CR
OfficialSecurity

CrowdStrike Falcon MCP Server for AI Threat Analysis

Enable AI security with the CrowdStrike Falcon MCP server for access to detections, incidents, hosts, vulnerabilities, threat intel, and identity protection.

View on GitHub
Quick Install
npx -y @CrowdStrike/falcon-mcp

Overview

The CrowdStrike Falcon MCP Server provides a bridge between Falcon telemetry and AI models by implementing the Model Context Protocol (MCP). It exposes structured, on-demand context derived from detections, incidents, hosts, vulnerabilities, threat intelligence, and identity protection so LLMs and other AI systems can reason with accurate, security-relevant data. The server is intended to be run inside a secure environment (SOC, research lab, or private cloud) and called by model orchestration layers to enrich prompts or to perform tool-like lookups during automated analysis.

For developers, the MCP server simplifies integrating Falcon data into AI workflows: it handles authentication to Falcon APIs, normalizes response shapes, and offers a small set of resource endpoints optimized for contextual retrieval. This reduces prompt engineering overhead and helps AI systems produce more accurate and actionable threat analysis, triage recommendations, and enrichment for alerts.

Features

  • Exposes Falcon telemetry as model-friendly context via the Model Context Protocol
  • Resource categories: detections, incidents, hosts, vulnerabilities, threat intelligence, identity protection
  • On-demand retrieval and optional caching to reduce API load
  • Configurable authorization and access controls for model integrations
  • Docker-friendly for deployment in private cloud or SOC environments
  • Simple HTTP API for easy integration with orchestration frameworks and LLM toolchains

Installation / Configuration

Clone the repository, create a virtual environment, and install dependencies:

git clone https://github.com/CrowdStrike/falcon-mcp.git
cd falcon-mcp

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

Set required environment variables (example names — adapt to your environment):

export FALCON_CLIENT_ID="your_falcon_client_id"
export FALCON_CLIENT_SECRET="your_falcon_client_secret"
export FALCON_CLOUD="us-1"            # or eu-1, us-2, etc.
export MCP_HOST="0.0.0.0"
export MCP_PORT="8080"
export MCP_CACHE_TTL="300"           # optional, cache time in seconds

Start the server locally:

# If the project provides a runner script or entrypoint, use it:
python -m falcon_mcp.server --host "$MCP_HOST" --port "$MCP_PORT"

Docker run example:

docker build -t falcon-mcp:latest .
docker run -e FALCON_CLIENT_ID="$FALCON_CLIENT_ID" \
           -e FALCON_CLIENT_SECRET="$FALCON_CLIENT_SECRET" \
           -e FALCON_CLOUD="$FALCON_CLOUD" \
           -p 8080:8080 \
           falcon-mcp:latest

Docker Compose snippet (example):

version: '3.8'
services:
  falcon-mcp:
    image: falcon-mcp:latest
    environment:
      - FALCON_CLIENT_ID=${FALCON_CLIENT_ID}
      - FALCON_CLIENT_SECRET=${FALCON_CLIENT_SECRET}
      - FALCON_CLOUD=${FALCON_CLOUD}
    ports:
      - "8080:8080"

Security note: Use least-privilege Falcon API credentials, rotate keys regularly, and restrict network access to the MCP server.

Repository: https://github.com/CrowdStrike/falcon-mcp

Available Resources

The MCP server exposes a small set of context resources. Typical resource names and what they provide:

ResourceDescriptionTypical Use
detectionsSummary and details for recent Falcon detectionsEnrich alerts with event timeline and recommended actions
incidentsIncident metadata and associated detectionsProvide incident context and correlation for models
hostsHost inventory, OS, installed apps, sensor statusIdentify affected assets and remediation steps
vulnerabilitiesVulnerability findings and CVE metadataPrioritize patching suggestions and exploitability
threat_intelIOCs, indicators, actor attributionCorrelate detections with known adversaries
identity_protectionIdentity-based alerts and risky sign-insSupport investigation of account compromise scenarios

Example: to request a host context for model enrichment, your orchestration layer would call the MCP server and ask for the “hosts” resource for an identifier (hostname or device ID). The server will return structured fields that are easier for models to consume than raw API dumps.

Use Cases

  1. Automated Triage for SOC Alerts
    • Workflow: Alert enters SIEM → orchestration queries MCP for detection + host + vuln context → LLM synthesizes recommended actions and creates ticket.
    • Example (simplified curl):
curl -sS -X POST "http://localhost:8080/context" \
  -H "Content-Type: application/json" \
  -d '{"model":"llm-v1","resources":["detections","hosts"],"query":{"detection_id":"abcd-1234"}}'

  1. Enrich ChatOps Responses

    • Use MCP to backstop chat-based analyst queries (e.g., “What happened to host X?”). A bot calls MCP, formats the structured output, and presents concise findings.

  2. Threat Hunting with LLM Assistance

    • Hunters request correlated intel and host telemetry across time windows. MCP returns normalized telemetry slices that models can synthesize into hypothesis-driven hunt narratives.

  3. Vulnerability Prioritization

    • Combine vulnerability data with host exposure and detection activity to prioritize remediation. MCP provides the combined context for risk-scoring models
Tags:security