Skip to content
VS Code

CrowdStrike Falcon MCP Server for VS Code

io.github.crowdstrike/falcon-mcp

Connects AI agents with CrowdStrike Falcon for security analysis and automation.

client:VS Code transport:stdio runtime:pypi

Install CrowdStrike Falcon MCP Server in VS Code

.vscode/mcp.json

{
  "inputs": [
    {
      "type": "promptString",
      "id": "falcon-client-id",
      "description": "FALCON_CLIENT_ID",
      "password": true
    },
    {
      "type": "promptString",
      "id": "falcon-client-secret",
      "description": "FALCON_CLIENT_SECRET",
      "password": true
    },
    {
      "type": "promptString",
      "id": "falcon-base-url",
      "description": "FALCON_BASE_URL",
      "password": true
    },
    {
      "type": "promptString",
      "id": "falcon-member-cid",
      "description": "FALCON_MEMBER_CID",
      "password": true
    },
    {
      "type": "promptString",
      "id": "falcon-mcp-modules",
      "description": "FALCON_MCP_MODULES",
      "password": true
    },
    {
      "type": "promptString",
      "id": "falcon-mcp-transport",
      "description": "FALCON_MCP_TRANSPORT",
      "password": true
    },
    {
      "type": "promptString",
      "id": "falcon-mcp-debug",
      "description": "FALCON_MCP_DEBUG",
      "password": true
    },
    {
      "type": "promptString",
      "id": "falcon-mcp-host",
      "description": "FALCON_MCP_HOST",
      "password": true
    },
    {
      "type": "promptString",
      "id": "falcon-mcp-port",
      "description": "FALCON_MCP_PORT",
      "password": true
    },
    {
      "type": "promptString",
      "id": "falcon-mcp-user-agent-comment",
      "description": "FALCON_MCP_USER_AGENT_COMMENT",
      "password": true
    },
    {
      "type": "promptString",
      "id": "falcon-mcp-stateless-http",
      "description": "FALCON_MCP_STATELESS_HTTP",
      "password": true
    },
    {
      "type": "promptString",
      "id": "falcon-mcp-api-key",
      "description": "FALCON_MCP_API_KEY",
      "password": true
    }
  ],
  "servers": {
    "falcon-mcp": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "falcon-mcp"
      ],
      "env": {
        "FALCON_CLIENT_ID": "${input:falcon-client-id}",
        "FALCON_CLIENT_SECRET": "${input:falcon-client-secret}",
        "FALCON_BASE_URL": "${input:falcon-base-url}",
        "FALCON_MEMBER_CID": "${input:falcon-member-cid}",
        "FALCON_MCP_MODULES": "${input:falcon-mcp-modules}",
        "FALCON_MCP_TRANSPORT": "${input:falcon-mcp-transport}",
        "FALCON_MCP_DEBUG": "${input:falcon-mcp-debug}",
        "FALCON_MCP_HOST": "${input:falcon-mcp-host}",
        "FALCON_MCP_PORT": "${input:falcon-mcp-port}",
        "FALCON_MCP_USER_AGENT_COMMENT": "${input:falcon-mcp-user-agent-comment}",
        "FALCON_MCP_STATELESS_HTTP": "${input:falcon-mcp-stateless-http}",
        "FALCON_MCP_API_KEY": "${input:falcon-mcp-api-key}"
      }
    }
  }
}

VS Code prompts for each input the first time the server starts, so no secret is written to the file. VS Code docs

CrowdStrike Falcon MCP Server in other clients