CrowdStrike Falcon MCP Server

Draft · awaiting review

MCP server that connects agents to the CrowdStrike Falcon platform: detections, threat intel, host management and response.

Preview: The README marks the project as a public preview under active development whose features may change before a stable 1.0 release. README.md L18, README.md#L18 at the checked commit

“Did the read-only detection search cleanly through the lab stub, but every API request makes it look up ~/.netrc for credentials, a store it does not declare.” Would we use it again: with limits.

For Alert triage, Threat intel enrichmentWorks with Any MCP client, Gemini CLIMaintained CrowdStrike, last push 2026-10-08

MCP serverAn MCP server is a program that gives your AI client extra tools; the client's model decides when to call them. by CrowdStrike · read from the code at 17fea06 (v0.19.0) on 2026-11-07The date we last read the tool’s files. The code after “at” names the exact version (the git commit) we read; a newer version may differ. · Ran once on 2026-11-07 and did more than it said.Whether we have run the tool in our lab. “Did more than it said” means the run used rights its description does not name; “did no more than it said” means it stayed within them.

Code showsWhat a reading of the code found the tool can do, at the checked version, in the words of the rights table in the record. It is a ceiling, not what the tool did. A right marked unknown has no evidence either way, and that never counts as harmless.

What the code shows, worst first. No run advice yet: the one word needs a read under the full rule.

Level 3. Network. The HTTP transport starts uvicorn on the operator-supplied host and only warns when a non-loopback address such as all interfaces is used without an api-key, which is a network-reachable listener.
server.py L456-472 · server.py L553
Level 2. Files. Delete_quarantined_files deletes quarantined files on endpoints by id or by an FQL filter.
quarantine.py L265-270
Level 2. Persistence. Enables, disables, attaches and deletes Falcon policies, i.e. changes target configuration.
policies.py L873-894
No evidence. Approval. Unknown: the code sets no approval configuration; the server only instructs connecting agents to confirm intent, which is guidance rather than an enforced gate. That never counts as zero.

Before first useSettings for your AI client that limit the tool to the rights its task needs; derived from the code unless marked tested. derived from the code, not tested

Derived from the code.
Of it, the lab ran stdio with --read-only and --modules detections against a stub of the API (runs/2026-11-07).
Prefer the stdio transport, run with --read-only or a narrow --modules set, give the API client only the scopes those modules need, never bind the HTTP transport to 0.0.0.0 without an api-key, and keep FALCON_MCP_TRANSPORT out of any .env file in the working directory.

What we checked, and what we found Disagree?

MCP server · code showsreach 3 · privileged

What the code can reach, 0 to 3 per right; a dashed point means no evidence, never zero. The three readings

Is it for you?

Made for: Gives AI agents access to a CrowdStrike Falcon tenant for security analysis and automation.
Supports threat investigation, detection triage and security operations from AI assistants such as Claude Desktop, VS Code, Gemini CLI and custom agents.
Use it when: Find Falcon detections by severity, status, hostname or time range Alert triage
Research threat actors and adversary groups tracked by CrowdStrike intelligence Threat intel enrichment
Collect host evidence with read-only RTR commands such as ls, ps, cat, filehash and reg Incident response and forensics (DFIR)
Turn a CQL query into a scheduled NG-SIEM correlation rule Detection engineering
Not for: The authors ask users to avoid production deployments while the project is in public preview.
You need: Access to a CrowdStrike console in which to create API credentials
A Falcon API client with its Client ID and Client Secret; the quickstart enables at minimum Hosts:read and Alerts:read
Python 3.11 or higher
+3 more
Details: You need

Install

linked, not distributed: the Field Guide does not bundle agents or MCP servers

Upstream

uv tool install falcon-mcp
Quoted from README.md#L69-73 at the pinned commit; a quotation, not a command to copy.

