Skip to main content
The CrowdStrike Falcon MCP server lets agents query detections, incidents, threat intelligence, hosts, vulnerabilities, and other Falcon modules. It is commonly run as a hosted stdio server with Falcon credentials injected through environment variables.

​
Prerequisites

  • A TrueFoundry account with permission to add MCP servers.
  • A CrowdStrike Falcon subscription with API access.
  • Falcon API client credentials for each user or a shared service account.

​
Create Falcon API Credentials

In Falcon, go to Support > API Clients and Keys, click Add new API client, and select only the API scopes needed by your enabled modules. Copy the Client ID and Client Secret immediately.

​
Register in TrueFoundry

Create a Hosted Stdio-based MCP Server with: Use https://api.crowdstrike.com for US-1, https://api.us-2.crowdstrike.com for US-2, https://api.eu-1.crowdstrike.com for EU-1, and https://api.laggar.gcw.crowdstrike.com for US-GOV. For per-user credentials, set FALCON_CLIENT_ID and FALCON_CLIENT_SECRET as templated env vars and have users add Auth Overrides.

​
Security Notes

Grant only the Falcon scopes required by the modules you expose. CrowdStrike notes that this MCP server is preview software, so validate it carefully before production use.