Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| FALCON_BASE_URL | Yes | CrowdStrike Falcon API Region URL (e.g., https://api.crowdstrike.com). | https://api.crowdstrike.com |
| FALCON_MCP_HOST | No | Host for HTTP transports. | 127.0.0.1 |
| FALCON_MCP_PORT | No | Port for HTTP transports. | 8000 |
| FALCON_CLIENT_ID | Yes | Your CrowdStrike Falcon API Client ID. | |
| FALCON_MCP_DEBUG | No | Enable debug logging: true or false. | false |
| FALCON_MCP_MODULES | No | Comma-separated list of modules to enable (e.g., detections,incidents,intel). If none specified, all available modules are enabled. | |
| FALCON_CLIENT_SECRET | Yes | Your CrowdStrike Falcon API Client Secret. | |
| FALCON_MCP_TRANSPORT | No | Transport method: stdio, sse, or streamable-http. | stdio |
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |