English
Official publisherMCPNewly listed 2026-10-18

CrowdStrike Falcon MCP

by CrowdStrike · CrowdStrike/falcon-mcp

Investigate Falcon detections, hosts, threat intelligence, and other security data through CrowdStrike’s MCP server.

GitHub stars270 · collected 2026-10-18Repository pushedGuide checked2026-10-18

Install from the author’s instructions

Before connecting

Author README · MCP setup

{
  "mcpServers": {
    "falcon-mcp": {
      "command": "uvx",
      "args": [
        "--env-file",
        "/path/to/.env",
        "falcon-mcp",
        "--modules",
        "detections,hosts,intel"
      ]
    }
  }
}

Sources: Author README · Checked 2026-10-18.

Replace the environment-file path. The example selects detections, hosts, and intel; review tool permissions before connecting a production tenant.

Sources: Author README · Checked 2026-10-18.

Tools and capabilities

CapabilityWhat it does
Security investigationQuery detections, host information, and threat intelligence using Falcon modules.
Tool controlsLimit exposed modules and tools, or select the documented read-only mode.

Sources: Author README · Checked 2026-10-18.

Workflow examples

Suggested prompts for your own client. These are examples, not recorded tool executions.

Prompt 1

Review recent detections on a test host and correlate them with threat intelligence, citing the records used.

Prompt 2

Summarize the hosts affected by a detection pattern and draft an investigation checklist without running response actions.

Sources and verification

Publisher-owned documentation and public GitHub metadata reviewed on 2026-10-18. Author installation examples are retained as documented. Prompts are illustrative; no third-party package or MCP was installed or executed, and no account was connected.

Recent activity refers to the repository push timestamp. It does not establish the product’s original release date. Stars are a dated snapshot of the entire repository.

  1. GitHub repository metadataVerified 2026-10-18
  2. Author READMEVerified 2026-10-18

Continue exploring

Related tools and workflows

Choose another guide for your workflow, or explore a collection.

Same category · Developer tools

Socket Security MCP

Inspect dependency risk and package metadata using Socket’s hosted or local MCP server.

MCP

Same category · Developer tools

Sentry

Use Sentry’s remote MCP integration to investigate application errors and related issue context.

MCP

Browse all topic collections → · See 29 new official additions →