Module Overview

The Falcon MCP Server provides the following modules. Each module requires specific CrowdStrike API scopes.

Module	API Scopes	Description
AgentWorks	Charlotte AI Agent Definition: READ, Charlotte AI Agent Definition: WRITE	Calling, listing, and observing CrowdStrike AgentWorks (agentic-studio) Charlotte AI agents and their execution traces
Case Management	Case Templates: READ, Cases: READ, Cases: WRITE	Managing CrowdStrike cases, including searching, creating, updating, and managing evidence and tags
Cloud Security	Cloud Groups V2: READ, Cloud Security API Assets: READ, Cloud Security API Detections: READ, Cloud Security API Risks: READ, Cloud Security Policies: READ, Falcon Container Image: READ, Cloud Security Policies: WRITE	Accessing and analyzing CrowdStrike Falcon cloud resources like Kubernetes & Containers Inventory, Images Vulnerabilities, Cloud Assets, IOM Findings, CSPM Suppression Rules, Cloud Risks, Cloud Groups, and Cloud Insights
Correlation Rules	Correlation Rules: READ, Correlation Rules: WRITE	Correlation Rules module for CrowdStrike Falcon.
Custom IOA	Custom IOA Rules: READ, Custom IOA Rules: WRITE	Searching, creating, updating, and deleting Custom IOA (Indicators of Attack) behavioral rules and rule groups using Falcon Custom IOA Service Collection endpoints
Data Protection	Data Protection: READ	Provides read-only access to Data Protection configuration data — classifications, policies, and content patterns — so an LLM can reason about why a Data Protection detection fired
Detections	Alerts: READ, Alerts: WRITE	Accessing and analyzing CrowdStrike Falcon detections
Discover	Assets: READ	Accessing and managing CrowdStrike Falcon Discover applications, managed assets, and unmanaged assets
Exclusions	IOA Exclusions: READ, Machine Learning Exclusions: READ, Sensor Visibility Exclusions: READ, IOA Exclusions: WRITE, Machine Learning Exclusions: WRITE, Sensor Visibility Exclusions: WRITE	This module provides a unified set of tools for managing CrowdStrike exclusions across four types — IOA, Machine Learning, Sensor Visibility, and Certificate-Based — behind a single `exclusion_type` discriminator
Firewall Management	Firewall Management: READ, Firewall Management: WRITE	Searching and managing firewall rules and rule groups
Fusion SOAR	Workflows: READ, Workflows: WRITE	Searching Fusion SOAR workflow definitions and executions, reading what an execution produced, and running an on-demand workflow
Guardian	AIDR: READ	Provides tools for querying AI agent inventory and activity data
Host Groups	Host Groups: READ, Host Groups: WRITE	Searching, creating, updating, and deleting CrowdStrike Falcon host groups, as well as managing group membership
Hosts	Hosts: READ, Hosts: WRITE	Accessing and managing CrowdStrike Falcon hosts/devices
Identity Protection	Identity Protection Assessment: READ, Identity Protection Detections: READ, Identity Protection Entities: READ, Identity Protection Timeline: READ, Identity Protection GraphQL: WRITE	Accessing and managing CrowdStrike Falcon Identity Protection capabilities
Intel	Actors (Falcon Intelligence): READ, Indicators (Falcon Intelligence): READ, Reports (Falcon Intelligence): READ	Accessing and analyzing CrowdStrike Falcon intelligence data
IOC	IOC Management: READ, IOC Management: WRITE	Searching, creating, and deleting custom IOCs using Falcon IOC Service Collection endpoints
NGSIEM	NGSIEM: READ, NGSIEM: WRITE	Running search queries against CrowdStrike’s Next-Gen SIEM via the asynchronous job-based search API
Policies	Content Update Policies: READ, Device Control Policies: READ, Firewall Management: READ, Prevention Policies: READ, Response Policies: READ, Sensor Update Policies: READ, Content Update Policies: WRITE, Device Control Policies: WRITE, Firewall Management: WRITE, Prevention Policies: WRITE, Response Policies: WRITE, Sensor Update Policies: WRITE	This module provides a unified set of tools for managing CrowdStrike host-based policies across all six policy types — prevention, sensor_update, firewall, device_control, response, and content_update — behind a single `policy_type` discriminator
Quarantine	Quarantined Files: READ, Quarantined Files: WRITE	Investigating quarantined files and applying quarantine actions during triage and remediation workflows
Recon	Monitoring rules (Falcon Intelligence Recon): READ	Searching Falcon Intelligence Recon notifications, monitoring rules, and exposed-data records
Real Time Response	Real time response: READ, real-time-response-audit: READ, Real time response: WRITE	Initiating and inspecting RTR sessions and for executing read-only RTR commands during host investigations
Scheduled Reports	Scheduled Reports: READ	Accessing and managing CrowdStrike Falcon scheduled reports and scheduled searches
Sensor Usage	Sensor Usage: READ	Accessing CrowdStrike Falcon sensor usage data
Serverless	Falcon Container Image: READ	Accessing and managing CrowdStrike Falcon Serverless Vulnerabilities
Shield	SaaS Security: READ, SaaS Security: WRITE	Shield module for CrowdStrike Falcon.
Spotlight	Vulnerabilities: READ	Accessing and managing CrowdStrike Falcon Spotlight vulnerabilities
Zero Trust Assessment	Zero Trust Assessment: READ	Retrieving Zero Trust Assessment posture scores and sensor and OS hardening signals for hosts

CrowdStrike-hosted MCP differences

The two servers differ in how a client reaches a tool. The hosted Falcon MCP works through discovery: a client calls search_tools to find a Falcon tool by name or keyword, then execute_tool to run it with arguments. The self-hosted falcon-mcp server registers each falcon_* tool up front instead, so a client calls one by name with no discovery round-trip.

If you self-host and want the same discovery pattern, enable dynamic mode: it swaps the full tool surface for falcon_search_tools, falcon_execute_tool, and an always-on falcon_list_enabled_tools inventory. Mind the falcon_ prefix — those three are the self-hosted falcon-mcp server’s tools, not the hosted MCP’s.

Module and tool coverage also differs:

Fusion SOAR, Zero Trust Assessment, and Real Time Response are available only on this self-hosted server; the hosted MCP has no equivalent modules.
Cloud Security: falcon_search_cloud_insights, falcon_list_cloud_insight_definitions, and falcon_get_cloud_asset_insights are not available on the hosted MCP.
Discover: falcon_search_managed_assets is not available on the hosted MCP.
Policies: the hosted MCP does not use the unified policy_type-discriminated tools. It instead exposes six policy-type-specific variants of each tool (for example falcon_search_policies_firewall, falcon_create_policy_prevention).