pod
Other formats agents might prefer:
markdownjsonllms.txt

Agent? You probably want markdown or json, or Pod over MCP.

Reported issues for CrowdStrike Falcon MCP Server

Pod holds 24 of 110 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to CrowdStrike Falcon MCP Server.

Most discussed

[Bug]: Falcon MCP fails auth at startup with valid OAuth token and correct parent CID

Initial Checks

  • I confirm that I'm using the latest version of falcon-mcp
  • I searched existing issues before opening this report

Bug Description

We are testing the falcon-mcp (stdio) integration.

Facts:

  • OAuth2 client-credentials flow succeeds (access_token returned from /oauth2/token)
  • Using parent CID: confirmed by the API key settings
  • Base URL: https://api.crowdstrike.com
  • Minimal module set tested: detections only (even though I provisioned that and more)
  • Environ

Read the thread · 2026-04-17 · closed · external user · 3 comments

[Bug]: Log messages written to stdout break MCP stdio transport compatibility with some clients

Initial Checks

  • I confirm that I'm using the latest version of falcon-mcp
  • I searched existing issues before opening this report

Bug Description

Summary

falcon-mcp writes INFO log messages to stdout when using the stdio transport, which breaks compatibility with MCP clients that strictly parse stdout as JSON-RPC (e.g., Gemini CLI).

Expected Behavior

Log messages should be written to stderr, not stdout. The MCP stdio transport specification expects only valid JSON-

Read the thread · 2026-01-15 · closed · external user · 3 comments

[Bug]: Bug Report: falcon-mcp logs to stdout breaking stdio transport

Initial Checks

  • I confirm that I'm using the latest version of falcon-mcp
  • I searched existing issues before opening this report

Bug Description

Summary falcon-mcp outputs INFO log messages to stdout during initialization when using stdio transport, which breaks JSON-RPC protocol compatibility with MCP clients like Kiro CLI.

Expected Behavior When using stdio transport, falcon-mcp should only output JSON-RPC messages to stdout. All logging should go to stderr or be suppress

Read the thread · 2026-01-14 · closed · external user · 4 comments

[Feature Request]: Add Pagination Metadata (Breaking)

Summary

Wrap search tool responses with pagination metadata to help AI agents understand result set state and efficiently retrieve complete data.

Problem

Current search tools return raw result lists without pagination context:

  • AI agents don't know if more results exist
  • No indication of total count or current position
  • Difficult to implement efficient pagination workflows
  • Agents may miss data or make unnecessary API calls

Proposed Solution

Wrap search responses with paginatio

Read the thread · 2026-01-05 · closed · outside contributor · 3 comments

[Question]: Required Host Header

Initial Checks

  • I searched existing issues and discussions
  • I checked the README and documentation

Question Type

Configuration and authentication

Your Question

We have setup MCP as a streamable-http as required for our setup. Setting up the URL just as:

http://x.x.x.x:8000

Error: "POST / HTTP/1.1" 404 Not Found

Digging around and determined we needed to have a trailing /mcp in the URL. Now our LLM is at least attempting to connect, but appears I need some sort

Read the thread · 2025-12-11 · closed · external user · 4 comments

[Feature Request]: Support NGSIEM advanced search for threat hunting

Feature Description

As the title suggests, the most valuable information provided by Falcon is its reach telemetry and events that can be queried arbitrarily via advanced event search.

Adding that to the MCP server would allow for full-scale security investigations and threat hunting opportunities via AI.

Use Case

As explained above.

Related Module/Area

New module needed

Proposed Solution (Optional)

MCP server supporting the NG SIEM search endpoints.

Alternatives

Read the thread · 2025-11-17 · closed · external user · 17 comments

mcp-use BR: here to help

Hey guys, I am the author of mcp-use. How can I help you here ? What BR are you referring to?

https://github.com/CrowdStrike/falcon-mcp/blob/e0b971c6b4e4dcda693ea7f8407a21a3e847a1dc/pyproject.toml#L41

Read the thread · 2025-07-22 · closed · external user · 3 comments

Add OAuth authentication support

Implement OAuth authentication support to the MCP server.

Use OAuthAuthorizationServerProvider from the MCP SDK, based on this example: https://github.com/modelcontextprotocol/python-sdk?tab=readme-ov-file#authentication

Read the thread · 2025-06-14 · closed · outside contributor · 3 comments

Most recent

exclusions and policies tools document no required scopes at all

scripts/generate_module_docs.py infers a tool's required scopes by regex-matching API operation-name string literals in the source of the tool method and the helpers it calls. exclusions.py and policies.py don't put operation names in method bodies — they hold them as values in a class-level dispatch dict and look them up at runtime:

# falcon_mcp/modules/exclusions.py:87
_OPERATIONS: dict[str, dict[str, str]] = {
    "ioa": {
        "query": "ss_ioa_exclusions_search_v2",
     

[Read the thread](https://github.com/CrowdStrike/falcon-mcp/issues/553) · 2026-08-24 · closed · outside contributor · 0 comments

### Integration filter and sort tests tolerate zero rows, so silent FQL breakage passes

Follow-up to #535.

