# Investigate CrowdStrike Falcon alerts and telemetry through falcon-mcp

> Use falcon-mcp when an agent needs CrowdStrike Falcon detections, incidents, behaviors, threat intel, or read-only response context to triage a security event without leaving an MCP workflow.

- Skill: `agentskillexchange/investigate-crowdstrike-falcon-alerts-and-telemetry-through-` (Agent Skill)
- Install (CLI): `npx skillmds@latest add agentskillexchange/investigate-crowdstrike-falcon-alerts-and-telemetry-through-`
- Raw SKILL.md: https://api.skillmd.com/api/skills/agentskillexchange/investigate-crowdstrike-falcon-alerts-and-telemetry-through-/raw
- Safety review: pending (external: skill-scanner PASS, skillspector CAUTION)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: agentskillexchange (https://skillmd.com/u/agentskillexchange)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/agentskillexchange/investigate-crowdstrike-falcon-alerts-and-telemetry-through-

---


# Investigate CrowdStrike Falcon alerts and telemetry through falcon-mcp

Use falcon-mcp when an agent needs CrowdStrike Falcon detections, incidents, behaviors, threat intel, or read-only response context to triage a security event without leaving an MCP workflow.

## Prerequisites

Python 3.10+ with uv or pip; CrowdStrike Falcon API credentials with the scopes required for the enabled modules; an MCP-compatible client such as Claude Code, Claude Desktop, Cursor, or OpenClaw.

## Installation

Use the upstream install or setup path that matches your environment:
- uv tool install falcon-mcp
- pip install falcon-mcp
- docker pull quay.io/crowdstrike/falcon-mcp:latest
- docker run -i --rm --env-file /path/to/.env quay.io/crowdstrike/falcon-mcp:latest

Requirements and caveats from upstream:
- [![PyPI - Python Version](https://img.shields.io/pypi/pyversions/falcon-mcp)](https://pypi.org/project/falcon-mcp/)
- ### Docker
- "falcon-mcp-docker": {

Basic usage or getting-started notes:
- | [Sensor Usage](https://crowdstrike.github.io/falcon-mcp/modules/sensor-usage/) | Access and analyze sensor usage data |
- #### Using uv (recommended)
- bash

- Source: https://github.com/CrowdStrike/falcon-mcp
- Extracted from upstream docs: https://raw.githubusercontent.com/CrowdStrike/falcon-mcp/HEAD/README.md

## Documentation

- https://github.com/CrowdStrike/falcon-mcp/tree/main/docs

## Source

- [Agent Skill Exchange](https://agentskillexchange.com/skills/investigate-crowdstrike-falcon-alerts-and-telemetry-through-falcon-mcp/)