Set up the CrowdStrike Falcon MCP server

The CrowdStrike Falcon MCP server connects AI agents to the Falcon platform for security operations — querying detections, threat intelligence, host inventory, vulnerabilities, real-time response, and more. This guide covers creating a Falcon API client with the right scopes and adding it to MintMCP using the Advanced hosted connector setup with per-user credentials.

Prerequisites

• A MintMCP admin account
• A CrowdStrike Falcon subscription with API access

Create a Falcon API client

Because FALCON_CLIENT_ID and FALCON_CLIENT_SECRET are per-user credentials, each team member needs to create their own Falcon API client. Share these steps with your team.

1. Go to falcon.crowdstrike.com and sign in.

2. Navigate to Support > API Clients and Keys.

3. Click Add new API client.

4. Enter a name (e.g., "MintMCP Falcon") and an optional description.

5. Select scopes under API scopes based on the modules you want to enable. The table below maps each module to its required scopes; CrowdStrike's Module Overview has the authoritative, current list.

Module	Required API scopes
Core	Basic connectivity and system info — no additional scopes
Case Management	Case Templates:read, Cases:read, Cases:write
Cloud Security	Cloud Security API Assets:read, Cloud Security API Detections:read, Cloud Security Policies:read, Cloud Security Policies:write, Falcon Container Image:read
Correlation Rules	Correlation Rules:read, Correlation Rules:write
Custom IOA	Custom IOA Rules:read, Custom IOA Rules:write
Data Protection	Data Protection:read
Detections	Alerts:read, Alerts:write
Discover	Assets:read
Exclusions	IOA Exclusions:read, IOA Exclusions:write, Machine Learning Exclusions:read, Machine Learning Exclusions:write, Sensor Visibility Exclusions:read, Sensor Visibility Exclusions:write
Firewall Management	Firewall Management:read, Firewall Management:write
Host Groups	Host Groups:read, Host Groups:write
Hosts	Hosts:read
Identity Protection	Identity Protection Assessment:read, Identity Protection Detections:read, Identity Protection Entities:read, Identity Protection Timeline:read, Identity Protection GraphQL:write
Intel	Actors (Falcon Intelligence):read, Indicators (Falcon Intelligence):read, Reports (Falcon Intelligence):read
IOC	IOC Management:read, IOC Management:write
NGSIEM	NGSIEM:read, NGSIEM:write
Policies	Content Update Policies:read, Content Update Policies:write, Device Control Policies:read, Device Control Policies:write, Firewall Management:read, Firewall Management:write, Prevention Policies:read, Prevention Policies:write, Response Policies:read, Response Policies:write, Sensor Update Policies:read, Sensor Update Policies:write
Quarantine	Quarantined Files:read, Quarantined Files:write
Real Time Response	Real time response:read, Real time response:write, real-time-response-audit:read
Recon	Monitoring rules (Falcon Intelligence Recon):read
Scheduled Reports	Scheduled Reports:read
Sensor Usage	Sensor Usage:read
Serverless	Falcon Container Image:read
Shield	SaaS Security:read, SaaS Security:write
Spotlight	Vulnerabilities:read

6. Click Add.

7. Copy the Client ID and Client Secret. The secret is shown only once — store it in a secrets manager before closing.

Add CrowdStrike Falcon to MintMCP

1. In MintMCP, go to MCP store > Manage store.
2. Click + Add an MCP to your registry → Host an open source or custom MCP.
3. Click Advanced.
4. Enter uvx falcon-mcp in the Command field.
5. Under Global Environment Variables, add FALCON_BASE_URL → https://api.crowdstrike.com.
6. Under User Specific Environment Variables, add FALCON_CLIENT_ID and FALCON_CLIENT_SECRET.
7. Click Create.

If your Falcon environment is not in US-1, set FALCON_BASE_URL to the appropriate regional URL:

Region	Base URL
US-1 (default)	https://api.crowdstrike.com
US-2	https://api.us-2.crowdstrike.com
EU-1	https://api.eu-1.crowdstrike.com
US-GOV	https://api.laggar.gcw.crowdstrike.com

To limit which modules are active, add FALCON_MCP_MODULES as a Global Environment Variable with a comma-separated list of module names (e.g., detections,incidents,intel). If omitted, all modules are enabled.

Security considerations

• The client secret is shown only once at creation — store it immediately in a secrets manager.
• Grant only the API scopes your use case requires. Each module maps to specific scopes in the table above.
• Each user's Falcon API client is scoped to their own account — actions are tied to the individual's identity and permissions.
• This server is in public preview and CrowdStrike advises against production deployments until the stable 1.0 release.

Next steps

• Tool customization — Limit which Falcon tools are available to AI agents
• Add a hosted connector — Reference documentation for hosting open-source MCP servers