{ "$schema": "https://readbeforerun.ai/schema/entry.schema.json", "entry": { "id": "crowdstrike-falcon-mcp", "name": "CrowdStrike Falcon MCP Server", "summary": "MCP server that connects agents to the CrowdStrike Falcon platform: detections, threat intel, host management and response.", "draft": "review", "type": "mcp-server", "mission": [ "defensive" ], "task": [ "alert-triage", "threat-intel-enrichment" ], "domain": [ "security-operations", "threat-intelligence" ], "runtime": [ "mcp-generic", "gemini-cli" ], "tier": "tried", "last_checked": "2026-11-07", "next_check": "2027-05-06", "freshness": "fresh", "superseded": false, "in_my_kit": null, "advice": null, "code_shows": "can tunnel or exfiltrate · writes outside the project · changes config or installs globally · Approval: unknown", "source": { "repo": "https://github.com/CrowdStrike/falcon-mcp", "subpath": null, "commit": "17fea062558312dfbf981ea09f7ce58a11ea31fb", "version": "v0.19.0", "license": "MIT" }, "install": { "skills_cli": null, "claude_code": null, "upstream": "uv tool install falcon-mcp", "bundled": false }, "scan": { "status": "static scan pending (not run)" }, "reach": { "method": "reach-v0.1", "level": 3, "level_source": "static", "level_label": "privileged", "unknown_axes": 1, "verdict": "beyond-declared", "badge": "reach 3 · beyond declared (1)", "long": "reach 3 from code (privileged); lab: beyond declared on 1 of 6 rights: secrets", "declared": { "fs": 2, "net": 3, "exec": 1, "cred": 1, "persist": 2, "hitl": 0 }, "static": { "level": 3, "fs": 2, "net": 3, "exec": 1, "cred": 1, "persist": 2, "hitl": null, "unknown": [ "hitl" ] }, "observed": { "level": 3, "fs": null, "net": 1, "exec": 0, "cred": 3, "persist": 0, "hitl": 0, "unknown": [ "fs" ], "run": "2026-11-07" }, "surplus": { "axes": { "fs": null, "net": 0, "exec": 0, "cred": 2, "persist": 0, "hitl": 0 }, "count": 1, "beyond_static": [ "cred" ], "headline": "Beyond declared on 1 of 6 rights: secrets (observed 3, declared 1), reading ~/.netrc on every API request." }, "fit": "partial", "exports": { "aivss": { "fs": 0.5, "net": 1, "exec": 0.5, "cred": 0.5, "persist": 0.5, "hitl": null }, "usf_risk_tier": "L3" } }, "profile": { "read_at": "17fea062558312dfbf981ea09f7ce58a11ea31fb", "read_on": "2026-10-25", "overview": "falcon-mcp is an MCP server that connects AI agents with the CrowdStrike Falcon platform and gives them programmatic access to detections, threat intelligence, host management and other security capabilities.", "purpose": [ "Gives AI agents access to a CrowdStrike Falcon tenant for security analysis and automation.", "Supports threat investigation, detection triage and security operations from AI assistants such as Claude Desktop, VS Code, Gemini CLI and custom agents." ], "use_cases": [ { "text": "Find Falcon detections by severity, status, hostname or time range", "task": "alert-triage" }, { "text": "Research threat actors and adversary groups tracked by CrowdStrike intelligence", "task": "threat-intel-enrichment" }, { "text": "Collect host evidence with read-only RTR commands such as ls, ps, cat, filehash and reg", "task": "dfir" }, { "text": "Turn a CQL query into a scheduled NG-SIEM correlation rule", "task": "detection-engineering" } ], "maturity": "preview", "capabilities": [ { "name": "Detections", "effects": [ "reads", "changes" ], "enabled": "default" }, { "name": "Hosts", "effects": [ "reads", "changes" ], "enabled": "default" }, { "name": "Intel", "effects": [ "reads" ], "enabled": "default" }, { "name": "Real Time Response", "effects": [ "reads", "changes", "runs-commands" ], "enabled": "default" }, { "name": "NGSIEM", "effects": [ "reads" ], "enabled": "default" }, { "name": "Correlation Rules", "effects": [ "reads", "changes", "deletes" ], "enabled": "default" }, { "name": "Policies", "effects": [ "reads", "changes", "deletes" ], "enabled": "default" }, { "name": "Exclusions", "effects": [ "reads", "changes", "deletes" ], "enabled": "default" }, { "name": "Quarantine", "effects": [ "reads", "changes", "deletes" ], "enabled": "default" }, { "name": "Fusion SOAR", "effects": [ "reads", "changes" ], "enabled": "default" } ], "effects": [ "reads", "changes", "deletes", "runs-commands" ], "runs": "local-process", "listens": [ { "mode": "optional", "bind": "configurable", "sign_in": "optional" } ], "sends_to": [ { "to": "CrowdStrike Falcon API", "kind": "vendor-api", "when": "always" }, { "to": "HTTP/HTTPS proxy", "kind": "other", "when": "optional" }, { "to": "PyPI", "kind": "download", "when": "default" }, { "to": "quay.io", "kind": "download", "when": "optional" } ], "model": "client", "needs": [ { "kind": "account", "text": "Access to a CrowdStrike console in which to create API credentials." }, { "kind": "credentials", "text": "A Falcon API client with its Client ID and Client Secret; the quickstart enables at minimum Hosts:read and Alerts:read." }, { "kind": "runtime", "text": "Python 3.11 or higher." }, { "kind": "tools", "text": "uv or pip to install the package." }, { "kind": "setting", "text": "The Falcon API base URL for the tenant's CrowdStrike region (US-1, US-2, EU-1 or US-GOV); US-1 is the default." }, { "kind": "credentials", "text": "The Falcon API client's scopes are selected according to the modules the user plans to enable; each module requires its own CrowdStrike API scopes." } ] }, "urls": { "page": "/catalog/crowdstrike-falcon-mcp/", "json": "/entries/crowdstrike-falcon-mcp.json", "md": "/catalog/crowdstrike-falcon-mcp.md", "badge": "/badge/crowdstrike-falcon-mcp.svg" } }, "data": { "schema_version": "0.5", "slug": "crowdstrike-falcon-mcp", "name": "CrowdStrike Falcon MCP Server", "summary": "MCP server that connects agents to the CrowdStrike Falcon platform: detections, threat intel, host management and response.", "draft": "review", "in_my_kit": null, "type": "mcp-server", "mission": [ "defensive" ], "task": [ "alert-triage", "threat-intel-enrichment" ], "domain": [ "security-operations", "threat-intelligence" ], "phase": [ "def:detect", "def:respond" ], "role": [ "soc" ], "runtime": [ "mcp-generic", "gemini-cli" ], "auth": "oauth2", "autonomy": null, "addresses": [], "frameworks": { "owasp_ast": [], "owasp_asi": [], "attack_tactic": [], "atlas": [] }, "source": { "repo": "https://github.com/CrowdStrike/falcon-mcp", "commit": "17fea062558312dfbf981ea09f7ce58a11ea31fb", "version": "v0.19.0", "license": "MIT", "manifest": "server.json", "also_listed": {} }, "upstream": { "checked_at": "2026-10-19", "updated_at": "2026-10-08", "current_release": "v0.19.0", "archived": false, "stars": 271, "commit_history": {}, "releases_since_pin": 0 }, "install": { "upstream": "uv tool install falcon-mcp", "upstream_evidence": "README.md#L69-73", "bundled": false }, "scan": [ { "tool": "cisco-skill-scanner", "version": "not-run", "llm_judge": false, "date": "2026-10-19", "result": "pending" } ], "privileges": { "method": "reach-v0.1", "declared": { "axes": { "fs": 2, "net": 3, "exec": 1, "cred": 1, "persist": 2, "hitl": 0 }, "evidence": { "fs": "README.md#L48 the Quarantine module can release, unrelease or delete quarantined files on endpoints, i.e. restore or delete files on the target", "net": "README.md#L168-171 the documented container launch binds the streamable-http transport to every network interface, which declares a network-reachable listener beyond the loopback default", "exec": "README.md#L49 execution is declared as read-only RTR triage on endpoints", "cred": "server.json#L29-35 one CrowdStrike API client secret supplied by the user", "persist": "README.md#L47 the server creates, updates and deletes Falcon policies, i.e. changes target configuration", "hitl": "falcon_mcp/server.py#L49-51 the server instructions tell agents to confirm intent before any state-changing tool and declare no pre-approvals" } }, "static": { "level": 3, "axes": { "fs": 2, "net": 3, "exec": 1, "cred": 1, "persist": 2, "hitl": null }, "evidence": { "fs": "falcon_mcp/modules/quarantine.py#L265-270 delete_quarantined_files deletes quarantined files on endpoints by id or by an FQL filter", "net": "falcon_mcp/server.py#L456-472 the HTTP transport starts uvicorn on the operator-supplied host and only warns when a non-loopback address such as all interfaces is used without an api-key, which is a network-reachable listener; falcon_mcp/server.py#L553 stdio is the default transport, and the HTTP host defaults to 127.0.0.1 (L587-591) with an optional --api-key (L616-620)", "exec": "falcon_mcp/modules/rtr.py#L534-541 runs RTR commands on an endpoint through the read-only RTR_ExecuteCommand endpoint, with no local shell", "cred": "falcon_mcp/client.py#L51-52 reads one API client id and secret from parameters or environment variables, with no credential store access", "persist": "falcon_mcp/modules/policies.py#L873-894 enables, disables, attaches and deletes Falcon policies, i.e. changes target configuration", "hitl": "no evidence: the code sets no approval configuration; the server only instructs connecting agents to confirm intent, which is guidance rather than an enforced gate" }, "unknown": [ "hitl" ] }, "observed": { "level": 3, "axes": { "fs": null, "net": 1, "exec": 0, "cred": 3, "persist": 0, "hitl": 0 }, "unknown": [ "fs" ], "run": "runs/2026-11-07", "valid_for": { "commit": "17fea062558312dfbf981ea09f7ce58a11ea31fb", "version": "v0.19.0" } }, "surplus": { "axes": { "fs": null, "net": 0, "exec": 0, "cred": 2, "persist": 0, "hitl": 0 }, "count": 1, "beyond_static": [ "cred" ], "headline": "Beyond declared on 1 of 6 rights: secrets (observed 3, declared 1), reading ~/.netrc on every API request." }, "fit": "partial", "min_config": { "status": "derived", "note": "derived from the code; of it, the lab ran stdio with --read-only and --modules detections against a stub of the API (runs/2026-11-07); prefer the stdio transport, run with --read-only or a narrow --modules set, give the API client only the scopes those modules need, never bind the HTTP transport to 0.0.0.0 without an api-key, and keep FALCON_MCP_TRANSPORT out of any .env file in the working directory" }, "override": null, "reviews": [] }, "status": { "tier": "tried", "last_checked": "2026-11-07", "next_check": "2027-05-06", "freshness": "fresh", "superseded": false, "superseded_by": null, "added": "2026-10-19", "added_by": "scout" }, "evidence": { "label": "observation", "runs": [ "runs/2026-11-07" ], "badge": "/badge/crowdstrike-falcon-mcp.svg" }, "changes": [ { "date": "2026-11-07", "value": "tier", "from": "listed", "to": "tried", "reason": "First lab run published (runs/2026-11-07): falcon-mcp over stdio, read-only, detections module, against the lab's stub of the Falcon API; observed reach 3, beyond declared on secrets." } ] }, "profile": { "schema_version": "0.1", "entry": "crowdstrike-falcon-mcp", "draft": "review", "commit": "17fea062558312dfbf981ea09f7ce58a11ea31fb", "read_on": "2026-10-25", "check": { "date": "2026-10-25", "facts": 57, "confirmed": 57, "verified": 51 }, "overview": { "text": "falcon-mcp is an MCP server that connects AI agents with the CrowdStrike Falcon platform and gives them programmatic access to detections, threat intelligence, host management and other security capabilities.", "ev": "README.md#L15 author's own description of the project" }, "maturity": { "word": "preview", "text": "The README marks the project as a public preview under active development whose features may change before a stable 1.0 release.", "ev": "README.md#L18 public preview notice" }, "purpose": [ { "text": "Gives AI agents access to a CrowdStrike Falcon tenant for security analysis and automation.", "ev": "server.json#L5 registry description" }, { "text": "Supports threat investigation, detection triage and security operations from AI assistants such as Claude Desktop, VS Code, Gemini CLI and custom agents.", "ev": "docs/overview.md#L9 stated purpose of the docs overview" } ], "use_cases": [ { "text": "Find Falcon detections by severity, status, hostname or time range", "task": "alert-triage", "ev": "docs/modules/detections.md#L22 falcon_search_detections usage" }, { "text": "Research threat actors and adversary groups tracked by CrowdStrike intelligence", "task": "threat-intel-enrichment", "ev": "docs/modules/intel.md#L21 falcon_search_actors description" }, { "text": "Collect host evidence with read-only RTR commands such as ls, ps, cat, filehash and reg", "task": "dfir", "ev": "docs/modules/rtr.md#L126 falcon_execute_rtr_read_only_command description" }, { "text": "Turn a CQL query into a scheduled NG-SIEM correlation rule", "task": "detection-engineering", "ev": "docs/modules/correlationrules.md#L42 falcon_create_correlation_rule description" } ], "not_for": [ { "text": "The authors ask users to avoid production deployments while the project is in public preview.", "ev": "README.md#L18 public preview notice" } ], "capabilities": { "coverage": "partial", "missing": "Core, AgentWorks, Cases, Cloud Security, Custom