CrowdStrike Falcon MCP

What it does

Falcon MCP provides AI agents with programmatic access to the CrowdStrike Falcon platform, allowing for automated security operations, threat intelligence research, and host management within agentic workflows.

Tools

• Detections: Analyze malicious activity and security alerts.
• Intel: Research threat actors, IOCs, and intelligence reports.
• Host Management: Query and manage device information and host groups.
• Cloud Security: Inspect Kubernetes containers and image vulnerabilities.
• NG-SIEM: Execute CQL queries for advanced security searching.

Installation

Add the following to your claude_desktop_config.json:

{
  "mcpServers": {
    "falcon-mcp": {
      "command": "uvx",
      "args": [
        "--env-file",
        "/path/to/.env",
        "falcon-mcp"
      ]
    }
  }
}

Supported hosts

Supported on any MCP-compatible client including Claude Desktop and Cursor.