CrowdStrike MCP Server: Complete Integration Guide for Developers 2025

# Clone the official CrowdStrike Falcon MCP repository
git clone https://github.com/CrowdStrike/falcon-mcp.git

# Navigate to the project directory
cd falcon-mcp

# Install dependencies using npm
npm install

# Or use yarn for faster installation
yarn install

# Verify installation
npm run test

# CrowdStrike Falcon API Configuration
FALCON_CLIENT_ID=your_client_id_here
FALCON_CLIENT_SECRET=your_client_secret_here
FALCON_CLOUD_REGION=us-1
# Options: us-1, us-2, eu-1, us-gov-1

# MCP Server Configuration
MCP_SERVER_PORT=3000
MCP_LOG_LEVEL=info
# Options: debug, info, warn, error

# Security Settings
ENABLE_REQUEST_LOGGING=true
MAX_CONCURRENT_REQUESTS=10
API_REQUEST_TIMEOUT=30000

# Optional: Redis for session management
REDIS_URL=redis://localhost:6379
SESSION_TTL=3600

{
  "mcpServers": {
    "crowdstrike-falcon": {
      "command": "node",
      "args": [
        "/absolute/path/to/falcon-mcp/build/index.js"
      ],
      "env": {
        "FALCON_CLIENT_ID": "your_client_id",
        "FALCON_CLIENT_SECRET": "your_client_secret",
        "FALCON_CLOUD_REGION": "us-1"
      },
      "disabled": false,
      "alwaysAllow": []
    }
  },
  "globalShortcut ": "CommandOrControl+Shift+Space"
}

// Example: Querying high-severity detections via MCP
const queryDetections = async () => {
  const mcpClient = new MCPClient({
    serverUrl: 'localhost:3000'
  });

  // Natural language query to Claude
  const query = `
    Find all critical severity detections in the last 24 hours
    where the target OS is Windows and behavior involves 
    credential dumping or privilege escalation
  `;

  const response = await mcpClient.sendQuery({
    tool: 'crowdstrike-falcon',
    action: 'query_detections',
    parameters: {
      query: query,
      timeRange: '24h',
      severity: ['critical', 'high'],
      platforms: ['windows']
    }
  });

  // Process and display results
  console.log(`Found ${response.detections.length} detections`);
  response.detections.forEach(detection => {
    console.log({
      id: detection.detection_id,
      severity: detection.severity,
      technique: detection.technique,
      hostname: detection.device.hostname,
      timestamp: detection.created_timestamp
    });
  });
};

queryDetections();

// Automated incident response workflow
class FalconMCPIncidentHandler {
  constructor(mcpClient) {
    this.mcp = mcpClient;
    this.isolatedHosts = new Set();
  }

  async handleCriticalDetection(detectionId) {
    // Step 1: Get detailed detection information
    const detection = await this.mcp.query({
      action: 'get_detection_details',
      detectionId: detectionId
    });

    console.log(`Processing critical detection: ${detection.name}`);

    // Step 2: Isolate affected endpoint
    if (detection.severity === 'critical') {
      await this.isolateHost(detection.device.device_id);
      
      // Step 3: Collect forensic artifacts
      const artifacts = await this.collectForensics(
        detection.device.device_id,
        ['memory_dump', 'process_list', 'network_connections']
      );

      // Step 4: Generate incident report
      const report = await this.generateReport({
        detection: detection,
        artifacts: artifacts,
        timeline: await this.buildTimeline(detection)
      });

