Falcon MCP

Falcon MCP connects your agent to the CrowdStrike Falcon platform through its API. Ask in plain words and it searches detections, looks up hosts, researches threat actors and works through vulnerabilities, cloud findings and identity risk in your own Falcon environment. What you can do with it - Find, count and triage detections by severity, status, host, time range or MITRE ATT&CK technique - Query your hosts by platform, sensor version or containment status - Research threat actors, indicators and intelligence reports, and build MITRE ATT&CK reports - Pull Spotlight vulnerability data, cloud security findings, container images and Kubernetes workloads - Investigate users and entities with Identity Protection - Run CQL queries against Next-Gen SIEM - Manage IOCs, firewall rules, host groups, policies, exclusions and cases, and run read-only Real Time Response triage How it connects It runs on your machine with uvx falcon-mcp (or its Docker image), using an API client you create in the Falcon console under Support > API Clients and Keys. Set FALCON_CLIENT_ID, FALCON_CLIENT_SECRET and FALCON_BASE_URL for your region, as environment variables or in a .env file. It's also a Gemini CLI extension: install it, then copy your .env file into the extension's folder. Choose what it can do - Turn on only the modules you need with --modules (for example detections,hosts,intel); each module needs its own API scopes - --read-only registers only the tools that don't change anything in your tenant - --tools and --exclude-tools allow or withhold single tools - Dynamic mode (--dynamic) swaps the full tool list for three tools that find and run the rest, so your agent loads only what it needs Good to know falcon-mcp is pre-1.0, so tool names and parameters can still change between minor releases; CrowdStrike suggests pinning a version. It's an open-source project maintained by CrowdStrike rather than an official CrowdStrike product, supported through GitHub Issues and, for customers, CrowdStrike Technical Support.

• “Show me new high severity detections from the last 7 days”

  1. falcon_search_detections
  Copy

• “What are the top 10 hosts by alert count this week?”

  1. falcon_aggregate_detections
  Copy

• “Find threat actors targeting financial services”

  1. falcon_search_actors
  Copy

• “Show me open high severity vulnerabilities”