Description
CrowdStrike Falcon MCP server that provides AI assistants with direct access to CrowdStrike's cybersecurity platform through comprehensive modules covering detections, incidents, threat intelligence, host management, vulnerability scanning, cloud security, identity protection, and sensor usage analytics. Built by CrowdStrike's cloud integrations team, the implementation uses the FalconPy SDK with proper API scope management and error handling, supporting multiple transport methods (stdio, SSE, streamable-http) and featuring modular architecture with FQL query guides, retry logic for E2E testing, and Docker deployment options. Designed for security operations teams, threat hunters, and incident responders who need conversational access to their CrowdStrike environment for tasks like investigating security alerts, analyzing threat intelligence, managing endpoints, and generating security reports without switching between multiple interfaces.
🔬 Playground
Try CrowdStrike Falcon live in the browser with security context.
Installation
npx -y falcon-mcpnpm install falcon-mcpgit clone https://github.com/crowdstrike/falcon-mcpClaude Desktop Configuration
Add this configuration to your Claude Desktop config file to enable this MCP server:
Config file location: ~/Library/Application Support/Claude/claude_desktop_config.json
Config file location: %APPDATA%\Claude\claude_desktop_config.json
Config file location: ~/.config/Claude/claude_desktop_config.json
{
"mcpServers": {
"crowdstrike-falcon": {
"command": "npx",
"args": [
"-y",
"falcon-mcp"
]
}
}
}Community Reviews
Authenticated reviews from GitHub users. No anonymous submissions. Your experience helps others choose wisely.
No reviews yet. Be the first to share your experience.