CrowdStrike Falcon MCP Server

How to start

1. Run the command in your terminal, in the project where you want it.
2. Set FALCON_CLIENT_ID, FALCON_CLIENT_SECRET with --env or in your shell.
3. Check it: run /mcp in Claude Code and look for it in the list.

What it needs

• FALCON_CLIENT_IDRequired. Secret: keep it out of your repo. CrowdStrike API client ID
• FALCON_CLIENT_SECRETRequired. Secret: keep it out of your repo. CrowdStrike API client secret
• FALCON_BASE_URLOptional. CrowdStrike API region URL
• FALCON_MEMBER_CIDOptional. Child CID for Flight Control (MSSP) support
• FALCON_MCP_MODULESOptional. Comma-separated list of modules to enable
• FALCON_MCP_TRANSPORTOptional. Transport protocol to use
• FALCON_MCP_DEBUGOptional. Enable debug logging
• FALCON_MCP_HOSTOptional. Host to bind to for HTTP transports
• FALCON_MCP_PORTOptional. Port to listen on for HTTP transports
• FALCON_MCP_USER_AGENT_COMMENTOptional. Additional information to include in the User-Agent comment section
• FALCON_MCP_STATELESS_HTTPOptional. Enable stateless HTTP mode for scalable deployments
• FALCON_MCP_API_KEYOptional. Secret: keep it out of your repo. API key for HTTP transport authentication (x-api-key header)

Environment variables as listed in the server's MCP Registry entry.