Most integration tests assert only that a search returned a list of length >= 0. `assert_valid_list_response(..., min_length=0)` appears 112 times across 24 of the 32 integration test files, and another 51 calls omit `min_length` entirely and get the same default. There are 150 `skip_with_warning` calls alongside them.

For a test that exercises a `filter` or a `sort`, that assertion cannot fail. These query APIs return an empty HTTP 200 for an unsupported filter field, an un

[Read the thread](https://github.com/CrowdStrike/falcon-mcp/issues/551) · 2026-08-24 · closed · outside contributor · 0 comments

### No integration test verifies two-step search results honour the requested sort

`_reorder_by_ids` (`falcon_mcp/modules/base.py:198-238`) exists because get-by-ID endpoints return entities in arbitrary order and discard the sort the query step applied. Nothing in `tests/integration/` checks that it works. There are 29 call sites across 18 modules, so a regression of the exact bug it was written to fix would pass CI silently everywhere.

The one order assertion that does exist, `tests/integration/test_detections.py:251`, is on aggregate buckets from a single-call endpoint tha

[Read the thread](https://github.com/CrowdStrike/falcon-mcp/issues/549) · 2026-08-24 · closed · outside contributor · 0 comments

### Audit integration tests for search results indexed as bare lists

Integration tests across the repo index search results directly — `result[0]`, `len(result) > N`, `for x in result`. Where the tool returns the pagination envelope rather than a bare list, `result[0]` raises `KeyError: 0` and `len()` counts the envelope keys instead of the records. So the test either fails outright or, worse, silently skips the only assertion it has.

Both modes were live in the cloud module. Four tests were failing on every run:

- `tests/integration/cloud/test_cloud_iom.py::te

[Read the thread](https://github.com/CrowdStrike/falcon-mcp/issues/548) · 2026-08-24 · closed · outside contributor · 0 comments

### Remove the vestigial tools/list payload budget warning, or make it a growth ratchet

### Feature Description

Delete `test_tools_list_payload_within_budget` from
`tests/test_tools_list_output_schema.py`, or replace it with a growth ratchet.

The check asserts nothing. It only calls `warnings.warn`, so it cannot fail. Its
threshold was calibrated when the catalogue was much smaller, and it has been breached
for many releases without effect.

