CrowdStrike Falcon MCP Server

falcon-mcp is a Model Context Protocol (MCP) server that connects AI agents with the CrowdStrike Falcon platform, powering intelligent security analysis in your agentic workflows. It delivers programmatic access to essential security capabilities - including detections, threat intelligence, and host management - establishing the foundation for advanced security operations and automation.

People who work with crowdstrike and falcon and want it reachable from Claude, Cursor, VS Code, or another MCP client. The project is written in Python.

VERIFIED ACTIVE

LAST COMMIT 2026-09-17 · ★ 256 · #3 OF 204 MAINTAINED SECURITY · VERIFIED 2026-09-18

MIT · Python servers · how we verify → /methodology

01 · Install CrowdStrike Falcon MCP Server

before you install - you'll need

Set FALCON_CLIENT_ID, FALCON_CLIENT_SECRET, FALCON_BASE_URL before connecting.

Claude Code

claude mcp add crowdstrike-falcon-mcp -- uvx falcon-mcp

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "crowdstrike-falcon-mcp": {
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license MIT - declared in the repository

pypi package falcon-mcp - check the name against the project README before installing (PyPI has no namespace ownership)

registry namespace io.github.CrowdStrike is GitHub-verified and matches the repo owner

03 · What CrowdStrike Falcon MCP Server can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

Latest releases

v0.19.0 · 2026-09-01

0.19.0 (2026-09-01) · modules/guardian: add AI agent activity module · stop generic words deciding which tools are reachable

v0.18.0 · 2026-08-28

0.18.0 (2026-08-28) · modules/cloud: cloud insights - mixin package, filter-only search, and definitions catalog · reject sort expressions the policy APIs cannot serve · resolve operation names behind constants and…

v0.17.0 · 2026-08-22

0.17.0 (2026-08-22) · modules/agentworks: add AgentWorks module for calling and observing Charlotte AI agents · modules/cases: add description_format to create/update case · modules/discover: add…

04 · Who maintains CrowdStrike Falcon MCP Server

CrowdStrike Falcon MCP Server is maintained by crowdstrike. It's the only MCP server we track from this author; the repo dates to Jun 2025.

05 · Facts

repository: github.com/crowdstrike/falcon-mcp
category: security - ranked #3 of 204 actively-maintained security servers as of 2026-09-18.
release cadence: 8 releases in the last 90 days (latest 2026-09-01)
registry: io.github.CrowdStrike/falcon-mcp (active, first published 2026-05-18 · 11 versions)
packages: pypi:falcon-mcp

06 · CrowdStrike Falcon MCP Server FAQ

What is CrowdStrike Falcon MCP Server?

Is CrowdStrike Falcon MCP Server still maintained?

Yes - as of 2026-09-18, its last commit was 2026-09-17 and it shipped 8 releases in the last 90 days. We re-verify nightly.

How do I install CrowdStrike Falcon MCP Server?

Run `uvx falcon-mcp`. The README documents 3 environment variables (FALCON_CLIENT_ID, FALCON_CLIENT_SECRET, FALCON_BASE_URL) to set first. Set FALCON_CLIENT_ID, FALCON_CLIENT_SECRET, FALCON_BASE_URL before connecting. You can also paste the ready-made client config above.

Does CrowdStrike Falcon MCP Server run locally?

Yes - it's a stdio server: it runs on your machine (via uvx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to CrowdStrike Falcon MCP Server

Alternatives to CrowdStrike Falcon MCP Server

Maintained security servers if CrowdStrike Falcon MCP Server isn't the fit.

Pairs well with

Servers that cover what CrowdStrike Falcon MCP Server doesn't - only shown when the pairing reason fits the companion.

head to head · CrowdStrike Falcon MCP Server vs Snyk MCP Server · CrowdStrike Falcon MCP Server vs HOL Guard · Auth0 MCP Server vs CrowdStrike Falcon MCP Server

More security MCP servers · CTRLRun Operator · Osv Advisory MCP Server · Cybercentry Verification · Clipboard History MCP · Google Ads MCP

More Python MCP servers · Trentina · Cruxible Core · Multi-Account Gmail · Mcu Buddy · see all