Back to MCP Trust Indexm8ven
C
Emerging
74/100
3 days ago

falcon-mcp

MCP server bridging AI assistants with CrowdStrike Falcon for SOC operations, enabling natural-language triage, investigation, and response across detections, endpoints, threat intelligence, and more.

→ rijul170/falcon-mcp· listed on glama

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

rijul170

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
✅
3 tools verified — handlers match their declared behaviour
3 read-only tools verified — handlers contain no write/delete/exec
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 2 credentials: FALCON_MCP_API_KEY, FALCON_CLIENT_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configFALCON_MCP_TRANSPORTOptional Transport protocol: stdio, sse, or streamable-http (default: stdio) streamable-http
configFALCON_MCP_MODULESOptional Comma-separated list of modules to enable; omit to enable all detections,incidents,intel
configFALCON_MCP_DEBUGOptional Set to true to enable verbose debug logging true
configFALCON_BASE_URLRequired API endpoint URL for your region https://api.crowdstrike.com
configFALCON_MCP_HOSTOptional Bind host for HTTP transports (default: 127.0.0.1) 0.0.0.0
configFALCON_MCP_PORTOptional Bind port for HTTP transports (default: 8000) 8000
configFALCON_MCP_USER_AGENT_COMMENT
configFALCON_MCP_STATELESS_HTTPOptional Set to true to enable stateless HTTP mode for horizontally-scaled deployments true
🔐 secretFALCON_MCP_API_KEYOptional API key for x-api-key header authentication on HTTP transports your-api-key
configFALCON_MEMBER_CIDOptional Default child CID for MSSP Flight Control; targets all queries at that tenant ABC123DEF456GHI789
configFALCON_MCP_READONLYOptional Set to true to suppress all mutating tools at startup true
configFALCON_CLIENT_IDRequired CrowdStrike API Client ID abc123def456
🔐 secretFALCON_CLIENT_SECRETRequired CrowdStrike API Client Secret your-client-secret
configFALCON_MCP_AUDIT_LOG
configFALCON_MCP_ENABLE_GENERATEDOptional Set to 1 to load all 106 auto-generated modules (~1,296 tools total) 1
configFALCON_MCP_ALLOW_DESTRUCTIVEOptional Set to true to enable all destructive tools, or a comma-separated list of specific tool names to allow selectively falcon_perform_host_action,falcon_execute_rtr_active_responder_command
// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/rijul170-falcon-mcp-1i4b82)](https://m8ven.ai/mcp/rijul170-falcon-mcp-1i4b82)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: 5c044069f0f03f369d48c3fef7178832e1aba36c
code hash: 0fc7e7181c6cc125e3ed12030aa38b5fcf244c93b0fd33cea6d7b262e067f3f4
verified: 8/19/2026, 9:56:34 AM
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client