CrowdStrike Falcon MCP Server

CrowdStrike Falcon MCP Server is a local MCP server: Connects AI agents with CrowdStrike Falcon for security analysis and automation. Install it from pypi as falcon-mcp.

Claude CodeCodexAntigravity

commandprompt

Terminal

claude mcp add falcon-mcp -e FALCON_CLIENT_ID=... -e FALCON_CLIENT_SECRET=... -e FALCON_BASE_URL=... -e FALCON_MEMBER_CID=... -e FALCON_MCP_MODULES=... -e FALCON_MCP_TRANSPORT=... -e FALCON_MCP_DEBUG=... -e FALCON_MCP_HOST=... -e FALCON_MCP_PORT=... -e FALCON_MCP_USER_AGENT_COMMENT=... -e FALCON_MCP_STATELESS_HTTP=... -e FALCON_MCP_API_KEY=... -- uvx falcon-mcp

Run in your project folder. Add --scope user to use it everywhere.

Add to claude_desktop_config.json or .cursor/mcp.json.

{
  "mcpServers": {
    "falcon-mcp": {
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "...",
        "FALCON_CLIENT_SECRET": "...",
        "FALCON_BASE_URL": "...",
        "FALCON_MEMBER_CID": "...",
        "FALCON_MCP_MODULES": "...",
        "FALCON_MCP_TRANSPORT": "...",
        "FALCON_MCP_DEBUG": "...",
        "FALCON_MCP_HOST": "...",
        "FALCON_MCP_PORT": "...",
        "FALCON_MCP_USER_AGENT_COMMENT": "...",
        "FALCON_MCP_STATELESS_HTTP": "...",
        "FALCON_MCP_API_KEY": "..."
      }
    }
  }
}

Fill in the environment variables with your own credentials.

• Runtime: Python with uv (runs with uvx).
• MCP client: Claude Code, Codex, Antigravity, Claude Desktop, Cursor or any other client that speaks MCP over stdio.
• Environment variables: FALCON_CLIENT_ID, FALCON_CLIENT_SECRET, FALCON_BASE_URL, FALCON_MEMBER_CID, FALCON_MCP_MODULES, FALCON_MCP_TRANSPORT, FALCON_MCP_DEBUG, FALCON_MCP_HOST, FALCON_MCP_PORT, FALCON_MCP_USER_AGENT_COMMENT, FALCON_MCP_STATELESS_HTTP, FALCON_MCP_API_KEY