Investigate Crowdstrike Falcon Alerts And Telemetry Through Falcon Mcp

Name: Investigate Crowdstrike Falcon Alerts And Telemetry Through Falcon Mcp
Author: agentskillexchange

ASecurity

Use falcon-mcp when an agent needs CrowdStrike Falcon detections, incidents, behaviors, threat intel, or read-only response context to triage a security event without leaving an MCP workflow.

36 stars
0 votes
0 copies
0 views
Added June 8, 2026

ai-agentspythongobashdockergitapisecuritydocumentation

Works with

claude code
claude desktop
cursor
cli
api
mcp

Security analysis

A92/100

mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned June 8, 2026

npx -y skills add agentskillexchange/skills --skill investigate-crowdstrike-falcon-alerts-and-telemetry-through-falcon-mcp --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Investigate Crowdstrike Falcon Alerts And Telemetry Through Falcon Mcp?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Investigate Crowdstrike Falcon Alerts And Telemetry Through Falcon Mcp

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/agentskillexchange-investigate-crowdstrike-falcon-alerts-and-telemetr/badge)](https://www.skillsdirectory.com/skills/agentskillexchange-investigate-crowdstrike-falcon-alerts-and-telemetr)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

SKILL.md

---
name: "Investigate CrowdStrike Falcon alerts and telemetry through falcon-mcp"
slug: "investigate-crowdstrike-falcon-alerts-and-telemetry-through-falcon-mcp"
description: "Use falcon-mcp when an agent needs CrowdStrike Falcon detections, incidents, behaviors, threat intel, or read-only response context to triage a security event without leaving an MCP workflow."
github_stars: 136
verification: "security_reviewed"
source: "https://github.com/CrowdStrike/falcon-mcp"
author: "CrowdStrike"
publisher_type: "company"
category: "Security & Verification"
framework: "MCP"
tool_ecosystem:
  github_repo: "CrowdStrike/falcon-mcp"
  github_stars: 136
---

# Investigate CrowdStrike Falcon alerts and telemetry through falcon-mcp

Use falcon-mcp when an agent needs CrowdStrike Falcon detections, incidents, behaviors, threat intel, or read-only response context to triage a security event without leaving an MCP workflow.

## Prerequisites

Python 3.10+ with uv or pip; CrowdStrike Falcon API credentials with the scopes required for the enabled modules; an MCP-compatible client such as Claude Code, Claude Desktop, Cursor, or OpenClaw.

## Installation

Use the upstream install or setup path that matches your environment:
- uv tool install falcon-mcp
- pip install falcon-mcp
- docker pull quay.io/crowdstrike/falcon-mcp:latest
- docker run -i --rm --env-file /path/to/.env quay.io/crowdstrike/falcon-mcp:latest

Requirements and caveats from upstream:
- [![PyPI - Python Version](https://img.shields.io/pypi/pyversions/falcon-mcp)](https://pypi.org/project/falcon-mcp/)
- ### Docker
- "falcon-mcp-docker": {

Basic usage or getting-started notes:
- | [Sensor Usage](https://crowdstrike.github.io/falcon-mcp/modules/sensor-usage/) | Access and analyze sensor usage data |
- #### Using uv (recommended)
- bash

- Source: https://github.com/CrowdStrike/falcon-mcp
- Extracted from upstream docs: https://raw.githubusercontent.com/CrowdStrike/falcon-mcp/HEAD/README.md

## Documentation

- https://github.com/CrowdStrike/falcon-mcp/tree/main/docs

## Source

- [Agent Skill Exchange](https://agentskillexchange.com/skills/investigate-crowdstrike-falcon-alerts-and-telemetry-through-falcon-mcp/)