      // Step 5: Notify security team
      await this.notifyTeam({
        severity: 'critical',
        report: report,
        recommendedActions: await this.getRecommendations(detection)
      });
    }

    return {
      status: 'handled',
      actions: this.getExecutedActions()
    };
  }

  async isolateHost(deviceId) {
    const result = await this.mcp.query({
      action: 'contain_host',
      deviceId: deviceId
    });
    
    this.isolatedHosts.add(deviceId);
    console.log(`Host ${deviceId} isolated successfully`);
    return result;
  }

  async collectForensics(deviceId, artifactTypes) {
    const session = await this.mcp.query({
      action: 'init_rtr_session',
      deviceId: deviceId
    });

    const artifacts = {};
    for (const artifactType of artifactTypes) {
      artifacts[artifactType] = await this.mcp.query({
        action: 'execute_rtr_command',
        sessionId: session.session_id,
        command: this.getForensicCommand(artifactType)
      });
    }

    return artifacts;
  }

  getForensicCommand(artifactType) {
    const commands = {
      'memory_dump': 'runscript -CloudFile=memory_capture',
      'process_list': 'ps',
      'network_connections': 'netstat'
    };
    return commands[artifactType];
  }
}

// Usage
const handler = new FalconMCPIncidentHandler(mcpClient);
handler.handleCriticalDetection('det:abc123xyz');

import Redis from 'ioredis';
import { RateLimiterRedis } from 'rate-limiter-flexible';

class FalconMCPCache {
  constructor() {
    this.redis = new Redis(process.env.REDIS_URL);
    
    // Configure rate limiter: 100 requests per minute per user
    this.rateLimiter = new RateLimiterRedis({
      storeClient: this.redis,
      keyPrefix: 'falcon_mcp_rate',
      points: 100,
      duration: 60,
      blockDuration: 60
    });
  }

  async getCached(key, fetchFunction, ttl = 300) {
    // Check cache first
    const cached = await this.redis.get(key);
    if (cached) {
      console.log(`Cache hit for key: ${key}`);
      return JSON.parse(cached);
    }

    // Apply rate limiting before API call
    try {
      await this.rateLimiter.consume('global');
    } catch (error) {
      throw new Error('Rate limit exceeded. Please retry later.');
    }

    // Fetch from API
    console.log(`Cache miss for key: ${key}, fetching from API`);
    const data = await fetchFunction();

    // Store in cache with TTL
    await this.redis.setex(key, ttl, JSON.stringify(data));
    
    return data;
  }

  async invalidatePattern(pattern) {
    const keys = await this.redis.keys(pattern);
    if (keys.length > 0) {
      await this.redis.del(...keys);
      console.log(`Invalidated ${keys.length} cache entries`);
    }
  }

  // Cache strategies for different data types
  getCacheTTL(dataType) {
    const ttlConfig = {
      'host_info': 300,        // 5 minutes
      'detections': 60,        // 1 minute
      'iocs': 1800,           // 30 minutes
      'policies': 3600,       // 1 hour
      'user_info': 7200       // 2 hours
    };
    return ttlConfig[dataType] || 300;
  }
}

// Usage example
const cache = new FalconMCPCache();

async function getHostDetails(deviceId) {
  return await cache.getCached(
    `host:${deviceId}`,
    async () => {
      const response = await falconAPI.getDeviceDetails(deviceId);
      return response.resources[0];
    },
    cache.getCacheTTL('host_info')
  );
}

interface TenantConfig {
  tenantId: string;
  falconClientId: string;
  falconClientSecret: string;
  cloudRegion: string;
  allowedScopes: string[];
  rateLimit: number;
}

class MultiTenantFalconMCP {
  private tenants: Map = new Map();
  private connections: Map = new Map();

  async initializeTenant(config: TenantConfig) {
    // Validate tenant configuration
    this.validateTenantConfig(config);

    // Store tenant configuration
    this.tenants.set(config.tenantId, config);

    // Initialize Falcon API connection
    const client = new FalconAPIClient({
      clientId: config.falconClientId,
      clientSecret: config.falconClientSecret,
      cloudRegion: config.cloudRegion
    });

    await client.authenticate();
    this.connections.set(config.tenantId, client);

    console.log(`Tenant ${config.tenantId} initialized successfully`);
  }

  async executeQuery(tenantId: string, query: MCPQuery) {
    // Verify tenant exists
    if (!this.tenants.has(tenantId)) {
      throw new Error(`Tenant ${tenantId} not found`);
    }

    const tenant = this.tenants.get(tenantId)!;
    const client = this.connections.get(tenantId)!;