Run it with least privilege

note: derived from the code; of it, the lab ran stdio with --read-only and --modules detections against a stub of the API (runs/2026-11-07); prefer the stdio transport, run with --read-only or a narrow --modules set, give the API client only the scopes those modules need, never bind the HTTP transport to 0.0.0.0 without an api-key, and keep FALCON_MCP_TRANSPORT out of any .env file in the working directory

derived, not tested: proposed from the code analysis

End of the card. Below: what we checked, and what we found.Markdown JSON

The record · every value with its evidence

What we checked, and what we found.

Profile read at commit 17fea06 on 2026-10-25: 57 facts, each with its quoted line confirmed by script; see the lab runs below.Each fact was read from the tool's files at the checked version and links to the line it comes from. Where nothing was found, the page says so instead of assuming “none”.

Run and written by Ilja Schlak, 2026-11-07. Each section opens with the answer; the file and line of every fact follow it.

What it can change the capability groups as upstream groups them, worst first

Changes, deletes, runs commands, according to the capabilities read.

Partly listed: Core, AgentWorks, Cases, Cloud Security, Custom IOA, Discover, Firewall, Guardian, Host Groups, Identity Protection, IOC, Recon, Shield, Spotlight and 5 more modules

What it can do, by group
Group	What it covers	Effect	On by default
Correlation Rules	Searches, creates, updates and permanently deletes NG-SIEM correlation rules. correlationrules.md L75, docs/modules/correlationrules.md#L75 at the checked commit	reads, changes, deletes	yes
Policies	Searches, creates, updates and deletes six host policy types and manages host-group assignment, enable/disable and precedence. README.md L47, README.md#L47 at the checked commit	reads, changes, deletes	yes
Exclusions	Searches, creates, updates and deletes IOA, machine learning, sensor visibility and certificate-based exclusions. README.md L37, README.md#L37 at the checked commit	reads, changes, deletes	yes
Quarantine	Searches quarantine records, previews action counts, and releases, unreleases or deletes quarantined files. README.md L48, README.md#L48 at the checked commit	reads, changes, deletes	yes
Real Time Response	Searches and audits RTR sessions, opens and refreshes a session on one host, runs read-only RTR commands and polls their output. rtr.md L7, docs/modules/rtr.md#L7 at the checked commit	reads, changes, runs commands	yes
Detections	Searches, aggregates and retrieves Falcon detections (alerts) and updates their status, assignment, visibility, comments and tags. detections.md L78, docs/modules/detections.md#L78 at the checked commit	reads, changes	yes
Hosts	Searches hosts and their sensor state, retrieves host details, and adds or removes Falcon Grouping Tags on hosts. hosts.md L55, docs/modules/hosts.md#L55 at the checked commit	reads, changes	yes
Fusion SOAR	Searches Fusion SOAR workflow definitions and executions, reads execution results and starts on-demand workflows. README.md L39, README.md#L39 at the checked commit	reads, changes	yes
Intel	Researches threat actors, IOCs and intelligence reports. README.md L44, README.md#L44 at the checked commit	reads	yes
NGSIEM	Executes CQL queries against Next-Gen SIEM. README.md L46, README.md#L46 at the checked commit	reads	yes

Where it sends data and who can connect to it

4 outside connections found in the files read: CrowdStrike Falcon API, HTTP/HTTPS proxy, PyPI, quay.io.

CrowdStrike Falcon API vendor API, always. Authenticates with the API client id and secret at startup, then sends every tool call to the regional Falcon API base URL. server.py L158-159, falcon_mcp/server.py#L158-159 at the checked commit
HTTP/HTTPS proxy other, if you turn it on. Routes outbound Falcon API traffic through the proxy set in --proxy or FALCON_PROXY_URL. client.py L82-84, falcon_mcp/client.py#L82-84 at the checked commit
PyPI download, by default. The registry entry starts the PyPI package falcon-mcp through uvx, which resolves the package from PyPI. server.json L14-17, server.json#L14-17 at the checked commit
quay.io download, if you turn it on. The container route pulls the falcon-mcp image from quay.io. README.md L163, README.md#L163 at the checked commit

One listener in the files read.

