# CrowdStrike Falcon MCP Server

> Draft · awaiting review.

> MCP server that connects agents to the CrowdStrike Falcon platform: detections, threat intel, host management and response.

- Badge: `reach 3 · beyond declared (1)`
- Type: MCP server; tier: tried
- Tasks: Alert triage, Threat intel enrichment; mission: Defensive; works with: Any MCP client, Gemini CLI
- Source: https://github.com/CrowdStrike/falcon-mcp, pinned to `17fea06` (v0.19.0), licence MIT
- Last checked: 2026-11-07; next check: 2027-05-06; method v0.1, reach-v0.1

## At a glance

- **What it is:** falcon-mcp is an MCP server that connects AI agents with the CrowdStrike Falcon platform and gives them programmatic access to detections, threat intelligence, host management and other security capabilities. An MCP server is a program that gives your AI client extra tools; the client's model decides when to call them.
- **Made for:** Gives AI agents access to a CrowdStrike Falcon tenant for security analysis and automation. +1 more
- **Runs:** On your machine, started by your AI client. Other modes: SSE or streamable HTTP (on your machine, as a service with a network port); Docker image (in a container on your machine). Listens only in an optional mode: With an HTTP transport, uvicorn listens on 127.0.0.1:8000 by default; --host and --port change it, --api-key requires an x-api-key header (sign-in optional).
- **Sends data to:** CrowdStrike Falcon API (always), HTTP/HTTPS proxy (if you turn it on), PyPI (by default), quay.io (if you turn it on). Other connections not ruled out: read in the documentation and the cited code, not searched in full.
- **Can change things:** Changes, deletes, runs commands, according to the capabilities read. Partly listed: Core, AgentWorks, Cases, Cloud Security, Custom IOA, Discover, Firewall, Guardian, Host Groups, Identity Protection, IOC, Recon, Shield, Spotlight and 5 more modules
- **Needs:** Access to a CrowdStrike console in which to create API credentials · A Falcon API client with its Client ID and Client Secret; the quickstart enables at minimum Hosts:read and Alerts:read · Python 3.11 or higher · +3 more

Profile read at commit `17fea06` on 2026-10-25; every fact cites a file and line at that commit.

## What it does

falcon-mcp is an MCP server that connects AI agents with the CrowdStrike Falcon platform and gives them programmatic access to detections, threat intelligence, host management and other security capabilities. (README.md#L15)

Made for (the author says):

- Gives AI agents access to a CrowdStrike Falcon tenant for security analysis and automation. (server.json#L5)
- Supports threat investigation, detection triage and security operations from AI assistants such as Claude Desktop, VS Code, Gemini CLI and custom agents. (docs/overview.md#L9)

Documented uses:

- Find Falcon detections by severity, status, hostname or time range [Alert triage] (docs/modules/detections.md#L22)
- Research threat actors and adversary groups tracked by CrowdStrike intelligence [Threat intel enrichment] (docs/modules/intel.md#L21)
- Collect host evidence with read-only RTR commands such as ls, ps, cat, filehash and reg [Incident response and forensics (DFIR)] (docs/modules/rtr.md#L126)
- Turn a CQL query into a scheduled NG-SIEM correlation rule [Detection engineering] (docs/modules/correlationrules.md#L42)

Not for (the author says):

- The authors ask users to avoid production deployments while the project is in public preview. (README.md#L18)

