Falcosidekick UI MCP Server

This folder contains a lightweight Model Context Protocol (MCP) server that exposes the Falcosidekick UI /api/v1/events/search endpoint as a tool. The server uses HTTP Basic Auth (default admin:admin) and runs in streamable HTTP mode so MCP clients can connect over plain HTTP.

Layout

• falco_mcp_server.py – FastMCP implementation exposing Falco events over Falcosidekick UI API via two tools

• requirements.txt – Python dependencies (mcp, httpx, boto3)

• Dockerfile – Container image that launches the server on port 8080

• k8s/ – Deployment and Service manifests to run the server in Kubernetes

Related MCP server: AccuKnox MCP Server

Environment variables

Available tools

When calling either tool you can pass start_time / end_time arguments. Provide timestamps in ISO 8601 UTC form (e.g. 2025-11-24T03:59:59.848208Z). The server converts them to timezone-aware datetimes internally and removes any events that fall outside that window, while still sending since=1M upstream to keep the search bounded.

Local run

cd falco-mcp
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
python3 falco_mcp_server.py

Then configure your MCP client with:

{
  "mcpServers": {
    "falco-events": {
      "type": "http",
      "url": "http://localhost:8080/mcp"
    }
  }
}

Docker

cd falco-mcp
docker build -t falco-mcp .
docker run -p 8080:8080 \
  -e FALCO_BASE_URL=http://falcosidekick-ui.default.svc.cluster.local:2802 \
  -e FALCO_USERNAME=admin \
  -e FALCO_PASSWORD=admin \
  falco-mcp

Kubernetes

The provided manifests assume the Falcosidekick UI is exposed as http://falcosidekick-ui:2802 and that the admin credentials remain admin:admin (see k8s/falco-mcp-deployment.yaml). If your environment uses different credentials or a different service name, edit the env vars before deploying.

kubectl apply -f k8s/falco-mcp-deployment.yaml
kubectl apply -f k8s/falco-mcp-service.yaml