CrowdStrike Falcon

You run a dual-transport MCP server that bridges the CrowdStrike Falcon API to MCP clients. It exposes both STDIO (MCP protocol) for MCP-aware tools and HTTP/REST for broader interoperability, while handling credentials securely and supporting multi-tenant setups when needed.

How to use

You can connect with MCP clients using either STDIO or HTTP. For standard MCP clients, start the local server in a way that keeps STDIO available on port 8080 and HTTP on port 80. Use the STDIO path when your client speaks the MCP protocol directly, and use the HTTP path when your client makes REST-like calls to the exposed endpoints. In both modes, you provide your CrowdStrike API key (and optional tenant) to authorize requests. You can switch between transports or run both simultaneously depending on your client needs.

How to install

docker pull <your-registry>/crowdstrike-falcon-mcp:latest
docker run -d \
  --name crowdstrike-falcon-mcp \
  --publish 8080:8080 \
  --publish 80:80 \
  -e TRANSPORT_MODE=dual \
  -e FALCON_API_KEY=your_api_key_here \
  <your-registry>/crowdstrike-falcon-mcp:latest

Note: The example runs the MCP server in Docker with both STDIO and HTTP enabled. Replace <your-registry> and your_api_key_here with your actual registry path and CrowdStrike API key.

## Configuration

Environment variables configure access and transport behavior. You can pass credentials via environment or per-call parameters. Common variables include the CrowdStrike API key, optional tenant ID, and the API base URL. Transport mode can be stdio, http, or dual to enable both paths. Ports for HTTP and STDIO are 80 and 8080 by default.

Environment variables shown in examples include:
- FALCON\_API\_KEY: Your CrowdStrike API key
- FALCON\_TENANT\_ID: Optional multi-tenant identifier
- FALCON\_API\_BASE\_URL: API base URL (default: https://api.crowdstrike.com)
- TRANSPORT\_MODE: Segment transport mode (stdio, http, or dual)
- HTTP\_PORT: HTTP server port (default: 80)
- STDIO\_PORT: STDIO port (default: 8080)

## Security and deployment notes

Security is important when deploying in production. Ensure you use HTTPS in front of the HTTP endpoint, rotate API keys regularly, and monitor access logs. Treat API keys as secrets and avoid embedding them in client configurations or code. If you expose both transports, implement appropriate rate limiting and auditing for both paths.

Health checks should be monitored via the /healthz endpoint on the HTTP path, and you should monitor for failed health checks, API errors, and rate limits. When scaling, consider a load balancer for HTTP requests and clustering for STDIO clients where applicable.

## Troubleshooting

Health check failing: verify the server is running and the container is healthy. Check logs for startup messages and errors. Authentication errors: confirm your API key is correct, has the required scopes, and is formatted properly.

Connection issues: ensure ports are exposed correctly and the TRANSPORT\_MODE matches your use case. If you encounter environment variable issues, double-check that keys are set in the container or your host environment as appropriate.

## Tools and endpoints overview

This MCP server provides endpoints and tools for managing hosts, detections, IOCs, host groups, and policies. You can perform queries, retrieve details, and update states across hosts, detections, IOCs, policy details, and sensor update policies.

## Available tools

### Hosts

Query hosts and retrieve host details using the HTTP API or STDIO calls.

### Detections

Query detections, get details, and update detection status via API calls.

### IOCs

Create, query, and delete indicators of compromise.

### Host Groups

Query and detail host groups.

### Policies

Query and detail prevention and sensor update policies.