    // Verify scope permissions
    if (!this.hasRequiredScope(tenant, query.requiredScope)) {
      throw new Error('Insufficient permissions for this operation');
    }

    // Apply tenant-specific rate limiting
    await this.checkRateLimit(tenantId, tenant.rateLimit);

    // Execute query with tenant isolation
    return await client.executeQuery(query);
  }

  private validateTenantConfig(config: TenantConfig) {
    if (!config.tenantId || !config.falconClientId) {
      throw new Error('Invalid tenant configuration');
    }
    // Additional validation logic
  }

  private hasRequiredScope(tenant: TenantConfig, scope: string): boolean {
    return tenant.allowedScopes.includes(scope);
  }

  private async checkRateLimit(tenantId: string, limit: number) {
    // Implement tenant-specific rate limiting logic
  }
}

import requests
import json
from datetime import datetime

class FalconMCPSIEMIntegration:
    def __init__(self, mcp_url, splunk_url, splunk_token):
        self.mcp_url = mcp_url
        self.splunk_url = splunk_url
        self.splunk_token = splunk_token
        
    def send_detection_to_splunk(self, detection):
        """Forward Falcon detection to Splunk for correlation"""
        event = {
            "time": detection['created_timestamp'],
            "host": detection['device']['hostname'],
            "source": "crowdstrike_falcon_mcp",
            "sourcetype": "crowdstrike:detection",
            "event": {
                "detection_id": detection['detection_id'],
                "severity": detection['severity'],
                "technique": detection['technique'],
                "tactic": detection['tactic'],
                "description": detection['description'],
                "status": detection['status']
            }
        }
        
        headers = {
            "Authorization": f"Splunk {self.splunk_token}",
            "Content-Type": "application/json"
        }
        
        response = requests.post(
            f"{self.splunk_url}/services/collector/event",
            headers=headers,
            data=json.dumps(event)
        )
        
        return response.status_code == 200
    
    def query_falcon_from_splunk(self, alert_data):
        """Query Falcon via MCP when Splunk alert is triggered"""
        mcp_query = {
            "tool": "crowdstrike-falcon",
            "action": "investigate_host",
            "parameters": {
                "hostname": alert_data['hostname'],
                "timeRange": "1h",
                "includeProcesses": True,
                "includeNetworkConnections": True
            }
        }
        
        response = requests.post(
            f"{self.mcp_url}/api/query",
            json=mcp_query
        )
        
        if response.status_code == 200:
            investigation_results = response.json()
            
            # Enrich Splunk alert with Falcon data
            self.enrich_splunk_alert(
                alert_data['alert_id'],
                investigation_results
            )
            
            return investigation_results
        
        return None
    
    def enrich_splunk_alert(self, alert_id, enrichment_data):
        """Add Falcon investigation data to Splunk alert"""
        # Implementation for updating Splunk notable events
        pass

# Usage
integrator = FalconMCPSIEMIntegration(
    mcp_url="http://localhost:3000",
    splunk_url="https://splunk.company.com:8088",
    splunk_token="your-hec-token"
)

# Forward Falcon detections to Splunk
detection = get_latest_detection()
integrator.send_detection_to_splunk(detection)

import winston from 'winston';
import { ElasticsearchTransport } from 'winston-elasticsearch';

class FalconMCPAuditLogger {
  constructor() {
    this.logger = winston.createLogger({
      level: 'info',
      format: winston.format.combine(
        winston.format.timestamp(),
        winston.format.json()
      ),
      transports: [
        // Console output for development
        new winston.transports.Console(),
        
