crowdstrike-mcp

A Model Context Protocol (MCP) server for CrowdStrike Falcon, by WIT-SecOps, built for a Flight Control (MSSP) parent and its child tenants. Every tool takes a tenant, and the read tools can sweep every child in one call, so an assistant can answer "which clients have hosts that…" without one server per customer.

Note: Not affiliated with or endorsed by CrowdStrike.

Features

• Per-call tenant: each tool takes an exact tenant name or CID, a list, or "*" for every child. One API key in the parent covers them all; the server gets a token per child (member_cid) and caches it.
• Exact tenant matching only. A near miss is an error that names candidates, never a silent best guess, because the real risk of a tenant argument is a wrong-but-valid customer.
• Sweeps that don't fall over: each tenant is queried directly (parent roll-ups aren't estate-wide for every product), one tenant's failure is reported without failing the rest, and limit: 0 returns per-tenant counts cheaply.
• Read-only by default. v0.1 has no write tools at all.
• Throttled: at most 6 requests in flight across all tenants, paced logins for the token endpoint's own limit, and 429 retries (honouring X-RateLimit-RetryAfter) only for sweeps; single-tenant calls fail fast.
• Local audit log: one JSON line per tool call, with the tenants it touched.
• Markdown and JSON response formats
• Runs locally over stdio; each MCP client spawns its own process

Quick Start

The server reads its credentials only from its environment. They are never accepted on the command line.

Claude Desktop, with the Kryptos vault

1. Store the API client in Kryptos, in your own terminal. Each command asks for the value with hidden typing:

   kryptos set FALCON_CLIENT_ID
   kryptos set FALCON_CLIENT_SECRET
   kryptos set FALCON_BASE_URL

2. Open Claude Desktop and go to Settings > Developer > Edit Config, then add the following to claude_desktop_config.json:

   {
     "mcpServers": {
       "crowdstrike": {
         "command": "kryptos",
         "args": [
           "run", "--only", "FALCON_BASE_URL,FALCON_CLIENT_ID,FALCON_CLIENT_SECRET", "--",
           "npx", "-y", "@wit-secops/crowdstrike-mcp"
         ]
       }
     }
   }

   Name the three secrets rather than FALCON_*, which would also pass any other FALCON_* value in the vault.

3. Save the file and restart Claude Desktop.

On the Microsoft Store build of Claude Desktop, the file is under %LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\, not %APPDATA%\Claude\. Edit Config always opens the right one.

Without Kryptos

Set the same variables in the process environment (for example in the config's env block).

Other MCP Clients (Cursor, Windsurf, Claude Code, etc.)

Most MCP clients use the same stdio configuration format shown above.

Environment Variables

| Variable | Description | Required | Default | |----------|-------------|----------|---------| | FALCON_CLIENT_ID | Client ID of an API client in the Flight Control parent CID | Yes | | | FALCON_CLIENT_SECRET | That API client's secret | Yes | | | FALCON_BASE_URL | API base URL, e.g. https://api.us-2.crowdstrike.com. Must be https on crowdstrike.com | Yes, unless --region or --base-url | | | CROWDSTRIKE_ALLOW_WRITE | true enables write tools (none yet) | No | false | | CROWDSTRIKE_CACHE_DIR | Where the audit log is written | No | %LOCALAPPDATA%\crowdstrike-mcp (Windows), ~/Library/Caches/crowdstrike-mcp (macOS), $XDG_CACHE_HOME/crowdstrike-mcp |

CLI Options

--base-url <url>        Falcon API base URL (overrides --region and FALCON_BASE_URL)
--region <region>       us-1, us-2 or eu-1 (overrides FALCON_BASE_URL)
--cache-dir <dir>       Where the audit log is written
--read-write            Enable write tools (none yet in this version)
--read-only             Force read-only mode (the default; wins over --read-write)
--help, -h              Show help
--version, -v           Show version

Access Modes

Read-only is the default. In read-only mode, write tools are never registered and the server's instructions don't mention them. v0.1 has no write tools, so both modes expose the same three read tools.