`tests/test_tools_list_output_schema.py:69-90`

```python
budget = 120_000
if total >= budget:
    warnings.warn(
        f"tools/list paylo

[Read the thread](https://github.com/CrowdStrike/falcon-mcp/issues/546) · 2026-08-23 · closed · outside contributor · 0 comments

### [Bug]: Generated module docs under-report required API scopes when a tool names its operation through a constant

### Initial Checks

- [x] I confirm that I'm using the latest version of falcon-mcp
- [x] I searched existing issues before opening this report

### Bug Description

`docs/modules/*.md` under-reports the API scopes a tool requires. A tool that names
its operation through a module-level constant, or that reaches the API only through
another method, gets **no scopes line at all** — silently. Nothing fails; the page is
just wrong.

The scope data itself is correct. `API_SCOPE_REQUIREMENTS` has the 

[Read the thread](https://github.com/CrowdStrike/falcon-mcp/issues/545) · 2026-08-23 · closed · outside contributor · 0 comments

### Want to add your plugin to awesome-ai-plugins?

Hey, we maintain [awesome-ai-plugins](https://github.com/hashgraph-online/awesome-ai-plugins) and came across `falcon-mcp`. It looks like a great fit alongside the other gemini cli extensions, and we'd love to include it.

Would you be up for submitting it? The whole submission is a small PR adding one entry to `README.md`; [`CONTRIBUTING.md`](https://github.com/hashgraph-online/awesome-ai-plugins/blob/main/CONTRIBUTING.md) shows the format.

Projects listed there can also receive a public profi

[Read the thread](https://github.com/CrowdStrike/falcon-mcp/issues/541) · 2026-08-21 · open · external user · 0 comments

### [Feature Request]: AgentWorks module

### Feature Description

`/agentic-studio` endpoints allow listing and invoking AgentWorks agents.

### Use Case

Allow my MCP-based agent to interact with purpose-built security agents living in AgentWorks.

### Related Module/Area

New module needed

### Proposed Solution (Optional)

_No response_

### Alternatives Considered (Optional)

_No response_

### Additional Context (Optional)

_No response_

[Read the thread](https://github.com/CrowdStrike/falcon-mcp/issues/536) · 2026-08-17 · closed · outside contributor · 0 comments

### feat(modules/discover): add falcon_search_managed_assets for drive encryption and system-insights data

## Summary

There's no way to pull host **drive/disk encryption status** (or the rest of the Asset Details "System insights" data) through the MCP server today. This came up from a customer who was pointed at `falcon_get_host_details` and couldn't find it there.

The data exists in the API — it's just not reachable from any current tool.

## What I found (live-validated)

For a managed Windows host, the **Falcon Discover** host entity (`combined_hosts`, `/discover/combined/hosts/v1`) returns the

[Read the thread](https://github.com/CrowdStrike/falcon-mcp/issues/534) · 2026-08-14 · closed · outside contributor · 0 comments

### perform_policy_action: add-rule-group/remove-rule-group send wrong param name (group_id → should be rule_group_id), causing 400 "Group action parameters must be provided"

### Bug Description

**Version:** 0.16.1 (latest) · **Module:** `falcon_mcp/modules/policies.py`

Calling `perform_policy_action` with `add-rule-group` (or `remove-rule-group`) on a prevention policy always fails with:

400 {"code":400,"message":"Group action parameters must be provided"}


and `resources_affected: 0` — the rule group is never attached to the policy.

**Root cause:** `perform_policy_action` builds the request body with a hardcoded parameter name for every group action:

`

[Read the thread](https://github.com/CrowdStrike/falcon-mcp/issues/530) · 2026-08-11 · closed · external user · 0 comments

### Bug: falcon_update_policy accepts `settings` for firewall policies but the endpoint has none — returns 200 and changes nothing

### Version

falcon-mcp 0.16.0 (latest on PyPI at time of writing), US-2 tenant, `policies` + `firewall` modules.

### Summary

`falcon_update_policy` offers a `settings` parameter for **every** policy type, but the
firewall update endpoint has no `settings` field. Passing one for `policy_type='firewall'`
returns HTTP 200 with an updated-looking policy record while changing nothing. The caller
gets a success response for an operation that did not happen.

### Root cause

`update_policy` puts `se

[Read the thread](https://github.com/CrowdStrike/falcon-mcp/issues/526) · 2026-08-09 · closed · external user · 0 comments

### Bug: falcon_search_firewall_rules silently ignores `q`, and the FQL guide recommends a `name` glob that never matches

### Version

falcon-mcp 0.16.0 (latest on PyPI at time of writing), launched via `uvx falcon-mcp --modules ...,firewall,...`, US-2 tenant.

### Summary

Two separate defects in `falcon_search_firewall_rules` that both fail by returning a **plausible result instead of an error**, so a caller cannot tell a real "no such rule" from a broken query:

1. **`q` is silently ignored.** Any value returns the full unfiltered record set.
2. **A `name` glob silently matches nothing** — and the bundled FQL gu

[Read the thread](https://github.com/CrowdStrike/falcon-mcp/issues/525) · 2026-08-09 · closed · external user · 0 comments

### [Feature Request]: CAO hunting reads (saved queries and guides)

### Feature Description

Add read tools for CAO hunting: search saved hunting queries and search hunting guides. This capability is not currently exposed by falcon-mcp.

### Use Case

As a threat hunter, I want to discover existing saved queries and guides through falcon-mcp so I can reuse vetted hunting content mid-investigation instead of reconstructing it.

### Related Module/Area

New module needed

### Proposed Solution

Add read tools to search saved hunting queries and hunting guides, fol

[Read the thread](https://github.com/CrowdStrike/falcon-mcp/issues/522) · 2026-08-06 · open · outside contributor · 0 comments

### [Feature Request]: NGSIEM management and provisioning reads

### Feature Description

Add NGSIEM management/provisioning read tools: list data connections, parsers, and lookup files, and report provisioning status. Today `search_ngsiem` executes pre-written CQL only; there is no management surface.

### Use Case

As an administrator managing an NGSIEM tenant, I want to enumerate data connections, parsers, and lookup files and check provisioning status through falcon-mcp, so I can inspect the ingest/parse configuration alongside search.

### Related Module

[Read the thread](https://github.com/CrowdStrike/falcon-mcp/issues/521) · 2026-08-06 · open · outside contributor · 0 comments

### [Feature Request]: Recon corpus-aggregate / preview search

### Feature Description

Add a Recon corpus-aggregate / preview search tool. The Recon module today exposes record reads (rules, notifications, exposed-data records) but no corpus-aggregate or rule-preview capability.

### Use Case

As an analyst building or validating a Recon monitoring rule, I want to preview how a query matches against the corpus before committing it, so I can tune coverage without creating noisy rules.

### Related Module/Area

Recon module

### Proposed Solution

Add a corp

[Read the thread](https://github.com/CrowdStrike/falcon-mcp/issues/520) · 2026-08-06 · closed · outside contributor · 1 comment

### [Feature Request]: Threat Graph module

### Feature Description

Add a Threat Graph module so agents can retrieve summaries for an indicator/vertex, list what an artifact ran on, and enumerate typed edges from a vertex.

### Use Case

As an analyst pivoting from an indicator, I want to traverse Threat Graph relationships (summary, ran-on, edges) to expand scope across related hosts and artifacts, without leaving falcon-mcp.

### Related Module/Area

New module needed

### Proposed Solution

Add read tools for vertex summary, ran-on lo

[Read the thread](https://github.com/CrowdStrike/falcon-mcp/issues/519) · 2026-08-06 · open · outside contributor · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/CrowdStrike/falcon-mcp/issues).