## What it can do

| Group | What it covers | Effect | On by default |
|---|---|---|---|
| Detections | Searches, aggregates and retrieves Falcon detections (alerts) and updates their status, assignment, visibility, comments and tags. (docs/modules/detections.md#L78) | reads, changes | yes |
| Hosts | Searches hosts and their sensor state, retrieves host details, and adds or removes Falcon Grouping Tags on hosts. (docs/modules/hosts.md#L55) | reads, changes | yes |
| Intel | Researches threat actors, IOCs and intelligence reports. (README.md#L44) | reads | yes |
| Real Time Response | Searches and audits RTR sessions, opens and refreshes a session on one host, runs read-only RTR commands and polls their output. (docs/modules/rtr.md#L7) | reads, changes, runs commands | yes |
| NGSIEM | Executes CQL queries against Next-Gen SIEM. (README.md#L46) | reads | yes |
| Correlation Rules | Searches, creates, updates and permanently deletes NG-SIEM correlation rules. (docs/modules/correlationrules.md#L75) | reads, changes, deletes | yes |
| Policies | Searches, creates, updates and deletes six host policy types and manages host-group assignment, enable/disable and precedence. (README.md#L47) | reads, changes, deletes | yes |
| Exclusions | Searches, creates, updates and deletes IOA, machine learning, sensor visibility and certificate-based exclusions. (README.md#L37) | reads, changes, deletes | yes |
| Quarantine | Searches quarantine records, previews action counts, and releases, unreleases or deletes quarantined files. (README.md#L48) | reads, changes, deletes | yes |
| Fusion SOAR | Searches Fusion SOAR workflow definitions and executions, reads execution results and starts on-demand workflows. (README.md#L39) | reads, changes | yes |

Partly listed: Core, AgentWorks, Cases, Cloud Security, Custom IOA, Discover, Firewall, Guardian, Host Groups, Identity Protection, IOC, Recon, Shield, Spotlight and 5 more modules

## How it runs

falcon-mcp calls the CrowdStrike Falcon API through the APIHarnessV2 client from FalconPy. (falcon_mcp/client.py#L17-18)

- Starts: On your machine, started by your AI client. By default the AI client starts falcon-mcp as a subprocess and talks to it over stdin/stdout. (docs/usage/transports.md#L17)
- Can also run: On your machine, as a service with a network port (SSE or streamable HTTP, switch `--transport streamable-http`). With --transport streamable-http (or --transport sse) it runs as an HTTP server on the user's machine, listening at 127.0.0.1:8000 by default. (docs/usage/transports.md#L55)
- Can also run: In a container on your machine (Docker image, switch `docker run -i --rm`). Runs from the quay.io/crowdstrike/falcon-mcp image, over stdio with -i or over HTTP with a published port. (README.md#L166)
- Your AI client: **MCP client configuration**: An mcpServers entry in the AI client that starts falcon-mcp with uvx and an --env-file path. (docs/getting-started/quickstart.md#L41)
- Your machine: **falcon-mcp server**: Python console program falcon-mcp, started through the entry point falcon_mcp.server:main. (pyproject.toml#L43)
- Your machine: **.env file**: Holds FALCON_CLIENT_ID, FALCON_CLIENT_SECRET, FALCON_BASE_URL and optional server settings read at startup. (docs/getting-started/configuration.md#L38)
- Container on your machine: **Docker container**: Optional python:3.13-alpine image that runs falcon-mcp as the non-root user app. (Dockerfile#L49)
- Outside your machine: **CrowdStrike Falcon API**: Regional Falcon REST API that issues OAuth2 tokens and serves all module operations. (falcon_mcp/client.py#L53-55)
- Outside your machine: **AgentWorks Charlotte AI agents**: Charlotte AI agents in the Falcon tenant that the AgentWorks module can list, invoke and observe. (docs/modules/agentworks.md#L94)
- Listens: With an HTTP transport, uvicorn listens on 127.0.0.1:8000 by default; --host and --port change it, --api-key requires an x-api-key header.: an address you choose, sign-in optional, in an optional mode (falcon_mcp/server.py#L589)
- Sends data to CrowdStrike Falcon API (vendor API, always): Authenticates with the API client id and secret at startup, then sends every tool call to the regional Falcon API base URL. (falcon_mcp/server.py#L158-159)
- Sends data to HTTP/HTTPS proxy (other, if you turn it on): Routes outbound Falcon API traffic through the proxy set in --proxy or FALCON_PROXY_URL. (falcon_mcp/client.py#L82-84)
- Sends data to PyPI (download, by default): The registry entry starts the PyPI package falcon-mcp through uvx, which resolves the package from PyPI. (server.json#L14-17)
- Sends data to quay.io (download, if you turn it on): The container route pulls the falcon-mcp image from quay.io. (README.md#L163)