        // Elasticsearch for long-term storage and analysis
        new ElasticsearchTransport({
          level: 'info',
          clientOpts: {
            node: process.env.ELASTICSEARCH_URL,
            auth: {
              username: process.env.ES_USERNAME,
              password: process.env.ES_PASSWORD
            }
          },
          index: 'falcon-mcp-audit-logs'
        })
      ]
    });
  }

  logMCPQuery(context) {
    this.logger.info('MCP_QUERY', {
      eventType: 'mcp_query',
      timestamp: new Date().toISOString(),
      userId: context.userId,
      tenantId: context.tenantId,
      query: this.sanitizeQuery(context.query),
      sourceIP: context.sourceIP,
      userAgent: context.userAgent,
      sessionId: context.sessionId
    });
  }

  logAPICall(context) {
    this.logger.info('FALCON_API_CALL', {
      eventType: 'falcon_api_call',
      timestamp: new Date().toISOString(),
      endpoint: context.endpoint,
      method: context.method,
      statusCode: context.statusCode,
      responseTime: context.responseTime,
      userId: context.userId,
      tenantId: context.tenantId
    });
  }

  logSecurityEvent(context) {
    this.logger.warn('SECURITY_EVENT', {
      eventType: 'security_event',
      timestamp: new Date().toISOString(),
      severity: context.severity,
      eventDescription: context.description,
      userId: context.userId,
      sourceIP: context.sourceIP,
      action: context.action
    });
  }

  logComplianceEvent(context) {
    this.logger.info('COMPLIANCE_EVENT', {
      eventType: 'compliance_event',
      timestamp: new Date().toISOString(),
      complianceFramework: context.framework,
      controlId: context.controlId,
      status: context.status,
      evidence: context.evidence
    });
  }

  sanitizeQuery(query) {
    // Remove sensitive data from queries before logging
    const sanitized = { ...query };
    delete sanitized.credentials;
    delete sanitized.apiKeys;
    return sanitized;
  }
}

// Usage
const auditLogger = new FalconMCPAuditLogger();

// Log all MCP interactions
app.use((req, res, next) => {
  auditLogger.logMCPQuery({
    userId: req.user.id,
    tenantId: req.user.tenantId,
    query: req.body,
    sourceIP: req.ip,
    userAgent: req.headers['user-agent'],
    sessionId: req.sessionID
  });
  next();
});

import client from 'prom-client';

class FalconMCPMetrics {
  constructor() {
    // Create a Registry
    this.register = new client.Registry();

    // Add default metrics
    client.collectDefaultMetrics({ register: this.register });

    // Custom metrics
    this.mcpQueryDuration = new client.Histogram({
      name: 'falcon_mcp_query_duration_seconds',
      help: 'Duration of MCP queries in seconds',
      labelNames: ['query_type', 'status'],
      buckets: [0.1, 0.5, 1, 2, 5, 10]
    });

    this.falconAPICallsTotal = new client.Counter({
      name: 'falcon_api_calls_total',
      help: 'Total number of Falcon API calls',
      labelNames: ['endpoint', 'method', 'status_code']
    });

    this.cacheHitRate = new client.Gauge({
      name: 'falcon_mcp_cache_hit_rate',
      help: 'Cache hit rate percentage',
      labelNames: ['cache_type']
    });

    this.activeConnections = new client.Gauge({
      name: 'falcon_mcp_active_connections',
      help: 'Number of active MCP connections'
    });

    this.rateLimitRemaining = new client.Gauge({
      name: 'falcon_api_rate_limit_remaining',
      help: 'Remaining API rate limit quota',
      labelNames: ['tenant_id']
    });

    // Register all metrics
    this.register.registerMetric(this.mcpQueryDuration);
    this.register.registerMetric(this.falconAPICallsTotal);
    this.register.registerMetric(this.cacheHitRate);
    this.register.registerMetric(this.activeConnections);
    this.register.registerMetric(this.rateLimitRemaining);
  }

  recordQueryDuration(queryType, status, duration) {
    this.mcpQueryDuration.observe(
      { query_type: queryType, status: status },
      duration
    );
  }

  recordAPICall(endpoint, method, statusCode) {
    this.falconAPICallsTotal.inc({
      endpoint: endpoint,
      method: method,
      status_code: statusCode
    });
  }

  updateCacheHitRate(cacheType, hitRate) {
    this.cacheHitRate.set({ cache_type: cacheType }, hitRate);
  }

  setActiveConnections(count) {
    this.activeConnections.set(count);
  }

  updateRateLimitRemaining(tenantId, remaining) {
    this.rateLimitRemaining.set({ tenant_id: tenantId }, remaining);
  }

  getMetrics() {
    return this.register.metrics();
  }
}

// Express endpoint for Prometheus scraping
app.get('/metrics', async (req, res) => {
  res.set('Content-Type', metrics.register.contentType);
  res.end(await metrics.getMetrics());
});

