# Falcon MCP > CrowdStrike's local MCP server for Falcon: your agent triages detections, looks up hosts and threat intel, and runs Next-Gen SIEM searches. Falcon MCP connects your agent to the CrowdStrike Falcon platform through its API. Ask in plain words and it searches detections, looks up hosts, researches threat actors and works through vulnerabilities, cloud findings and identity risk in your own Falcon environment. What you can do with it - Find, count and triage detections by severity, status, host, time range or MITRE ATT&CK technique - Query your hosts by platform, sensor version or containment status - Research threat actors, indicators and intelligence reports, and build MITRE ATT&CK reports - Pull Spotlight vulnerability data, cloud security findings, container images and Kubernetes workloads - Investigate users and entities with Identity Protection - Run CQL queries against Next-Gen SIEM - Manage IOCs, firewall rules, host groups, policies, exclusions and cases, and run read-only Real Time Response triage How it connects It runs on your machine with uvx falcon-mcp (or its Docker image), using an API client you create in the Falcon console under Support > API Clients and Keys. Set FALCON_CLIENT_ID, FALCON_CLIENT_SECRET and FALCON_BASE_URL for your region, as environment variables or in a .env file. It's also a Gemini CLI extension: install it, then copy your .env file into the extension's folder. Choose what it can do - Turn on only the modules you need with --modules (for example detections,hosts,intel); each module needs its own API scopes - --read-only registers only the tools that don't change anything in your tenant - --tools and --exclude-tools allow or withhold single tools - Dynamic mode (--dynamic) swaps the full tool list for three tools that find and run the rest, so your agent loads only what it needs Good to know falcon-mcp is pre-1.0, so tool names and parameters can still change between minor releases; CrowdStrike suggests pinning a version. It's an open-source project maintained by CrowdStrike rather than an official CrowdStrike product, supported through GitHub Issues and, for customers, CrowdStrike Technical Support. - Type: Plugin - Made by: crowdstrike - Category: Security - Formats: Local MCP, Extensions - Version: 0.19.0 - Website: https://developer.crowdstrike.com/falcon-mcp/ - Source: https://github.com/crowdstrike/falcon-mcp - Page: https://pluginboard.ai/plugins/falcon-mcp ## Works with - Claude - GitHub Copilot - Cursor - Claude Code - Codex - Antigravity - Gemini CLI - OpenClaw - OpenCode - Hermes Agent ## Install You'll need: - `FALCON_CLIENT_ID` (required): CrowdStrike API client ID - `FALCON_CLIENT_SECRET` (required): CrowdStrike API client secret - `FALCON_BASE_URL` (optional): CrowdStrike API region URL - `FALCON_MEMBER_CID` (optional): Child CID for Flight Control (MSSP) support - `FALCON_MCP_MODULES` (optional): Comma-separated list of modules to enable - `FALCON_MCP_TRANSPORT` (optional): Transport protocol to use - `FALCON_MCP_DEBUG` (optional): Enable debug logging - `FALCON_MCP_HOST` (optional): Host to bind to for HTTP transports - `FALCON_MCP_PORT` (optional): Port to listen on for HTTP transports - `FALCON_MCP_USER_AGENT_COMMENT` (optional): Additional information to include in the User-Agent comment section - `FALCON_MCP_STATELESS_HTTP` (optional): Enable stateless HTTP mode for scalable deployments - `FALCON_MCP_API_KEY` (optional): API key for HTTP transport authentication (x-api-key header) Replace each `` placeholder with your own value. ### Claude Add to claude_desktop_config.json: ```json { "mcpServers": { "falcon-mcp": { "command": "uvx", "args": [ "falcon-mcp==0.20.0" ], "env": { "FALCON_CLIENT_ID": "", "FALCON_CLIENT_SECRET": "" } } } } ``` ### GitHub Copilot Add to VS Code: vscode:mcp/install?%7B%22name%22%3A%22falcon-mcp%22%2C%22command%22%3A%22uvx%22%2C%22args%22%3A%5B%22falcon-mcp%3D%3D0.20.0%22%5D%2C%22env%22%3A%7B%22FALCON_CLIENT_ID%22%3A%22%3CFALCON_CLIENT_ID%3E%22%2C%22FALCON_CLIENT_SECRET%22%3A%22%3CFALCON_CLIENT_SECRET%3E%22%7D%7D Run in your terminal: ```shell code --add-mcp '{"name":"falcon-mcp","command":"uvx","args":["falcon-mcp==0.20.0"],"env":{"FALCON_CLIENT_ID":"","FALCON_CLIENT_SECRET":""}}' ``` Copilot CLI: ```shell copilot mcp add falcon-mcp --env FALCON_CLIENT_ID= --env FALCON_CLIENT_SECRET= -- uvx falcon-mcp==0.20.0 ``` ### Cursor Add to Cursor: cursor://anysphere.cursor-deeplink/mcp/install?name=falcon-mcp&config=eyJjb21tYW5kIjoidXZ4IiwiYXJncyI6WyJmYWxjb24tbWNwPT0wLjIwLjAiXSwiZW52Ijp7IkZBTENPTl9DTElFTlRfSUQiOiI8RkFMQ09OX0NMSUVOVF9JRD4iLCJGQUxDT05fQ0xJRU5UX1NFQ1JFVCI6IjxGQUxDT05fQ0xJRU5UX1NFQ1JFVD4ifX0%3D Add to .cursor/mcp.json: ```json { "mcpServers": { "falcon-mcp": { "command": "uvx", "args": [ "falcon-mcp==0.20.0" ], "env": { "FALCON_CLIENT_ID": "", "FALCON_CLIENT_SECRET": "" } } } } ``` ### Claude Code Run in your terminal: ```shell claude mcp add -e FALCON_CLIENT_ID= -e FALCON_CLIENT_SECRET= falcon-mcp -- uvx falcon-mcp==0.20.0 ``` ### Codex Run in your terminal: ```shell codex mcp add --env FALCON_CLIENT_ID= --env FALCON_CLIENT_SECRET= falcon-mcp -- uvx falcon-mcp==0.20.0 ``` ### Antigravity Add to ~/.gemini/config/mcp_config.json: ```json { "mcpServers": { "falcon-mcp": { "command": "uvx", "args": [ "falcon-mcp==0.20.0" ], "env": { "FALCON_CLIENT_ID": "", "FALCON_CLIENT_SECRET": "" } } } } ``` ### Gemini CLI Run in your terminal: ```shell gemini extensions install https://github.com/CrowdStrike/falcon-mcp ``` ### OpenClaw In a terminal: Run openclaw mcp add falcon-mcp --command uvx, with --arg before each argument (falcon-mcp==0.20.0) and --env NAME=value for each variable it needs. ### OpenCode Run in your terminal: ```shell opencode mcp add falcon-mcp --env FALCON_CLIENT_ID= --env FALCON_CLIENT_SECRET= -- uvx falcon-mcp==0.20.0 ``` ### Hermes Agent Add to ~/.hermes/config.yaml: ```json { "mcp_servers": { "falcon-mcp": { "command": "uvx", "args": [ "falcon-mcp==0.20.0" ], "env": { "FALCON_CLIENT_ID": "", "FALCON_CLIENT_SECRET": "" } } } } ``` --- From Pluginboard (https://pluginboard.ai).