With an HTTP transport, uvicorn listens on 127.0.0.1:8000 by default; --host and --port change it, --api-key requires an x-api-key header: an address you choose, sign-in optional, in an optional mode. server.py L589, falcon_mcp/server.py#L589 at the checked commit

Other connections not ruled out: read in the documentation and the cited code, not searched in full.

How it runs generated from the files read, never drawn by hand

falcon-mcp calls the CrowdStrike Falcon API through the APIHarnessV2 client from FalconPy. client.py L17-18, falcon_mcp/client.py#L17-18 at the checked commit

Your AI client

Parts that live inside the AI client: skill instructions, client configuration.

MCP client configuration An mcpServers entry in the AI client that starts falcon-mcp with uvx and an --env-file path. quickstart.md L41, docs/getting-started/quickstart.md#L41 at the checked commit

Your machine

Programs and files on the machine where you run the tool.

falcon-mcp server Python console program falcon-mcp, started through the entry point falcon_mcp.server:main. pyproject.toml L43, pyproject.toml#L43 at the checked commit
.env file Holds FALCON_CLIENT_ID, FALCON_CLIENT_SECRET, FALCON_BASE_URL and optional server settings read at startup. configuration.md L38, docs/getting-started/configuration.md#L38 at the checked commit

Container on your machine

Parts inside a container that the tool starts on your machine.

Docker container Optional python:3.13-alpine image that runs falcon-mcp as the non-root user app. Dockerfile L49, Dockerfile#L49 at the checked commit

Outside your machine

Remote services: vendor APIs, model providers, targets, telemetry endpoints. Data sent here leaves your machine.

AgentWorks Charlotte AI agents Charlotte AI agents in the Falcon tenant that the AgentWorks module can list, invoke and observe. agentworks.md L94, docs/modules/agentworks.md#L94 at the checked commit

The six rights, read three waysThe six rights a tool can take (files, network, execution, secrets, persistence, approval), each read three ways and rated 0 to 3. 0 never means safe; “?” means no evidence. what the author says, what the code shows, what one lab run showed

Level 3 (privileged), read from the code.

Privilege Reach: six rights, each read three ways. Levels 0 to 3; ? means no evidence.
Right	Author sayswhat the author says	Code showswhat static analysis finds	Run showedwhat one lab run showed
Fileswhere does it read and write?
Networkwhom does it talk to?
Executionwhat does it run?
Secretswhich credentials does it touch?
Persistencewhat survives the run?
Approvaldoes it ask before acting?

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe · zero means: none declared (Declared), none found (Code), none observed (Lab)

Author says: the evidence

Files · 2README.md L48 the Quarantine module can release, unrelease or delete quarantined files on endpoints, i.e. restore or delete files on the target
Network · 3README.md L168-171 the documented container launch binds the streamable-http transport to every network interface, which declares a network-reachable listener beyond the loopback default
Execution · 1README.md L49 execution is declared as read-only RTR triage on endpoints
Secrets · 1server.json L29-35 one CrowdStrike API client secret supplied by the user
Persistence · 2README.md L47 the server creates, updates and deletes Falcon policies, i.e. changes target configuration
Approval · 0server.py L49-51 the server instructions tell agents to confirm intent before any state-changing tool and declare no pre-approvals

Code shows: the evidence

Files · 2quarantine.py L265-270 delete_quarantined_files deletes quarantined files on endpoints by id or by an FQL filter
Network · 3server.py L456-472 the HTTP transport starts uvicorn on the operator-supplied host and only warns when a non-loopback address such as all interfaces is used without an api-key, which is a network-reachable listener
server.py L553 stdio is the default transport, and the HTTP host defaults to 127.0.0.1 (L587-591) with an optional --api-key (L616-620)
Execution · 1rtr.py L534-541 runs RTR commands on an endpoint through the read-only RTR_ExecuteCommand endpoint, with no local shell
Secrets · 1client.py L51-52 reads one API client id and secret from parameters or environment variables, with no credential store access
Persistence · 2policies.py L873-894 enables, disables, attaches and deletes Falcon policies, i.e. changes target configuration
Approval · ?no evidence: the code sets no approval configuration; the server only instructs connecting agents to confirm intent, which is guidance rather than an enforced gate

Valid for commit 17fea06 (v0.19.0) · checked 2026-11-07 · method reach-v0.1The published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.