// Usage in middleware
app.use(async (req, res, next) => {
  const start = Date.now();
  
  res.on('finish', () => {
    const duration = (Date.now() - start) / 1000;
    metrics.recordQueryDuration(
      req.body.action,
      res.statusCode,
      duration
    );
  });
  
  next();
});

// Healthcare-specific compliance query handler
class HealthcareFalconMCPQueries {
constructor(mcpClient) {
this.mcp = mcpClient;
}
async queryPHIAccess(timeRange = '1h') {
const query =       Find all endpoints that accessed files containing        patient health information (PHI) in the last ${timeRange}.       Filter for:       - File paths containing: /patient_records/, /medical/       - Processes accessing: .csv, .xlsx, .pdf files       - Exclude authorized EMR system processes       - Include user identity and access timestamp    ;
const results = await this.mcp.query({
  action: 'search_file_access',
  parameters: {
    query: query,
    timeRange: timeRange,
    dataClassification: ['PHI', 'PII'],
    includeUserContext: true
  }
});

// Generate HIPAA audit log
const auditLog = this.generateHIPAAAuditLog(results);

return {
  accessEvents: results.events,
  complianceReport: auditLog,
  riskyAccess: this.identifyRiskyBehaviors(results),
  recommendedActions: await this.getHIPAARecommendations(results)
};
}
async investigateDataExfiltration(deviceId) {
// Multi-stage investigation for potential data breach
const investigation = {
step1_networkActivity: await this.analyzeNetworkConnections(deviceId),
step2_fileOperations: await this.analyzeFileOperations(deviceId),
step3_cloudUploads: await this.detectCloudUploads(deviceId),
step4_removableMedia: await this.checkRemovableMedia(deviceId),
step5_emailAttachments: await this.analyzeEmailActivity(deviceId)
};
// Determine if breach notification required under HIPAA
const breachRisk = this.assessBreachRisk(investigation);

if (breachRisk.requiresNotification) {
  await this.initiateBreachProtocol(breachRisk);
}

return investigation;
}
generateHIPAAAuditLog(results) {
return {
auditId: HIPAA-${Date.now()},
timestamp: new Date().toISOString(),
regulation: 'HIPAA Security Rule § 164.312(b)',
accessEvents: results.events.map(event => ({
userId: event.user.id,
userName: event.user.name,
accessTime: event.timestamp,
resourceAccessed: this.maskPHI(event.resource),
action: event.action,
justification: event.justification || 'Not provided',
approvalStatus: event.approvalStatus
})),
complianceStatus: this.determineComplianceStatus(results),
reviewedBy: 'FalconMCP-Automated-System',
nextReviewDate: this.calculateNextReview()
};
}
identifyRiskyBehaviors(results) {
const risks = [];
results.events.forEach(event => {
  // After-hours access
  if (this.isAfterHours(event.timestamp)) {
    risks.push({
      severity: 'medium',
      type: 'after_hours_access',
      event: event
    });
  }

  // Bulk downloads
  if (event.filesAccessed > 50) {
    risks.push({
      severity: 'high',
      type: 'bulk_data_access',
      event: event
    });
  }

