CrowdStrike MCP
Run CrowdStrike Falcon MSP operations from your agent with a Flight-Control-aware local store for fast answers during incidents and tenant reviews.
Overview
CrowdStrike MCP is an Operate-phase MCP server that exposes Falcon MSP operations and Flight-Control-aware local queries to AI agents over stdio.
What is this MCP server?
- CrowdStrike Falcon MSP operations exposed as MCP tools
- Flight-Control-aware local store for agent-friendly lookups
- OAuth via FALCON_CLIENT_ID, FALCON_CLIENT_SECRET, and CROWDSTRIKE_OAUTH_SCOPE
- stdio mcpb release crowdstrike v0.1.0
- Servosity msp-skills crowdstrike packaging
- Server version 0.1.0
- Transport: stdio
- 3 required secret env vars listed: CROWDSTRIKE_OAUTH_SCOPE, FALCON_CLIENT_ID, FALCON_CLIENT_SECRET
Community signal: 1 GitHub stars.
What problem does it solve?
Falcon MSP data is noisy and spread across consoles and APIs, making it hard for an agent to give fast, repeatable answers during multi-tenant security work.
Who is it for?
Solo MSP security leads who manage CrowdStrike Falcon tenants and want agent-assisted triage and fleet reporting.
Skip if: Developers without CrowdStrike Falcon API access or environments that cannot host MCP servers with OAuth secrets.
What do I get? / Deliverables
With Falcon OAuth configured, your agent can use CrowdStrike MCP tools and the local store to respond to MSP security questions with less repeated API churn.
- MCP tools for CrowdStrike Falcon MSP operations
- Flight-Control-synchronized local store for repeat agent queries
- Terminal-driven security ops workflows from Servosity msp-skills
Recommended MCP Servers
Journey fit
Endpoint detection and MSP Falcon workflows are ongoing production security operations, so Operate is the canonical phase even though findings may inform Ship hardening. Monitoring fits continuous Falcon visibility, detection context, and Flight-Control synchronized local queries across many child tenants.
How it compares
CrowdStrike Falcon API MCP layer, not an EDR replacement or passive code-review skill.
Common Questions / FAQ
Who is CrowdStrike MCP for?
It is for MSP operators and security-minded builders who administer CrowdStrike Falcon and want MCP tools plus a Flight-Control-aware local cache for agent queries.
When should I use CrowdStrike MCP?
Use it during incident triage, tenant health reviews, and recurring Falcon reporting when you need consistent MSP-wide answers from Claude Code or Cursor.
How do I add CrowdStrike MCP to my agent?
Install crowdstrike-mcp.mcpb v0.1.0 with stdio transport and set FALCON_CLIENT_ID, FALCON_CLIENT_SECRET, and CROWDSTRIKE_OAUTH_SCOPE in your MCP client secrets.