Limits and risks what the files say that fits nowhere else, and what this reading does not cover

The HTTP transports have no authentication by default; binding beyond loopback without --api-key logs a warning and the server still starts. configuration.md L101-102, docs/getting-started/configuration.md#L101-102 at the checked commit
By default all available modules are enabled; --modules or FALCON_MCP_MODULES restricts which modules load. configuration.md L78, docs/getting-started/configuration.md#L78 at the checked commit
A module is enabled as a whole, so enabling it for its search tools also exposes its mutating tools; --read-only, --tools and --exclude-tools narrow the surface per tool. README.md L202-203, README.md#L202-203 at the checked commit
BaseModule._add_tool gives every tool registered without annotations the READ_ONLY_ANNOTATIONS default. base.py L120-126, falcon_mcp/modules/base.py#L120-126 at the checked commit
The server instructions ask the agent to confirm the user's intent before calling tools marked readOnlyHint=false or destructiveHint=true. server.py L49-51, falcon_mcp/server.py#L49-51 at the checked commit
The RTR module uses the read-only RTR command endpoint and does not expose RTR Admin, Active Responder, remediation or arbitrary script execution. rtr.py L429-431, falcon_mcp/resources/rtr.py#L429-431 at the checked commit
The Docker guide's streamable-http example publishes port 8000 and binds 0.0.0.0 without --api-key. docker.md L32-33, docs/deployment/docker.md#L32-33 at the checked commit
What falcon_execute_workflow does depends on the Fusion SOAR workflow named; a workflow may contain a host, disable an identity or notify third parties. fusion.md L102-104, docs/modules/fusion.md#L102-104 at the checked commit
The authors warn that Grouping Tags set through falcon_manage_host_grouping_tags can drive dynamic host group and policy assignment, so changing them may change a host's security posture. hosts.md L58-59, docs/modules/hosts.md#L58-59 at the checked commit
falcon_invoke_agentworks_agent runs a Charlotte AI agent on a prompt and spends credits; the run continues server-side after a timeout. agentworks.md L96-98, docs/modules/agentworks.md#L96-98 at the checked commit
The README describes falcon-mcp as a community-driven open source project that is not an official CrowdStrike product but is maintained by CrowdStrike. README.md L310, README.md#L310 at the checked commit
With --read-only a tool is withheld unless its readOnlyHint annotation is True, so the filter relies on the annotations set in the code. tool_filter.py L161-168, falcon_mcp/tool_filter.py#L161-168 at the checked commit
falcon_execute_rtr_read_only_command sends the agent's base_command and command_string unchanged to the RTR_ExecuteCommand operation; the module code applies no command list of its own. rtr.py L534-541, falcon_mcp/modules/rtr.py#L534-541 at the checked commit
Not covered: what it does at runtime beyond the one lab run. Other connections not ruled out: read in the documentation and the cited code, not searched in full.

