CrowdStrike Falcon Endpoint Protection MCP server
CrowdStrike Falcon Endpoint Protection is the industry-leading cloud-native platform for next-generation antivirus, endpoint detection and response (EDR), and managed threat hunting. This MCP server enables AI agents to detect threats, investigate incidents, manage device policies, and execute remediation across your endpoints.
Setting up an MCP server
This article covers the standard steps for creating an MCP server in AI Gateway and connecting it to an AI client. The steps are the same for every integration — application-specific details (API credentials, OAuth endpoints, and scopes) are covered in the Authentication section on this page.
Before you begin
You'll need:
- Access to AI Gateway with permission to create MCP servers.
- API credentials for the application you're connecting (see the Authentication section on this page for what to collect).
Create an MCP server
Find the app in the catalog
- Sign in to AI Gateway and select App Catalog from the left navigation.
- Search for the application you want to connect, then select it from the catalog.
- Select Create MCP Server to start the wizard.
App Configuration
Confirm the Base URL for the API, then, under Tools, select the endpoints you want to expose. Select Next.
MCP Server Setup
- Enter a Name for your server — something descriptive that identifies both the application and its purpose.
- Enter a Description so your team knows what the server is for.
- Set the log level: choose Production Mode for terser logs, or Non-Production Mode for more verbose logs that can help with debugging.
- Select Next.
Authentication
Enter the authentication details for the application. This varies by service — see the Authentication section on this page for the specific credentials, OAuth URLs, and scopes to use.
Review
Look over the summary of your MCP server configuration, then select Create & Deploy. AI Gateway provisions the server and provides a server URL you'll use when configuring your AI client.
Connect to an AI client
Once your server is deployed, you'll need to add it to the AI client your team uses. Select your client for setup instructions:
Tips
- You can create multiple MCP servers for the same application — for example, a read-only server for reporting agents and a read-write server for automation workflows.
- If you're unsure which OAuth scopes to request, start with the minimum read-only set and add write scopes only when needed. Most application pages include scope recommendations.
Authentication
CrowdStrike Falcon uses OAuth 2.0 with client credentials flow. Create an API client in the Falcon Console at Support > API Clients and Keys and save your Client ID and Client Secret. Request only the scopes you need.
| Value | Setting |
|---|---|
| Token endpoint (US-1) | https://api.crowdstrike.com/oauth2/token |
| Token endpoint (US-2) | https://api.us-2.crowdstrike.com/oauth2/token |
| Token endpoint (EU-1) | https://api.eu-1.crowdstrike.com/oauth2/token |
| Scopes | detections:read, detections:write, hosts:read, hosts:write, real-time-response:read, real-time-response:write, prevention-policies:read, prevention-policies:write, incidents:read, incidents:write |
Available tools
These tools enable detection management, endpoint containment, threat investigation, policy enforcement, and compliance monitoring across your security infrastructure.
Detection & Threat Management
| Tool | Description |
|---|---|
| Query detections | Search detections by severity, type, time range, or affected host |
| Get detection details | Retrieve full context including behavioral analysis and IOC data |
| Update detection | Mark detection as resolved, escalate, or flag as false positive |
| Search process execution | Hunt for specific processes like mimikatz or PowerShell abuse |
| Find network connections | Query network activity for suspicious IPs or domains |
Endpoint Control & Containment
| Tool | Description |
|---|---|
| List hosts | Retrieve inventory with filters for OS, status, policy, or group |
| Get host details | Fetch system information, security posture, and sensor health |
| Contain host | Isolate endpoint from network for incident response |
| Lift containment | Restore network access after remediation confirmed |
| Create host group | Organize endpoints for targeted policy deployment |
Real-Time Response & Remediation
| Tool | Description |
|---|---|
| Start RTR session | Establish interactive shell on endpoint for forensics |
| Execute command | Run read-only diagnostics (process listing, file inspection) |
| Kill process | Terminate malicious or suspicious process |
| Delete file | Remove malware or unwanted file from endpoint |
| Get command output | Retrieve results from remote commands |
Policy & Compliance
| Tool | Description |
|---|---|
| List prevention policies | View all configured endpoint protection policies |
| Get policy details | Fetch settings, exclusions, sensitivity levels, and assignments |
| Create policy | Define new prevention configuration from template |
| Update policy | Modify exclusions, detection sensitivity, or control settings |
| Assign policy | Apply policy to host groups or individual endpoints |
Tips
Define clear incident response workflows before using containment actions.
Test with non-critical systems first when implementing new response procedures.
Implement approval workflows for irreversible actions like file deletion or process termination.
Start with read-only scopes (detections:read, hosts:read) to gather data.
Add write scopes only for specific response tasks once you've validated data access.
Monitor policy changes to prevent accidental over-permissive or overly restrictive configurations that impact user productivity.
Rotate API credentials every 90 days and use IP allowlisting to restrict where the MCP server can authenticate from.
Cequence AI Gateway