Set up the CrowdStrike Falcon MCP server

The CrowdStrike Falcon MCP server connects AI agents to the Falcon platform for security operations — querying detections, threat intelligence, host inventory, vulnerabilities, real-time response, and more. This guide covers creating a Falcon API client with the right scopes and adding it to Mintive as a hosted connector built from CrowdStrike's container image, with per-user credentials.

Prerequisites

• A Mintive admin account
• A CrowdStrike Falcon subscription with API access

Create a Falcon API client

Because FALCON_CLIENT_ID and FALCON_CLIENT_SECRET are per-user credentials, each team member needs to create their own Falcon API client. Share these steps with your team.

1. Go to falcon.crowdstrike.com and sign in.

2. Navigate to Support > API Clients and Keys.

3. Click Add new API client.

4. Enter a name (e.g., "Mintive Falcon") and an optional description.

5. Select scopes under API scopes based on the modules you want to enable. The table below maps each module to its required scopes; CrowdStrike's Module Overview has the authoritative, current list.

Module	Required API scopes
Core	Basic connectivity and system info — no additional scopes
Case Management	Case Templates:read, Cases:read, Cases:write
Cloud Security	Cloud Security API Assets:read, Cloud Security API Detections:read, Cloud Security Policies:read, Cloud Security Policies:write, Falcon Container Image:read
Correlation Rules	Correlation Rules:read, Correlation Rules:write
Custom IOA	Custom IOA Rules:read, Custom IOA Rules:write
Data Protection	Data Protection:read
Detections	Alerts:read, Alerts:write
Discover	Assets:read
Exclusions	IOA Exclusions:read, IOA Exclusions:write, Machine Learning Exclusions:read, Machine Learning Exclusions:write, Sensor Visibility Exclusions:read, Sensor Visibility Exclusions:write
Firewall Management	Firewall Management:read, Firewall Management:write
Host Groups	Host Groups:read, Host Groups:write
Hosts	Hosts:read
Identity Protection	Identity Protection Assessment:read, Identity Protection Detections:read, Identity Protection Entities:read, Identity Protection Timeline:read, Identity Protection GraphQL:write
Intel	Actors (Falcon Intelligence):read, Indicators (Falcon Intelligence):read, Reports (Falcon Intelligence):read
IOC	IOC Management:read, IOC Management:write
NGSIEM	NGSIEM:read, NGSIEM:write
Policies	Content Update Policies:read, Content Update Policies:write, Device Control Policies:read, Device Control Policies:write, Firewall Management:read, Firewall Management:write, Prevention Policies:read, Prevention Policies:write, Response Policies:read, Response Policies:write, Sensor Update Policies:read, Sensor Update Policies:write
Quarantine	Quarantined Files:read, Quarantined Files:write
Real Time Response	Real time response:read, Real time response:write, real-time-response-audit:read
Recon	Monitoring rules (Falcon Intelligence Recon):read
Scheduled Reports	Scheduled Reports:read
Sensor Usage	Sensor Usage:read
Serverless	Falcon Container Image:read
Shield	SaaS Security:read, SaaS Security:write
Spotlight	Vulnerabilities:read

6. Click Add.

7. Copy the Client ID and Client Secret. The secret is shown only once — store it in a secrets manager before closing.

Add CrowdStrike Falcon to Mintive

1. In Mintive, go to MCP store > Manage store.
2. Click + Add an MCP to your registry → Deploy an open source or custom MCP.
3. Open the Container image tab and enter a Name.
4. Set Container Image to CrowdStrike's published image, quay.io/crowdstrike/falcon-mcp:latest. Pin a specific tag in production.
5. Set Transport to Stdio and enter falcon-mcp in the Command field. Stdio delivers each user's credentials to the server as environment variables.
6. Under Environment variables, add FALCON_BASE_URL → https://api.crowdstrike.com as a Global variable.
7. Add FALCON_CLIENT_ID and FALCON_CLIENT_SECRET as User-specific variables.
8. Click Create hosted connector.

If your Falcon environment is not in US-1, set FALCON_BASE_URL to the appropriate regional URL:

Region	Base URL
US-1 (default)	https://api.crowdstrike.com
US-2	https://api.us-2.crowdstrike.com
EU-1	https://api.eu-1.crowdstrike.com
US-GOV	https://api.laggar.gcw.crowdstrike.com

To limit which modules are active, add FALCON_MCP_MODULES as a Global environment variable with a comma-separated list of module names (e.g., detections,incidents,intel). If omitted, all modules are enabled.

Security considerations

• The client secret is shown only once at creation — store it immediately in a secrets manager.
• Grant only the API scopes your use case requires. Each module maps to specific scopes in the table above.
• Each user's Falcon API client is scoped to their own account — actions are tied to the individual's identity and permissions.
• This server is in public preview and CrowdStrike advises against production deployments until the stable 1.0 release.

Next steps

• Tool customization — Limit which Falcon tools are available to AI agents
• Add a hosted connector — Reference documentation for hosting open-source MCP servers