## What you need

- Account: Access to a CrowdStrike console in which to create API credentials. (docs/getting-started/credentials.md#L6)
- Credentials: A Falcon API client with its Client ID and Client Secret; the quickstart enables at minimum Hosts:read and Alerts:read. (docs/getting-started/quickstart.md#L14)
- Runtime: Python 3.11 or higher. (docs/getting-started/installation.md#L8)
- Other tools: uv or pip to install the package. (docs/getting-started/installation.md#L9)
- Setting: The Falcon API base URL for the tenant's CrowdStrike region (US-1, US-2, EU-1 or US-GOV); US-1 is the default. (docs/getting-started/credentials.md#L27)
- Credentials: The Falcon API client's scopes are selected according to the modules the user plans to enable; each module requires its own CrowdStrike API scopes. (docs/getting-started/credentials.md#L16-23)
- Installer: uv tool install falcon-mcp installs the falcon-mcp package from PyPI as a uv tool without naming a version, so it takes the latest release rather than the checked v0.19.0. (README.md#L72)
- Installer: One configuration option downloads .env.example from the main branch with curl and saves it as .env in the current directory. (docs/getting-started/configuration.md#L49)
- Installer: The Docker guide's recommended route pulls the quay.io/crowdstrike/falcon-mcp:latest image tag. (docs/deployment/docker.md#L13)

## Limits and risks

- The HTTP transports have no authentication by default; binding beyond loopback without --api-key logs a warning and the server still starts. (docs/getting-started/configuration.md#L101-102)
- By default all available modules are enabled; --modules or FALCON_MCP_MODULES restricts which modules load. (docs/getting-started/configuration.md#L78)
- A module is enabled as a whole, so enabling it for its search tools also exposes its mutating tools; --read-only, --tools and --exclude-tools narrow the surface per tool. (README.md#L202-203)
- BaseModule._add_tool gives every tool registered without annotations the READ_ONLY_ANNOTATIONS default. (falcon_mcp/modules/base.py#L120-126)
- The server instructions ask the agent to confirm the user's intent before calling tools marked readOnlyHint=false or destructiveHint=true. (falcon_mcp/server.py#L49-51)
- The RTR module uses the read-only RTR command endpoint and does not expose RTR Admin, Active Responder, remediation or arbitrary script execution. (falcon_mcp/resources/rtr.py#L429-431)
- The Docker guide's streamable-http example publishes port 8000 and binds 0.0.0.0 without --api-key. (docs/deployment/docker.md#L32-33)
- What falcon_execute_workflow does depends on the Fusion SOAR workflow named; a workflow may contain a host, disable an identity or notify third parties. (docs/modules/fusion.md#L102-104)
- The authors warn that Grouping Tags set through falcon_manage_host_grouping_tags can drive dynamic host group and policy assignment, so changing them may change a host's security posture. (docs/modules/hosts.md#L58-59)
- falcon_invoke_agentworks_agent runs a Charlotte AI agent on a prompt and spends credits; the run continues server-side after a timeout. (docs/modules/agentworks.md#L96-98)
- The README describes falcon-mcp as a community-driven open source project that is not an official CrowdStrike product but is maintained by CrowdStrike. (README.md#L310)
- With --read-only a tool is withheld unless its readOnlyHint annotation is True, so the filter relies on the annotations set in the code. (falcon_mcp/tool_filter.py#L161-168)
- falcon_execute_rtr_read_only_command sends the agent's base_command and command_string unchanged to the RTR_ExecuteCommand operation; the module code applies no command list of its own. (falcon_mcp/modules/rtr.py#L534-541)

## Rights in plain language

- Declared: files 2 (writes outside the project), network 3 (can tunnel or exfiltrate), execution 1 (runs only declared programs), secrets 1 (uses one scoped token), persistence 2 (changes config or installs globally), approval 0 (asks each time).
- Code: reach 3 (privileged): files 2 (writes outside the project), network 3 (can tunnel or exfiltrate), persistence 2 (changes config or installs globally); unknown: approval.
- Lab: Beyond declared on 1 of 6 rights: secrets (observed 3, declared 1), reading ~/.netrc on every API request.