What you need and what the documented installer does

What you need
Kind	What
AI client	Any MCP client, Gemini CLI; sign-in: OAuth 2
Account	Access to a CrowdStrike console in which to create API credentials. credentials.md L6, docs/getting-started/credentials.md#L6 at the checked commit
Credentials	A Falcon API client with its Client ID and Client Secret; the quickstart enables at minimum Hosts:read and Alerts:read. quickstart.md L14, docs/getting-started/quickstart.md#L14 at the checked commit
Runtime	Python 3.11 or higher. installation.md L8, docs/getting-started/installation.md#L8 at the checked commit
Other tools	uv or pip to install the package. installation.md L9, docs/getting-started/installation.md#L9 at the checked commit
Setting	The Falcon API base URL for the tenant's CrowdStrike region (US-1, US-2, EU-1 or US-GOV); US-1 is the default. credentials.md L27, docs/getting-started/credentials.md#L27 at the checked commit
Credentials	The Falcon API client's scopes are selected according to the modules the user plans to enable; each module requires its own CrowdStrike API scopes. credentials.md L16-23, docs/getting-started/credentials.md#L16-23 at the checked commit

What the documented installer does

uv tool install falcon-mcp installs the falcon-mcp package from PyPI as a uv tool without naming a version, so it takes the latest release rather than the checked v0.19.0. README.md L72, README.md#L72 at the checked commit
One configuration option downloads .env.example from the main branch with curl and saves it as .env in the current directory. configuration.md L49, docs/getting-started/configuration.md#L49 at the checked commit
The Docker guide's recommended route pulls the quay.io/crowdstrike/falcon-mcp:latest image tag. docker.md L13, docs/deployment/docker.md#L13 at the checked commit

Lab runs (1) one run is an observation, not a benchmark

Lab run 2026-11-07

Run and written by Ilja Schlak, 2026-11-07 · observation

One run is an observation, not a benchmark.

The lab values hold for exactly this configuration: commit 17fea06 (v0.19.0), the runtime and the model below.

Setup

Target: Lab stub of the CrowdStrike Falcon API (fixtures/api-stub, plain HTTP on the lab target) 0.1.0
Model: claude-haiku-5-5 (dated 2026-11-07, direct, global)
Client: Claude Code 2.1.311, mode dontAsk with the lab approver: every tool call asks, the task list below allows, everything else is denied
Access: white-box
Task: Lab measurement task. Use only the tools of the MCP server falcon. First call falcon_check_connectivity. Then call falcon_search_detections once with limit 5 and no other arguments. Then answer in one sentence what the two calls returned. Do not call any other tool.
Timebox: 6 min
Duration: 2:07
Tokens: 67,764 in · 334 out
Cost: $0.00 (tool-reported)

Result

Reported: 0 findings
Validated: sample of 0: 0 true, 0 false positives
Score: Task done: the connectivity check reported connected and the detection search returned the empty list the lab stub serves. Nothing to score: this run measures reach, not detection.
Scope violations: none
Notes: falcon-mcp signs in to the Falcon API when it starts and exits if that fails (falcon_mcp/server.py lines 158 to 162 at the pinned commit), so with dummy credentials against CrowdStrike it would never reach the MCP handshake. The lab therefore points FALCON_BASE_URL at its own stub of the API (tool-cmd.sh). The server made three requests, all to the stub: two token requests and one detection query (target-access.txt lines 3 to 5). The server process opened ~/.netrc three times, matching those requests in order and spacing (host-events.jsonl lines 5 to 7). falconpy 1.6.4, the API library it uses, calls requests without an auth argument (falconpy/_util/_functions.py line 423), and requests then looks up the request's host in ~/.netrc and would use credentials it finds there. The canary netrc planted for this run had no entry for the stub's address, so nothing was attached, and the runner made no DNS query and no connection outside the lab. An earlier run the same day without a cost cap (20261107T174922Z) showed the same three reads. The install took the 34 locked packages with their hashes from the project's uv.lock through the lab proxy.

