/cases: add description_format to create/update case · modules/discover: add…

v0.16.1 · 2026-08-10

0.16.1 (2026-08-10) · modules/detections: chunk update_detections requests over 1000 ids · modules/exclusions: reject IOA regex zero-width assertions pre-flight · return FQL guide on filter errors for hosts, spotlight…

v0.16.0 · 2026-08-05

0.16.0 (2026-08-05) · rank and broaden tool search, and teach the server once via MCP instructions · modules/base: add shared aggregate-query foundation · modules/cases: add aggregate tools for case configuration and…

04 · Who maintains CrowdStrike Falcon MCP Server

CrowdStrike Falcon MCP Server is maintained by crowdstrike. It's the only MCP server we track from this author; the repo dates to Jun 2025.

05 · Facts

repository: github.com/crowdstrike/falcon-mcp
category: security - ranked #3 of 182 actively-maintained security servers as of 2026-08-25.
release cadence: 8 releases in the last 90 days (latest 2026-08-22)
registry: io.github.CrowdStrike/falcon-mcp (active, first published 2026-05-18 · 9 versions)
packages: pypi:falcon-mcp

06 · CrowdStrike Falcon MCP Server FAQ

What is CrowdStrike Falcon MCP Server?

Is CrowdStrike Falcon MCP Server still maintained?

Yes - as of 2026-08-25, its last commit was 2026-08-24 and it shipped 8 releases in the last 90 days. We re-verify nightly.

How do I install CrowdStrike Falcon MCP Server?

Run `uvx falcon-mcp`. The README documents 3 environment variables (FALCON_CLIENT_ID, FALCON_CLIENT_SECRET, FALCON_BASE_URL) to set first. Set FALCON_CLIENT_ID, FALCON_CLIENT_SECRET, FALCON_BASE_URL before connecting. You can also paste the ready-made client config above.

Does CrowdStrike Falcon MCP Server run locally?

Yes - it's a stdio server: it runs on your machine (via uvx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to CrowdStrike Falcon MCP Server

Alternatives to CrowdStrike Falcon MCP Server

Maintained security servers if CrowdStrike Falcon MCP Server isn't the fit.

Pairs well with

Servers that cover what CrowdStrike Falcon MCP Server doesn't - only shown when the pairing reason fits the companion.

head to head · CrowdStrike Falcon MCP Server vs Snyk MCP Server · CrowdStrike Falcon MCP Server vs HOL Guard · Auth0 MCP Server vs CrowdStrike Falcon MCP Server

More security MCP servers · Clipboard History MCP · Google Ads MCP · Excalidraw · Delego

More Python MCP servers · Trentina · Cruxible Core · Contract Review AI MCP · Iso 27001 AI MCP · Music Production AI MCP · see all