LocalFree server, account needed

CrowdStrike Falcon MCP server

CrowdStrike/falcon-mcp

Connects AI agents with CrowdStrike Falcon for security analysis and automation.

274 GitHub stars96 forks
Source code

Install CrowdStrike Falcon in Claude Code

Claude Code
claude mcp add crowdstrike-falcon -e FALCON_CLIENT_ID=... -e FALCON_CLIENT_SECRET=... -- uvx falcon-mcp
mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)
{
  "mcpServers": {
    "crowdstrike-falcon": {
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "...",
        "FALCON_CLIENT_SECRET": "..."
      }
    }
  }
}

Replace each ... with your own value.

Frequently asked questions

What does the CrowdStrike Falcon MCP server do?

Connects AI agents with CrowdStrike Falcon for security analysis and automation.

Is the CrowdStrike Falcon MCP server free?

The server is free, but you will likely need an account. The server itself is free, but it connects to a service that needs an account or API key, which may have paid tiers. Check the provider for current pricing.

Does CrowdStrike Falcon run locally or remotely?

Local. Runs on your machine (stdio). You install it with npx, uvx, Docker or from source.

How do I add CrowdStrike Falcon to Claude Code?

Run: claude mcp add crowdstrike-falcon -e FALCON_CLIENT_ID=... -e FALCON_CLIENT_SECRET=... -- uvx falcon-mcp

More security & identity MCP servers

View all

OpenWorkProof

262

dengyier/OpenWorkProof

Verifiable execution protocol for agent tool calls: signed policy decisions, causal evidence chains and offline verification from a SQLite ledger.

LocalFreePython

Vibe Prospecting

287

explorium-ai/vibeprospecting-mcp

B2B company and contact data for lead lists, enrichment, research, and outreach. OAuth sign-in.

RemoteAccount needed

EchelonGraph CVE & Exposure

87k

echelongraph/echelongraph-mcp

Keyless, read-only CVE and internet-exposure intelligence: CVE lookup and search, CISA KEV, EPSS history, CWE, vendor advisories (MSRC, Red Hat, Cisco, GHSA and more), SBOM and manifest checks, and aggregate exposure radars. Use the hosted endpoint (mcp.echelongraph.io) with no install, or run locally with npx.

Local + RemoteAccount neededTypeScript

squirrelscan

301

squirrelscan/squirrelscan

Website QA for your coding agent: audit SEO, performance, security, accessibility over MCP.

RemoteAccount needed

Wazuh

240

gbrigandi/mcp-server-wazuh

Access real-time security alerts and event data from Wazuh SIEM.

LocalFreeRust

DashClaw

314

ucsandman/DashClaw

Fail-closed approval layer for unattended agent runs: checks actions against org policy, requests human approval and logs every decision to a causal ledger.

LocalAccount neededTypeScript