What it did, per right

Files · ?no evidence: no writes besides result paths (fs-diff.json); reads are not audited, so 0 (reads only the working directory) and 1 (reads outside) cannot be told apart; /tmp in the runner is a tmpfs and invisible to fs-diff
Network · 1 talks only to declared hoststarget-access.txt#L3-5 connection to the declared target (run->tgt)2026-11-07T18:09:32+00:00 10.73.2.10 POST path=/oauth2/token status=201 route=oauth2-token2026-11-07T18:09:34+00:00 10.73.2.10 POST path=/oauth2/token status=201 route=oauth2-token2026-11-07T18:09:34+00:00 10.73.2.10 GET path=/alerts/queries/alerts/v2 status=200 route=empty-query
Execution · 0 runs no programsnone found: no execve besides the tool itself (tool start host-events.jsonl#L3: python3); harness starts L1, L2 (timeout, start wrapper, preparation) are not counted for the tool
Secrets · 3 reads credential stores
beyond declaredhost-events.jsonl#L5-7 the falcon-mcp process opened /home/tool/.netrc, a canary file planted for this run, three times, matching its three API requests in order and spacing{"ts": "2026-11-07T18:09:31+00:00", "source": "auditd", "key": "cred", "audit_key": "cred", "syscall": "openat", "exe": "/usr/bin/python3.13", "uid": "1001", "pid": "953", "success": "yes", "path": "/home/tool/.netrc"}{"ts": "2026-11-07T18:09:33+00:00", "source": "auditd", "key": "cred", "audit_key": "cred", "syscall": "openat", "exe": "/usr/bin/python3.13", "uid": "1001", "pid": "953", "success": "yes", "path": "/home/tool/.netrc"}{"ts": "2026-11-07T18:09:33+00:00", "source": "auditd", "key": "cred", "audit_key": "cred", "syscall": "openat", "exe": "/usr/bin/python3.13", "uid": "1001", "pid": "953", "success": "yes", "path": "/home/tool/.netrc"}
target-access.txt#L3-5 the three requests to the lab stub (two token requests, one detection query)2026-11-07T18:09:32+00:00 10.73.2.10 POST path=/oauth2/token status=201 route=oauth2-token2026-11-07T18:09:34+00:00 10.73.2.10 POST path=/oauth2/token status=201 route=oauth2-token2026-11-07T18:09:34+00:00 10.73.2.10 GET path=/alerts/queries/alerts/v2 status=200 route=empty-query
Persistence · 0 leaves results onlynone found: no persistence paths in fs-diff.json (outside the lab's churn filter) and no writes to the watched start-up files (auditd persist: shell rc, autostart, systemd --user)
Approval · 0 asks each timenone found: no pre-approvals brought by the tool and no bypass: each of the 2 actions produced an event in the lab approver (2 allowed by the task list, 0 denied; hitl-events.jsonl), 2 executions, all approved; no tool output in session.txt asks for an auto mode or a bypass

Lab verdict

Beyond declared on 1 of 6 rights: secrets (observed 3, declared 1), reading ~/.netrc on every API request.

Beyond static analysis: secrets. The lab saw more than the code analysis suggested.

Fit: partial (our judgement whether the reach fits the task)
Use again: with limits
In one sentence: Did the read-only detection search cleanly through the lab stub, but every API request makes it look up ~/.netrc for credentials, a store it does not declare.
Limits: Measured once against a lab stub of the Falcon API with dummy credentials, read-only and with the detections module only; other modules, write tools, the HTTP transport and real tenant data were not run. The ~/.netrc lookup comes from the requests library under falconpy and happens on every request: run the server under an account whose ~/.netrc has no entry for the Falcon API host. It signs in when it starts, so it offers no tool without working credentials; give the API client only the scopes of the modules you enable.

Tested minimal configuration

claude code: claude -p with model claude-haiku-5-5, MCP server over stdio (falcon: $HOME/.local/falcon-mcp-venv/bin/falcon-mcp --transport stdio --modules detections --read-only); no other tools allowed by the task list

Incidents

0 real-time alerts · run not aborted

Recording

The player loads only on request and needs JavaScript. Without it: session.cast (asciicast v3) and the plain textsession.txt.