IOA, Discover, Firewall, Guardian, Host Groups, Identity Protection, IOC, Recon, Shield, Spotlight and 5 more modules", "groups": [ { "name": "Detections", "does": "Searches, aggregates and retrieves Falcon detections (alerts) and updates their status, assignment, visibility, comments and tags.", "effects": [ "reads", "changes" ], "enabled": "default", "ev": "docs/modules/detections.md#L78 falcon_update_detections description" }, { "name": "Hosts", "does": "Searches hosts and their sensor state, retrieves host details, and adds or removes Falcon Grouping Tags on hosts.", "effects": [ "reads", "changes" ], "enabled": "default", "ev": "docs/modules/hosts.md#L55 falcon_manage_host_grouping_tags description" }, { "name": "Intel", "does": "Researches threat actors, IOCs and intelligence reports.", "effects": [ "reads" ], "enabled": "default", "ev": "README.md#L44 Intel module row" }, { "name": "Real Time Response", "does": "Searches and audits RTR sessions, opens and refreshes a session on one host, runs read-only RTR commands and polls their output.", "effects": [ "reads", "changes", "runs-commands" ], "enabled": "default", "ev": "docs/modules/rtr.md#L7 RTR module description" }, { "name": "NGSIEM", "does": "Executes CQL queries against Next-Gen SIEM.", "effects": [ "reads" ], "enabled": "default", "ev": "README.md#L46 NGSIEM module row" }, { "name": "Correlation Rules", "does": "Searches, creates, updates and permanently deletes NG-SIEM correlation rules.", "effects": [ "reads", "changes", "deletes" ], "enabled": "default", "ev": "docs/modules/correlationrules.md#L75 falcon_delete_correlation_rules description" }, { "name": "Policies", "does": "Searches, creates, updates and deletes six host policy types and manages host-group assignment, enable/disable and precedence.", "effects": [ "reads", "changes", "deletes" ], "enabled": "default", "ev": "README.md#L47 Policies module row" }, { "name": "Exclusions", "does": "Searches, creates, updates and deletes IOA, machine learning, sensor visibility and certificate-based exclusions.", "effects": [ "reads", "changes", "deletes" ], "enabled": "default", "ev": "README.md#L37 Exclusions module row" }, { "name": "Quarantine", "does": "Searches quarantine records, previews action counts, and releases, unreleases or deletes quarantined files.", "effects": [ "reads", "changes", "deletes" ], "enabled": "default", "ev": "README.md#L48 Quarantine module row" }, { "name": "Fusion SOAR", "does": "Searches Fusion SOAR workflow definitions and executions, reads execution results and starts on-demand workflows.", "effects": [ "reads", "changes" ], "enabled": "default", "ev": "README.md#L39 Fusion SOAR module row" } ] }, "architecture": { "summary": { "text": "falcon-mcp calls the CrowdStrike Falcon API through the APIHarnessV2 client from FalconPy.", "ev": "falcon_mcp/client.py#L17-18 Falcon API client import" }, "runs": { "where": "local-process", "text": "By default the AI client starts falcon-mcp as a subprocess and talks to it over stdin/stdout.", "ev": "docs/usage/transports.md#L17 stdio default transport" }, "modes": [ { "where": "local-service", "mode": "SSE or streamable HTTP", "switch": "--transport streamable-http", "text": "With --transport streamable-http (or --transport sse) it runs as an HTTP server on the user's machine, listening at 127.0.0.1:8000 by default.", "ev": "docs/usage/transports.md#L55 streamable-http start command" }, { "where": "container", "mode": "Docker image", "switch": "docker run -i --rm", "text": "Runs from the quay.io/crowdstrike/falcon-mcp image, over stdio with -i or over HTTP with a published port.", "ev": "README.md#L166 container stdio run" } ], "parts": [ { "name": "MCP client configuration", "zone": "client", "does": "An mcpServers entry in the AI client that starts falcon-mcp with uvx and an --env-file path.", "ev": "docs/getting-started/quickstart.md#L41 editor MCP configuration step" }, { "name": "falcon-mcp server", "zone": "machine", "does": "Python console program falcon-mcp, started through the entry point falcon_mcp.server:main.", "ev": "pyproject.toml#L43 console entry point" }, { "name": ".env file", "zone": "machine", "does": "Holds FALCON_CLIENT_ID, FALCON_CLIENT_SECRET, FALCON_BASE_URL and optional server settings read at startup.", "ev": "docs/getting-started/configuration.md#L38 .env file as configuration source" }, { "name": "CrowdStrike Falcon API", "zone": "outside", "does": "Regional Falcon REST API that issues OAuth2 tokens and serves all module operations.", "ev": "falcon_mcp/client.py#L53-55 default API base URL" }, { "name": "AgentWorks Charlotte AI agents", "zone": "outside", "does": "Charlotte AI agents in the Falcon tenant that the AgentWorks module can list, invoke and observe.", "ev": "docs/modules/agentworks.md#L94 falcon_invoke_agentworks_agent description" }, { "name": "Docker container", "zone": "container", "does": "Optional python:3.13-alpine image that runs falcon-mcp as the non-root user app.", "ev": "Dockerfile#L49 non-root user creation" } ], "listens": [ { "what": "With an HTTP transport, uvicorn listens on 127.0.0.1:8000 by default; --host and --port change it, --api-key requires an x-api-key header.", "mode": "optional", "bind": "configurable", "sign_in": "optional", "ev": "falcon_mcp/server.py#L589 default bind host" } ], "connections": [ { "to": "CrowdStrike Falcon API", "kind": "vendor-api", "when": "always", "what": "Authenticates with the API client id and secret at startup, then sends every tool call to the regional Falcon API base URL.", "ev": "falcon_mcp/server.py#L158-159 authentication at startup" }, { "to": "HTTP/HTTPS proxy", "kind": "other", "when": "optional", "what": "Routes outbound Falcon API traffic through the proxy set in --proxy or FALCON_PROXY_URL.", "ev": "falcon_mcp/client.py#L82-84 proxy configuration" }, { "to": "PyPI", "kind": "download", "when": "default", "what": "The registry entry starts the PyPI package falcon-mcp through uvx, which resolves the package from PyPI.", "ev": "server.json#L14-17 PyPI package with uvx runtime hint" }, { "to": "quay.io", "kind": "download", "when": "optional", "what": "The container route pulls the falcon-mcp image from quay.io.", "ev": "README.md#L163 image pull" } ], "model": { "who": "client", "text": "The AI client's model (Claude Desktop, VS Code, Gemini CLI or a custom agent) calls the Falcon tools.", "ev": "docs/overview.md#L9 clients that use the server" } }, "needs": [ { "kind": "account", "text": "Access to a CrowdStrike console in which to create API credentials.", "ev": "docs/getting-started/credentials.md#L6 prerequisite" }, { "kind": "credentials", "text": "A Falcon API client with its Client ID and Client Secret; the quickstart enables at minimum Hosts:read and Alerts:read.", "ev": "docs/getting-started/quickstart.md#L14 minimum scopes" }, { "kind": "runtime", "text": "Python 3.11 or higher.", "ev": "docs/getting-started/installation.md#L8 prerequisite" }, { "kind": "tools", "text": "uv or pip to install the package.", "ev": "docs/getting-started/installation.md#L9 prerequisite" }, { "kind": "setting", "text": "The Falcon API base URL for the tenant's CrowdStrike region (US-1, US-2, EU-1 or US-GOV); US-1 is the default.", "ev": "docs/getting-started/credentials.md#L27 region URL selection" }, { "kind": "credentials", "text": "The Falcon API client's scopes are selected according to the modules the user plans to enable; each module requires its own CrowdStrike API scopes.", "ev": "docs/getting-started/credentials.md#L16-23 scope selection per module when creating the API client" } ], "installer": [ { "text": "uv tool install falcon-mcp installs the falcon-mcp package from PyPI as a uv tool without naming a version, so it takes the latest release rather than the checked v0.19.0.", "ev": "README.md#L72 documented install command" }, { "text": "One configuration option downloads .env.example from the main branch with curl and saves it as .env in the current directory.", "ev": "docs/getting-started/configuration.md#L49 curl download of example config" }, { "text": "The Docker guide's recommended route pulls the quay.io/crowdstrike/falcon-mcp:latest image tag.", "ev": "docs/deployment/docker.md#L13 image pull with latest tag" } ], "limits": [ { "text": "The HTTP transports have no authentication by default; binding beyond loopback without --api-key logs a warning and the server still starts.", "ev": "docs/getting-started/configuration.md#L101-102 HTTP transport security" }, { "text": "By default all available modules are enabled; --modules or FALCON_MCP_MODULES restricts which modules