Why three columns? Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

## Privilege Reach

Reach level 3 (privileged).

| Right | Declared | Code | Lab |
|---|---|---|---|
| Files: where does it read and write? | 2 writes outside the project | 2 writes outside the project | ? unknown |
| Network: whom does it talk to? | 3 can tunnel or exfiltrate | 3 can tunnel or exfiltrate | 1 talks only to declared hosts |
| Execution: what does it run? | 1 runs only declared programs | 1 runs only declared programs | 0 runs no programs |
| Secrets: which credentials does it touch? | 1 uses one scoped token | 1 uses one scoped token | 3 reads credential stores (beyond declared) |
| Persistence: what survives the run? | 2 changes config or installs globally | 2 changes config or installs globally | 0 leaves results only |
| Approval: does it ask before acting? | 0 asks each time | ? unknown | 0 asks each time |

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe

## Install

### Upstream

Quoted from `README.md#L69-73` at the pinned commit (not a command to copy): `uv tool install falcon-mcp`


### Run it with least privilege

- note: `derived from the code; of it, the lab ran stdio with --read-only and --modules detections against a stub of the API (runs/2026-11-07); prefer the stdio transport, run with --read-only or a narrow --modules set, give the API client only the scopes those modules need, never bind the HTTP transport to 0.0.0.0 without an api-key, and keep FALCON_MCP_TRANSPORT out of any .env file in the working directory`

- derived, not tested: proposed from the code analysis

## Lab runs

### 2026-11-07

One run is an observation, not a benchmark.

- Run and written by Ilja Schlak, 2026-11-07
- Target: Lab stub of the CrowdStrike Falcon API (fixtures/api-stub, plain HTTP on the lab target) 0.1.0; model claude-haiku-5-5; claude-code mode dontAsk with the lab approver: every tool call asks, the task list below allows, everything else is denied; white-box
- Verdict: Beyond declared on 1 of 6 rights: secrets (observed 3, declared 1), reading ~/.netrc on every API request.
- Use again: with-limits; Did the read-only detection search cleanly through the lab stub, but every API request makes it look up ~/.netrc for credentials, a store it does not declare.
- Artifacts: https://readbeforerun.ai/catalog/crowdstrike-falcon-mcp/runs/2026-11-07/

## Questions and answers

**Why compare declared, code and lab?**

Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

**What rights does CrowdStrike Falcon MCP Server declare?**

files 2 (writes outside the project), network 3 (can tunnel or exfiltrate), execution 1 (runs only declared programs), secrets 1 (uses one scoped token), persistence 2 (changes config or installs globally), approval 0 (asks each time).

**What does its code suggest?**

reach 3 (privileged): files 2 (writes outside the project), network 3 (can tunnel or exfiltrate), persistence 2 (changes config or installs globally); unknown: approval.

**What did it use when it ran in the lab?**

Beyond declared on 1 of 6 rights: secrets (observed 3, declared 1), reading ~/.netrc on every API request.

**Was it tried, and when?**

Yes: 2026-11-07.

**What changed since the last check?**

Upstream last pushed 2026-10-08; 0 release(s) since the pinned version.

**How do I run it with least privilege?**

Derived, not tested: note: derived from the code; of it, the lab ran stdio with --read-only and --modules detections against a stub of the API (runs/2026-11-07); prefer the stdio transport, run with --read-only or a narrow --modules set, give the API client only the scopes those modules need, never bind the HTTP transport to 0.0.0.0 without an api-key, and keep FALCON_MCP_TRANSPORT out of any .env file in the working directory

Method: https://readbeforerun.ai/method/