CrowdStrike Falcon MCP Server - SOC Automation
CrowdStrike's official Falcon MCP server connects AI assistants and agents to the CrowdStrike Falcon platform. Use it for security operations workflows such as investigating detections, triaging incidents, querying hosts, researching adversaries, analyzing vulnerabilities, and automating approved Falcon actions.
Overview
CrowdStrike Falcon MCP Server is the official Model Context Protocol server for
connecting AI agents to the CrowdStrike Falcon platform. It gives security
teams a governed way to bring Falcon telemetry and actions into MCP-compatible
IDEs, assistants, and agent workflows without building a custom connector for
every Falcon API use case.
What the MCP server enables
Falcon MCP is modular. Administrators can enable all modules or limit the tool
surface with module selection to reduce tool count and scope. Documented
capabilities include tools for:
- Detections, alerts, incidents, and behavioral investigation.
- Host search, host management, and sensor usage analysis.
- Threat intelligence, indicators, adversary research, and IOCs.
- Spotlight vulnerability analysis and security assessment workflows.
- Cloud, serverless, identity-protection, and SaaS posture modules where
available in the Falcon environment. - Policies, including prevention, sensor update, firewall, device control,
response, content update policies, host-group assignment, precedence, and
enable or disable operations. - Quarantine search and file release, unrelease, or delete workflows.
- Real Time Response auditing, summaries, and read-only triage workflows.
- Scheduled report management and report-file downloads.
When to use it
Use CrowdStrike Falcon MCP when an AI security workflow needs current Falcon
context or authorized Falcon operations. Practical examples include asking an
agent to summarize active detections, inspect host context for an incident,
research indicators from a case, prioritize vulnerabilities from Spotlight,
review quarantine status, analyze sensor coverage, or prepare a natural-language
incident summary for a SOC analyst.
Connection and authentication
Falcon MCP requires Falcon API credentials. Create an API client in the
CrowdStrike console and configure FALCON_CLIENT_ID, FALCON_CLIENT_SECRET,
and FALCON_BASE_URL. CrowdStrike's quickstart notes that a minimal first
setup can enable Hosts read and Alerts read, while additional modules require
their own API scopes.
For local MCP clients, use stdio with uvx falcon-mcp or an installed
falcon-mcp command. Docker deployments use
quay.io/crowdstrike/falcon-mcp:latest. The server also supports SSE and
Streamable HTTP. For remote HTTP operation, start the server with
--transport streamable-http --host 0.0.0.0; the MCP endpoint is exposed at
/mcp on the configured host and port. Remote endpoints can be protected with
--api-key and the x-api-key request header.
Key considerations
Falcon MCP can expose sensitive security telemetry and, depending on enabled
modules and scopes, can perform state-changing operations. Use the smallest set
of modules and Falcon API scopes required for the workflow. Protect remote
transports with network controls and API-key authentication, and prefer local
stdio for analyst workstations where appropriate. Require human review before
destructive or response-oriented actions such as policy changes, quarantine
changes, or incident-response workflows. Store Falcon credentials in
environment variables, protected .env files, or a secret manager, not in
committed MCP configuration.
Supported Transports
stdio
Command: uvx
Args:
--env-file${FALCON_ENV_FILE}falcon-mcp
stdio
Command: docker
Args:
run-i--rm--env-file${FALCON_ENV_FILE}quay.io/crowdstrike/falcon-mcp:latest
streamable_http
URL: http://${FALCON_MCP_HOST}:${FALCON_MCP_PORT}/mcp
sse
URL: http://${FALCON_MCP_HOST}:${FALCON_MCP_PORT}/sse
Frequently Asked Questions
- When should an AI agent use the CrowdStrike Falcon MCP server?
- Use it when an agent needs Falcon security context or approved Falcon operations, such as triaging detections, investigating incidents, querying hosts, researching adversaries, reviewing IOCs, analyzing vulnerabilities, checking quarantine records, or preparing SOC summaries.
- What does the CrowdStrike Falcon MCP server add to an AI agent's capabilities?
- It gives the agent structured access to CrowdStrike Falcon modules and APIs, including detections, incidents, hosts, threat intelligence, Spotlight vulnerabilities, policies, quarantine workflows, scheduled reports, sensor usage, and other enabled security-operations tools.
- What can an AI agent access or manage through Falcon MCP?
- Access depends on enabled modules and Falcon API scopes. The agent can work with detections, alerts, incidents, hosts, intel, IOCs, vulnerabilities, policies, quarantined files, Real Time Response triage data, reports, sensor usage, and supported cloud, identity, serverless, and SaaS posture modules where licensed and configured.
- How is authentication configured for CrowdStrike Falcon MCP?
- Configure a Falcon API client in the CrowdStrike console, then provide FALCON_CLIENT_ID, FALCON_CLIENT_SECRET, and FALCON_BASE_URL. Grant only the API scopes needed by the enabled modules. Remote HTTP deployments can also require an MCP-level x-api-key header when started with --api-key.
- Which transport should be used for CrowdStrike Falcon MCP?
- Use stdio with `uvx falcon-mcp` for local analyst or IDE use. Use the Docker stdio image for containerized local deployment. Use Streamable HTTP at `/mcp` for remote deployments, protected with network controls and x-api-key when configured. Use SSE only for clients that still require it.