load.", "ev": "docs/getting-started/configuration.md#L78 default module selection" }, { "text": "A module is enabled as a whole, so enabling it for its search tools also exposes its mutating tools; --read-only, --tools and --exclude-tools narrow the surface per tool.", "ev": "README.md#L202-203 module granularity" }, { "text": "BaseModule._add_tool gives every tool registered without annotations the READ_ONLY_ANNOTATIONS default.", "ev": "falcon_mcp/modules/base.py#L120-126 default tool annotations" }, { "text": "The server instructions ask the agent to confirm the user's intent before calling tools marked readOnlyHint=false or destructiveHint=true.", "ev": "falcon_mcp/server.py#L49-51 BASE_INSTRUCTIONS text" }, { "text": "The RTR module uses the read-only RTR command endpoint and does not expose RTR Admin, Active Responder, remediation or arbitrary script execution.", "ev": "falcon_mcp/resources/rtr.py#L429-431 RTR investigation guide" }, { "text": "The Docker guide's streamable-http example publishes port 8000 and binds 0.0.0.0 without --api-key.", "ev": "docs/deployment/docker.md#L32-33 streamable-http example" }, { "text": "What falcon_execute_workflow does depends on the Fusion SOAR workflow named; a workflow may contain a host, disable an identity or notify third parties.", "ev": "docs/modules/fusion.md#L102-104 falcon_execute_workflow caution" }, { "text": "The authors warn that Grouping Tags set through falcon_manage_host_grouping_tags can drive dynamic host group and policy assignment, so changing them may change a host's security posture.", "ev": "docs/modules/hosts.md#L58-59 author warning on grouping tags" }, { "text": "falcon_invoke_agentworks_agent runs a Charlotte AI agent on a prompt and spends credits; the run continues server-side after a timeout.", "ev": "docs/modules/agentworks.md#L96-98 invocation cost" }, { "text": "The README describes falcon-mcp as a community-driven open source project that is not an official CrowdStrike product but is maintained by CrowdStrike.", "ev": "README.md#L310 support statement" }, { "text": "With --read-only a tool is withheld unless its readOnlyHint annotation is True, so the filter relies on the annotations set in the code.", "ev": "falcon_mcp/tool_filter.py#L161-168 _is_mutating treats anything other than readOnlyHint=True as mutating" }, { "text": "falcon_execute_rtr_read_only_command sends the agent's base_command and command_string unchanged to the RTR_ExecuteCommand operation; the module code applies no command list of its own.", "ev": "falcon_mcp/modules/rtr.py#L534-541 command parameters passed straight into the API request body" } ], "not_found": [ { "field": "capability_count", "searched": "README.md, docs/modules/overview.md, docs/getting-started/quickstart.md; quickstart says 'all 16 modules' (unit not in allowed list) while README lists 28 modules; no stated tool count" }, { "field": "connection (telemetry)", "searched": "falcon_mcp/server.py, falcon_mcp/client.py, falcon_mcp/modules/*.py imports and pyproject.toml dependencies for telemetry or analytics endpoints" }, { "field": "need (authorization)", "searched": "README.md, SUPPORT.md, docs/getting-started/*.md for authorised-use statements" }, { "field": "not_for (beyond preview notice)", "searched": "README.md, docs/overview.md, docs/usage/*.md for out-of-scope statements" } ] }, "verdict": null, "runs": [ { "schema_version": "0.5", "run_id": "20261107T180703Z-crowdstrike-falcon-mcp", "entry": "crowdstrike-falcon-mcp", "draft": "review", "label": "observation", "method_version": "0.1", "reach_method": "reach-v0.1", "published": "2026-11-07", "run_by": "Ilja Schlak", "disclaimer": "One run is an observation, not a benchmark. Observed reach holds for exactly this configuration: falcon-mcp over stdio with --modules detections --read-only, driven by Claude Code with Haiku, against a lab stub of the Falcon API with dummy credentials.", "tool": { "name": "CrowdStrike Falcon MCP Server", "commit": "17fea062558312dfbf981ea09f7ce58a11ea31fb", "version": "v0.19.0", "install_source": "upstream", "declared_file": "declared.json" }, "runtime": { "client": "claude-code", "client_version": "2.1.311", "permission_mode": "dontAsk with the lab approver: every tool call asks, the task list below allows, everything else is denied", "allow_list": [ "mcp__falcon__falcon_check_connectivity", "mcp__falcon__falcon_search_detections (limit matching ^[1-9]$)" ], "sandbox": { "lab_vm": true, "external_allowlist_empty": true, "dns_via_lab_resolver": true, "target_only": true }, "user": "tool (uid 1001), no sudo" }, "model": { "id": "claude-haiku-5-5", "dated": "2026-11-07", "route": "direct", "virtual_key": "tool", "inference_region": "global" }, "target": { "name": "Lab stub of the CrowdStrike Falcon API (fixtures/api-stub, plain HTTP on the lab target)", "version": "0.1.0", "ground_truth": "n/a: the stub answers with fixed, empty results; no planted findings", "contamination": "written for the lab; no vendor data; the credentials given to the tool are lab dummies" }, "access_mode": "white-box", "task_given": "Lab measurement task. Use only the tools of the MCP server falcon. First call falcon_check_connectivity. Then call falcon_search_detections once with limit 5 and no other arguments. Then answer in one sentence what the two calls returned. Do not call any other tool.", "timebox_minutes": 6, "overnight": false, "phases": { "install": { "start": "2026-11-07T18:07:03Z", "end": "2026-11-07T18:09:12Z", "egress_hosts": [ "files.pythonhosted.org", "pypi.org" ] }, "run": { "start": "2026-11-07T18:09:25Z", "end": "2026-11-07T18:11:32Z", "egress_hosts": [] } }, "duration_seconds": 127, "budget_cap_usd": 0.5, "cost": { "cost_source": "tool-reported", "total_cost": 0.0016, "input_tokens": 67764, "output_tokens": 334, "duration_seconds": 127, "cost_per_hour": 0.0443, "file": "cost.json" }, "result": { "score": "Task done: the connectivity check reported connected and the detection search returned the empty list the lab stub serves. Nothing to score: this run measures reach, not detection.", "findings_reported": 0, "sample_validated": 0, "true_positives": 0, "false_positives": 0, "scope_violations": [], "file": "findings.jsonl", "notes": "falcon-mcp signs in to the Falcon API when it starts and exits if that fails (falcon_mcp/server.py lines 158 to 162 at the pinned commit), so with dummy credentials against CrowdStrike it would never reach the MCP handshake. The lab therefore points FALCON_BASE_URL at its own stub of the API (tool-cmd.sh). The server made three requests, all to the stub: two token requests and one detection query (target-access.txt lines 3 to 5). The server process opened ~/.netrc three times, matching those requests in order and spacing (host-events.jsonl lines 5 to 7). falconpy 1.6.4, the API library it uses, calls requests without an auth argument (falconpy/_util/_functions.py line 423), and requests then looks up the request's host in ~/.netrc and would use credentials it finds there. The canary netrc planted for this run had no entry for the stub's address, so nothing was attached, and the runner made no DNS query and no connection outside the lab. An earlier run the same day without a cost cap (20261107T174922Z) showed the same three reads. The install took the 34 locked packages with their hashes from the project's uv.lock through the lab proxy." }, "reach_observed": { "level": 3, "axes": { "fs": { "value": null, "evidence": "no evidence: no writes besides result paths (fs-diff.json); reads are not audited, so 0 (reads only the working directory) and 1 (reads outside) cannot be told apart; /tmp in the runner is a tmpfs and invisible to fs-diff" }, "net": { "value": 1, "evidence": "target-access.txt#L3-5 connection to the declared target (run->tgt)" }, "exec": { "value": 0, "evidence": "none found: no execve besides the tool itself (tool start host-events.jsonl#L3: python3); harness starts L1, L2 (timeout, start wrapper, preparation) are not counted for the tool" }, "cred": { "value": 3, "evidence": "host-events.jsonl#L5-7 the falcon-mcp process opened /home/tool/.netrc, a canary file planted for this run, three times, matching its three API requests in order and spacing; target-access.txt#L3-5 the three requests to the lab stub (two token requests, one detection query)" }, "persist": { "value": 0, "evidence": "none found: no persistence paths in fs-diff.json (outside the lab's churn filter) and no writes to the watched start-up files (auditd persist: shell rc, autostart, systemd --user)" }, "hitl": { "value": 0, "evidence": "none found: no pre-approvals brought by the tool and no bypass: each of the 2 actions produced an event in the lab approver (2 allowed by the task list, 0 denied; hitl-events.jsonl), 2 executions, all approved; no tool output in session.txt asks for an auto mode or a bypass" } }, "unknown": [ "fs" ] }, "surplus": { "axes": { "fs": null, "net": 0, "exec": 0, "cred": 2, "persist": 0, "hitl": 0 }, "count": 1, "beyond_static": [ "cred" ], "headline": "Beyond declared on 1 of 6 rights: secrets (observed 3, declared 1), reading ~/.netrc on every API request." }, "fit": "partial", "verdict": { "use_again": "with-limits", "one_sentence": "Did the read-only detection search cleanly through the lab stub, but every API request makes it look up ~/.netrc for credentials, a store it does not declare.", "limits": "Measured once against a lab stub of the Falcon API with dummy credentials, read-only and with the detections module only; other modules, write tools, the HTTP transport and real tenant data were not run. The ~/.netrc lookup comes from the requests library under falconpy and happens on every request: run the server under an account whose ~/.netrc has no entry for the Falcon API host. It signs in when it starts, so it offers no tool without working credentials; give the API client only the scopes of the modules you enable." }, "min_config_tested": { "claude_code": "claude -p with model claude-haiku-5-5, MCP server over stdio (falcon: $HOME/.local/falcon-mcp-venv/bin/falcon-mcp --transport stdio --modules detections --read-only); no other tools allowed by the task list" }, "incidents": { "realtime_alerts": 0, "aborted": false }, "artifacts": { "manifest": "manifest.json", "declared": "declared.json", "cost": "cost.json", "egress": "egress.jsonl", "blocked": "blocked.jsonl", "fs_diff": "fs-diff.json", "host_events": "host-events.jsonl", "hitl_events": "hitl-events.jsonl", "findings": "findings.jsonl", "score": "score.json", "cast": { "file": "session.cast", "size_bytes": 1504, "markers": [ "00:02 first tool call", "00:05 result" ] }, "transcript": "session.txt", "extra": [ "dns.jsonl", "gateway-sets.txt", "install-egress.jsonl", "target-access.txt", "tool-cmd.sh" ], "secret_scan": { "redact": "gateway-sets.txt: lines 1-11 only: the allow sets run_allow and run_tgt at run time; the rest of the gateway ruleset is not published; scan of all published files by analysis/export-package.py for this run's canary values, bait texts, key patterns and host identifiers: no hits", "gitleaks": "not run: not installed on the lab host; the scan above instead", "date": "2026-11-07" }, "private": [ "allowlist-driver.txt", "allowlist.txt", "approver-policy.json", "diff/driver.json", "diff/gateway.json", "diff/runner.json", "diff/target.json", "dns-servers.txt", "pcap/labctl0.pcap", "pcap/labrun0.pcap", "pcap/labtgt0.pcap", "pcap/labwan0.pcap", "preflight.json", "preflight.log", "profile.yaml", "proxy-policy.json", "raw/allowlist-all.txt", "raw/canaries.txt", "raw/cred-inventory-after.csv", "raw/cred-inventory-before.csv", "raw/driver.xml", "raw/fs-diff-raw.csv", "raw/install-lock.json", "raw/install-pip-freeze.txt", "raw/install-source-tree.json", "raw/mcp_ed25519", "raw/mcp_ed25519.pub", "raw/model-drive.log", "raw/model-in/budget_usd", "raw/model-in/max_turns", "raw/model-in/mcp.json", "raw/model-in/model", "raw/model-in/route", "raw/model-in/task.txt", "raw/model-in/timebox", "raw/model/claude-version.txt", "raw/model/end", "raw/model/end_epoch", "raw/model/rc", "raw/model/start", "raw/model/start_epoch", "raw/model/stderr.txt", "raw/model/stream.tsjsonl", "raw/phase-times.txt", "raw/runner-audit.log", "raw/runner-tmp-fstype.txt", "raw/seed/aws-credentials", "raw/seed/netrc", "raw/seed/npmrc", "raw/session.jsonl", "raw/tool-status.json", "sensors/dns.log", "sensors/egress.flows", "sensors/gw-sets.txt", "sensors/install-dns.log", "sensors/install-fs-diff.json", "target-url.txt", "task.txt" ] }, "interests": "Private project, privately funded. The author is employed by an IT consultancy; the company is neither client nor sponsor of this measurement and had no influence on selection, execution or result. No business relationship with the maintainers of the tested tool; no credits, licences or payments accepted from tested vendors. Deviations are stated in this field.", "right_of_reply": "dispute-process", "replications": [] } ] }