falcon-mcp

Environment

• FALCON_BASE_URLrequired

  API endpoint URL for your region

• FALCON_MCP_HOST

  Bind host for HTTP transports (default: 127.0.0.1)

• FALCON_MCP_PORT

  Bind port for HTTP transports (default: 8000)

• FALCON_CLIENT_IDrequired

  CrowdStrike API Client ID

• FALCON_MCP_DEBUG

  Set to true to enable verbose debug logging

• FALCON_MEMBER_CID

  Default child CID for MSSP Flight Control

• FALCON_MCP_API_KEYsecret

  API key for x-api-key header authentication on HTTP transports

• FALCON_MCP_MODULES

  Comma-separated list of modules to enable

• FALCON_MCP_READONLY

  Set to true to suppress all mutating tools

• FALCON_CLIENT_SECRETrequiredsecret

  CrowdStrike API Client Secret

• FALCON_MCP_TRANSPORT

  Transport protocol: stdio, sse, or streamable-http (default: stdio)

• FALCON_MCP_STATELESS_HTTP

  Set to true to enable stateless HTTP mode

• FALCON_MCP_ENABLE_GENERATED

  Set to 1 to load all auto-generated modules

• FALCON_MCP_ALLOW_DESTRUCTIVE

  Set to true or comma-separated list of tool names to enable destructive tools