CrowdStrike Falcon MCP Server

The Falcon MCP provides access to various security domains through specialized modules. You can use these modules to perform the following tasks via an AI assistant:

• Investigate Threats: Search detections by severity, time range, hostname, or MITRE ATT&CK technique.
• Query Your Fleet: Find hosts by platform, sensor version, network segment, or containment status.
• Hunt Vulnerabilities: Pull Spotlight CVE data with ExPRT ratings and remediation priorities.
• Research Adversaries: Look up threat actors, indicators, and intelligence reports.
• Monitor Cloud Posture: Search CSPM assets, container images, and Kubernetes workloads.
• Assess Identity Risk: Investigate entities, analyze timelines, and map relationships.
• Execute CQL Queries: Run searches against CrowdStrike Next-Gen SIEM.
• Manage IOCs: Search, create, and remove custom indicators of compromise.
• Audit Firewall Rules: Search and manage Falcon firewall rule groups.

Additional capabilities include Real Time Response, Scheduled Reports, and Shield.

You can narrow the available tools using three primary methods. Note that --tools is additive (it adds tools on top of enabled modules), while --exclude-tools and --read-only are subtractive (they act as a floor that cannot be bypassed).

Resolution Order

When multiple restriction flags are used, they resolve in this order:

1. --exclude-tools: Removes a tool unconditionally.
2. --read-only: Removes all mutating tools unconditionally.
3. --tools: Adds specific tools (can bypass module gates, but cannot bypass --exclude-tools or --read-only).
4. --modules: Determines the default candidate tools.

Common Scenarios

• Investigation-only: Use --read-only to disable all mutating tools.
• Strict Allow-list: Use --tools with specific names (e.g., falcon_search_detections). If used alone, no modules are loaded.
• Hybrid approach: Use --modules to enable a set, then --exclude-tools to remove a specific dangerous tool from that module.

Note: Tool names are prefixed with falcon_. Typos in --exclude-tools will cause the server to abort startup rather than silently failing.

```bash
# Investigation-only server
falcon-mcp --read-only

# Expose exactly two tools, nothing else
falcon-mcp --tools falcon_search_detections,falcon_search_hosts

# Keep the module, drop one tool
falcon-mcp --modules hostgroups --exclude-tools falcon_delete_host_groups

# All of detections, plus one tool from a module you did not enable
falcon-mcp --modules detections --tools falcon_search_applications
```埋

The documentation for Python modules is automatically generated from the source code in falcon_mcp/modules/ using the scripts/generate_module_docs.py script.

Important: Files in docs/modules/ are auto-generated and will be overwritten on every build. Do not edit them manually.

Automatic Extraction Logic

• Module Pages: One page is created per module containing API scopes, tools (with docstrings, scopes, and annotations), and resources.
• Module Overview: A summary table is generated at docs/modules/overview.md.
• Title/Description Derivation: The generator extracts the title from the first line of the module docstring (stripping module for Falcon MCP Server.) and the description from the first sentence of the second paragraph (stripping This module provides tools for ...).

Customizing Module Metadata

To override the automatic title, slug, or description, add an entry to the MODULE_METADATA dictionary in scripts/generate_module_docs.py:

MODULE_METADATA: dict[str, dict[str, Any]] = {
    "mymodule": {
        "title": "My Custom Title",      # optional
        "slug": "my-module",             # optional (defaults to module key)
        "description": "Custom desc.",   # optional (defaults to docstring-derived)
    },
}

Adding Tool Examples

To provide example prompts for a specific tool, add entries to the TOOL_EXAMPLES dictionary in scripts/generate_module_docs.py:

TOOL_EXAMPLES: dict[str, list[str]] = {
    "falcon_my_tool": [
        "Example prompt for the tool",
    ],
}

To improve tool usability, explicitly reference your resources within tool definitions. This is done by:

1. Including the resource URI in the parameter description.
2. Mentioning the resource in the tool's docstring.

This allows the model to know exactly which documentation to consult when constructing arguments for a tool call.

def query_actor_entities(
    self,
    filter: str | None = Field(
        default=None,
        description="FQL filter expression. See `falcon://intel/actors/fql-guide` for syntax.",
    ),
    # Other parameters...
) -> list[dict[str, Any]]:
    """Research threat actors and adversary groups tracked by CrowdStrike intelligence.

    Use this to search actors by name, target countries/industries, or activity dates.
    Consult falcon://intel/actors/fql-guide before constructing filter expressions.
    Returns full actor profiles including aliases, motivations, and targeting details.
    """
    # Method implementation...