  // Unauthorized location
  if (!this.isAuthorizedLocation(event.sourceIP)) {
    risks.push({
      severity: 'critical',
      type: 'unauthorized_location',
      event: event
    });
  }
});

return risks;
}
maskPHI(resource) {
// Redact sensitive information for audit logs
return resource.replace(/\d{3}-\d{2}-\d{4}/g, 'XXX-XX-XXXX')
.replace(/\b[A-Z][a-z]+ [A-Z][a-z]+\b/g, '[PATIENT_NAME]');
}
}
// Usage
const healthcareQueries = new HealthcareFalconMCPQueries(mcpClient);
// Daily compliance check
const phiAccessReport = await healthcareQueries.queryPHIAccess('24h');
console.log(PHI Access Events: ${phiAccessReport.accessEvents.length});
console.log(Risky Behaviors Detected: ${phiAccessReport.riskyAccess.length});

class FalconMCPAuthHandler {
constructor(config) {
this.config = config;
this.tokenCache = null;
this.tokenExpiry = null;
this.maxRetries = 3;
}
async authenticate() {
try {
// Check if cached token is still valid
if (this.isTokenValid()) {
console.log('Using cached authentication token');
return this.tokenCache;
}
  // Request new token from Falcon OAuth2 endpoint
  const tokenUrl = this.getTokenUrl();
  const response = await fetch(tokenUrl, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/x-www-form-urlencoded',
      'Accept': 'application/json'
    },
    body: new URLSearchParams({
      client_id: this.config.clientId,
      client_secret: this.config.clientSecret,
      grant_type: 'client_credentials'
    })
  });

  if (!response.ok) {
    await this.handleAuthError(response);
  }

  const data = await response.json();
  
  // Cache token with expiry
  this.tokenCache = data.access_token;
  this.tokenExpiry = Date.now() + (data.expires_in * 1000) - 300000; // 5 min buffer
  
  console.log('Authentication successful');
  return this.tokenCache;

} catch (error) {
  console.error('Authentication failed:', error.message);
  throw new Error(`Falcon authentication failed: ${error.message}`);
}
}
async handleAuthError(response) {
const errorData = await response.json();
const errorMessages = {
  401: 'Invalid API credentials. Verify client_id and client_secret.',
  403: 'Insufficient permissions. Check API client scopes in Falcon console.',
  429: 'Rate limit exceeded. Implement exponential backoff.',
  500: 'Falcon API server error. Check status.crowdstrike.com for incidents.'
};

const message = errorMessages[response.status] || 
                `Authentication failed with status ${response.status}`;

// Log detailed error for troubleshooting
console.error('Authentication Error Details:', {
  status: response.status,
  error: errorData.error,
  errorDescription: errorData.error_description,
  cloudRegion: this.config.cloudRegion,
  timestamp: new Date().toISOString()
});

throw new Error(message);
}
isTokenValid() {
return this.tokenCache && this.tokenExpiry && Date.now() < this.tokenExpiry;
}
getTokenUrl() {
const cloudRegions = {
'us-1': 'https://api.crowdstrike.com',
'us-2': 'https://api.us-2.crowdstrike.com',
'eu-1': 'https://api.eu-1.crowdstrike.com',
'us-gov-1': 'https://api.laggar.gcw.crowdstrike.com'
};
const baseUrl = cloudRegions[this.config.cloudRegion];
if (!baseUrl) {
  throw new Error(`Invalid cloud region: ${this.config.cloudRegion}`);
}

return `${baseUrl}/oauth2/token`;
}
async retryWithBackoff(operation, maxRetries = 3) {
for (let attempt = 1; attempt <= maxRetries; attempt++) {
try {
return await operation();
} catch (error) {
if (attempt === maxRetries) throw error;
    const delay = Math.min(1000 * Math.pow(2, attempt), 10000);
    console.log(`Retry attempt ${attempt} after ${delay}ms`);
    await new Promise(resolve => setTimeout(resolve, delay));
  }
}
}
}
// Usage with error recovery
const authHandler = new FalconMCPAuthHandler({
clientId: process.env.FALCON_CLIENT_ID,
clientSecret: process.env.FALCON_CLIENT_SECRET,
cloudRegion: process.env.FALCON_CLOUD_REGION
});
try {
const token = await authHandler.authenticate();
console.log('Ready to make Falcon API calls');
} catch (error) {
console.error('Failed to authenticate:', error.message);
// Implement alerting to security team
}