When write tools arrive, the write edition will be a second config entry, crowdstrike-write, with "--read-write" appended to the args, so both can be installed side by side.

Neither mode is a security boundary. The real control is the API client's scopes and who receives its credentials. A read-scoped key can't write whatever the flags say; a broad key relies on the flags alone.

Tools

Tenants

| Tool | Description | |------|-------------| | crowdstrike_list_tenants | Every Flight Control child tenant with its exact name, CID, full Flight Control name and status. Local name filter |

Hosts

| Tool | Description | |------|-------------| | crowdstrike_search_hosts | Hosts in one tenant, several, or "*": hostname contains-match plus raw FQL, with live online state. limit: 0 returns per-tenant counts | | crowdstrike_get_hosts | Full details for up to 100 device ids in one tenant: status, OS and build, sensor, hardware, network, last user, dates, groups, tags and policy ids |

Tenants and Filters

• tenant is an exact child name (the client part of the Flight Control name, e.g. Acme for Acme > US2 > Winona IT, or the full name) or CID, case-insensitive. A CCID with its -XX checksum is accepted. "*" means every child and can't be mixed with names.
• crowdstrike_list_tenants name is a local, case-insensitive substring filter for finding a tenant. Tools never match tenant names partially.
• hostname is a server-side, case-insensitive contains match (hostname:*'*text*').
• filter is raw Falcon FQL, sent as given and ANDed with hostname. Examples: platform_name:'Windows', last_seen:<'now-30d', status:'contained', product_type_desc:'Server'. Invalid FQL comes back as a 400 error.
• Paging: offset works for a single tenant only, and Falcon can't page past offset + limit = 10,000.

Setting Up the API Client

Create the API client in the parent CID (Support and resources > API clients and keys), named for the person who uses it, e.g. "Firstname - Claude MCP". For this version it needs:

• Flight Control (mssp): Read, to list the child tenants and get a token for each
• Hosts: Read, for host search, details and online state

Give each person their own key, and prefer read scopes. A key can't combine API-client management with product scopes, so "select everything" isn't possible anyway.

Regions

| Region | Base URL | |--------|----------| | us-1 | https://api.crowdstrike.com | | us-2 | https://api.us-2.crowdstrike.com | | eu-1 | https://api.eu-1.crowdstrike.com |

us-gov-1 (GovCloud) isn't supported yet; it needs its own key.

Rate Limits

Falcon allows about 6,000 API requests per minute per customer, and the token endpoint has its own limit of 300 logins per minute. The server keeps at most 6 requests in flight, spaces logins at least 100 ms apart, and reuses each tenant's token until a minute before it expires (tokens last 30 minutes). A full sweep of 73 tenants needs 73 logins and a few requests per tenant.

Single-tenant calls fail fast on HTTP 429 with a clear message. Sweeps retry a 429 up to three times, waiting until X-RateLimit-RetryAfter (or backing off when it's missing). Nothing retries a 5xx.

Response Size

Responses are capped at 25,000 characters. Markdown is truncated with a hint to narrow the query; JSON drops trailing rows and says how many were kept, so it always stays valid.

Development

npm install
npm run check        # lint, format check, build and unit tests
npm run dev          # run from source with tsx

Enable the pre-push hook once per clone, which runs npm run check before every push:

git config core.hooksPath .githooks

The live test drives the built server over stdio against the real parent, read-only, and cleans up after itself:

kryptos run --only "FALCON_BASE_URL,FALCON_CLIENT_ID,FALCON_CLIENT_SECRET" -- npm run test:live

It picks the first tenant (by name) with 5 to 400 hosts, or CROWDSTRIKE_LIVE_TENANT if set. Add -- --show to print each tool's output.

License

MIT