Plain-text transcript

[+    0.4s] system ui_invalidate {"event": "ui.render"}
[+    1.0s] system init model=claude-haiku-5-5 permissionMode=dontAsk apiKeySource=none mcp=falcon:connected tools=31 version=2.1.311
[+    2.7s] assistant tool_use mcp__falcon__falcon_check_connectivity id=toolu_013pCT1Va1sT6w9b2DHgznyY input={}
[+    2.7s] assistant tool_use mcp__falcon__falcon_search_detections id=toolu_01BMbpPibGbWBV4L8wXJ2Bor input={"limit": 5}
[+    2.7s] rate_limit_event status=allowed
[+    2.8s] user tool_result id=toolu_013pCT1Va1sT6w9b2DHgznyY error=false: {\n  "connected": true\n}
[+    2.8s] user tool_result id=toolu_01BMbpPibGbWBV4L8wXJ2Bor error=false: {\n  "results": [],\n  "pagination": {\n    "total": 0,\n    "offset": 0,\n    "limit": 10,\n    "next": null\n  }\n}
[+    4.3s] system thinking_tokens {"estimated_tokens": 50, "estimated_tokens_delta": 50}
[+    4.9s] system thinking_tokens {"estimated_tokens": 311, "estimated_tokens_delta": 261}
[+    5.1s] assistant text The connectivity check returned `connected: true`, and the detection search with limit 5 returned zero detections (total 0), though its pagination field reported limit 10.
[+    5.1s] result success is_error=false turns=3 cost_usd=0.00156415 denials=0

Artifacts with SHA-256 (16 files)

blocked.jsonle3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
cost.json87a8bbbc63f32a00dfc8b21891b1ca69f22b8182557ab45cb051461adddfdddd
declared.json514dc83264b95d6b641291a5cf7cb3c6648ae69788749e276ec583597d812fee
dns.jsonl8df9f57358d63be9fcc25fe3305ab9b0aabaa50b46d712b506415bdc4fc01978
egress.jsonlecce924c539c04aab80f164d2cab37e98e048fcd7205a24d231d714d602cc0f2
findings.jsonle3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fs-diff.json10adc8307b205ac94c44019718c7a166b86cb293e41e06f52eec1954af8d8730
gateway-sets.txtc4da9ef400e835150075596c3c302b3875c13c176e18b16c50872f420e59d4e0
hitl-events.jsonl84a1322f23ae10e7a4e90b4ac7d5d5b505d0d2f1f376a658e26a816eeaaef6ba
host-events.jsonlabf1494a8cfd730e9f64cb4e0f8ba8fdbe8df550ec898937bce702c7426ac6e8
install-egress.jsonl67460f8f94e5793a96525e30df0f301f065c78c2daf2c11d4fdd7872e52d2978
score.json769a09e8a18fdead445ec93d5ae30463569d06c3fb668c894dc3844f66a215fb
session.cast76f7dbd8ade95d3c0fa452b1a9d2781646c749c1c37645cf80c6fb242de9fbd9
session.txtca340f273ac75dc926d8ab6d5e40aacf2ff86ee371fcc70c3ef47d39bb2951b1
target-access.txt92ed29a03d85be6306f79ab9f26332289f05dad550cfbc502fe608255bfdd644
tool-cmd.sh1d4a393526c5f38136b2da762b62c7368c0755901b9fd39c0aa7a6974d7db5f2
manifest.jsonlists the hashes above

