CrowdStrike Falcon MCP Server

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

claude mcp add falcon-mcp -e 'FALCON_CLIENT_ID=<FALCON_CLIENT_ID>' -e 'FALCON_CLIENT_SECRET=<FALCON_CLIENT_SECRET>' -- uvx falcon-mcp

{
  "mcpServers": {
    "falcon-mcp": {
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<FALCON_CLIENT_SECRET>"
      }
    }
  }
}

[mcp_servers.falcon-mcp]
command = "uvx"
args = ["falcon-mcp"]
env = { FALCON_CLIENT_ID = "<FALCON_CLIENT_ID>", FALCON_CLIENT_SECRET = "<FALCON_CLIENT_SECRET>" }

{
  "mcpServers": {
    "falcon-mcp": {
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<FALCON_CLIENT_SECRET>"
      }
    }
  }
}

{
  "servers": {
    "falcon-mcp": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "<FALCON_CLIENT_ID>",
        "FALCON_CLIENT_SECRET": "<FALCON_CLIENT_SECRET>"
      }
    }
  }
}

Put your own values in place of <FALCON_CLIENT_ID> (CrowdStrike API client ID), <FALCON_CLIENT_SECRET> (CrowdStrike API client secret). The author’s registry entry marks them as required.

Optional settings from the registry entry, left out of the block above: FALCON_BASE_URL (CrowdStrike API region URL), FALCON_MEMBER_CID (Child CID for Flight Control (MSSP) support), FALCON_MCP_MODULES (Comma-separated list of modules to enable), FALCON_MCP_TRANSPORT (Transport protocol to use), FALCON_MCP_DEBUG (Enable debug logging), FALCON_MCP_HOST (Host to bind to for HTTP transports), FALCON_MCP_PORT (Port to listen on for HTTP transports), FALCON_MCP_USER_AGENT_COMMENT (Additional information to include in the User-Agent comment section), FALCON_MCP_STATELESS_HTTP (Enable stateless HTTP mode for scalable deployments), FALCON_MCP_API_KEY (API key for HTTP transport authentication (x-api-key header)).