CrowdStrike Falcon Logo

CrowdStrike Falcon

Official

Connect with the CrowdStrike Falcon platform for intelligent security analysis, providing programmat...

93 views
2 installs
Updated Oct 3, 2025
Not audited
Connect with the CrowdStrike Falcon platform for intelligent security analysis, providing programmatic access to detections, incidents, behaviors, threat intelligence, hosts, vulnerabilities, and identity protection capabilities.
  1. Log into your CrowdStrike Console

    • Open your browser and log in to your organization's CrowdStrike Falcon console.
  2. Navigate to API Credentials

    • Click on "Support" in the console's menu.
    • Select "API Clients and Keys" from the dropdown.
  3. Create a New API Client

    • Click the "Add new API client" button.
    • Enter a descriptive name for the client (for example, "Falcon MCP Server").
    • Optionally, provide a description for your records.
  4. Assign API Scopes

    • Select the required API scopes according to the modules you wish to use (for example, Detections: Alerts:read, Incidents:read, etc. Refer to the "Required API Scopes by Module" table in the README for details).
  5. Save and Copy Credentials

    • After creating the API client, the console will display:
      • Client ID
      • Client Secret
    • Copy these values immediately, as the Client Secret will only be shown once.
  6. Determine Your API Base URL

    • Typically, use https://api.crowdstrike.com.
    • For other regions, use the corresponding base URL (e.g., https://api.us-2.crowdstrike.com, https://api.eu-1.crowdstrike.com).
  7. Enter Credentials in the FastMCP Connection Interface

    • When prompted by the FastMCP "Install Now" button or connection interface, fill in the following ENV values:
      • FALCON_CLIENT_ID - Paste the Client ID you copied from step 5.
      • FALCON_CLIENT_SECRET - Paste the Client Secret you copied from step 5.
      • FALCON_BASE_URL - Enter your CrowdStrike region's base URL.
  8. Complete Installation

    • Submit or save the configuration as required by the FastMCP interface.
    • The integration should now be enabled and ready to use with the specified CrowdStrike modules.

Summary of Required Environment Variables:

FALCON_CLIENT_ID=<your-client-id>
FALCON_CLIENT_SECRET=<your-client-secret>
FALCON_BASE_URL=https://api.crowdstrike.com  # Or your specific region's URL

Quick Start

View on GitHub

More for Security

View All →

Report Issue

Thank you! Your issue report has been submitted successfully.