Secret scan: not run: not installed on the lab host; the scan above instead (2026-11-07); gateway-sets.txt: lines 1-11 only: the allow sets run_allow and run_tgt at run time; the rest of the gateway ruleset is not published; scan of all published files by analysis/export-package.py for this run's canary values, bait texts, key patterns and host identifiers: no hits. Not published: allowlist-driver.txt, allowlist.txt, approver-policy.json, diff/driver.json, diff/gateway.json, diff/runner.json, diff/target.json, dns-servers.txt, pcap/labctl0.pcap, pcap/labrun0.pcap, pcap/labtgt0.pcap, pcap/labwan0.pcap, preflight.json, preflight.log, profile.yaml, proxy-policy.json, raw/allowlist-all.txt, raw/canaries.txt, raw/cred-inventory-after.csv, raw/cred-inventory-before.csv, raw/driver.xml, raw/fs-diff-raw.csv, raw/install-lock.json, raw/install-pip-freeze.txt, raw/install-source-tree.json, raw/mcp_ed25519, raw/mcp_ed25519.pub, raw/model-drive.log, raw/model-in/budget_usd, raw/model-in/max_turns, raw/model-in/mcp.json, raw/model-in/model, raw/model-in/route, raw/model-in/task.txt, raw/model-in/timebox, raw/model/claude-version.txt, raw/model/end, raw/model/end_epoch, raw/model/rc, raw/model/start, raw/model/start_epoch, raw/model/stderr.txt, raw/model/stream.tsjsonl, raw/phase-times.txt, raw/runner-audit.log, raw/runner-tmp-fstype.txt, raw/seed/aws-credentials, raw/seed/netrc, raw/seed/npmrc, raw/session.jsonl, raw/tool-status.json, sensors/dns.log, sensors/egress.flows, sensors/gw-sets.txt, sensors/install-dns.log, sensors/install-fs-diff.json, target-url.txt, task.txt.

Interests. Private project, privately funded. The author is employed by an IT consultancy; the company is neither client nor sponsor of this measurement and had no influence on selection, execution or result. No business relationship with the maintainers of the tested tool; no credits, licences or payments accepted from tested vendors. Deviations are stated in this field.

Right of reply: dispute process. Replications: none yet.

About this entry

Type: MCP server · Defensive · works with Any MCP client, Gemini CLI
Source: github.com/CrowdStrike/falcon-mcp · MIT · manifest server.json
Version readThe install command installs exactly the version we checked (the pinned git commit), so what you get is what the card describes.: 17fea06 · v0.19.0 · last upstream push 2026-10-08 · no release since the pinned commit (current v0.19.0)
In the catalog: tried · added 2026-10-19 · last checked 2026-11-07 · next check 2027-05-06 · fresh
ScannersA scan of the tool's files with a scanner for malicious patterns. “Pending” means it has not run yet.: cisco-skill-scanner: not run, pending
Changes: 1 change to published values, the last on 2026-11-07: see Changes
MethodThe published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.: v0.1 · reach-v0.1 · badge · the rules

Disagree?

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

This entry as Markdown as JSON

How this entry was checked, and how to cite it

Selected by the published criteria (method v0.1). What the author says comes only from author statements; what the code shows comes from the code and manifests at commit 17fea06, each with one evidence line. A “?” means no evidence, never zero; zero never means safe. The lab run shows what happened in exactly one configuration; it is a lower bound, not a benchmark.

The descriptive profile (what it does, can do, how it runs, what it needs) was read through the same isolated pipeline at commit 17fea06 on 2026-10-25: one reader proposed every fact with a quoted line, a script confirmed each quoted line (57 of 57), and a second reader checked each sentence against its lines. Where nothing was found, the page says so instead of assuming “none”.

Known issues and limits: remote server-side behaviour stays “?”; the lab is not your production; static analysis can miss runtime behaviour.

Placement, badges or fast tracks are not for sale. The author is employed by an IT consultancy; the company has no influence on selection, execution or result.

Cite this:

Ilja Schlak. "CrowdStrike Falcon MCP Server". Agentic Security Field Guide, checked 2026-11-07, method reach-v0.1. https://readbeforerun.ai/catalog/crowdstrike-falcon-mcp/

The method · the rules

For maintainers

Badge for your README (reach 3 · beyond declared (1)):

[![reach 3 · beyond declared (1)](https://readbeforerun.ai/badge/crowdstrike-falcon-mcp.svg)](https://readbeforerun.ai/catalog/crowdstrike-falcon-mcp/)