Use the upstream install or setup path that matches your environment:
cmake \
make -j$(($nproc-1)) falco_unit_tests;
Requirements and caveats from upstream:
A demo environment is provided via a docker-compose file that can be started on a docker host which includes falco, falcosidekick, falcosidekick-ui and its required redis database. For more information see the [docker...
As a security tool meant to consume a crazy high throughput of events per second, Falco needs to squeeze performance in all hot paths at runtime and requires deep control on memory allocation, which the Go runtime can...
Basic usage or getting-started notes:
If you're new to Falco, begin your journey with our Getting Started guide. For production deployments, please refer to our comprehensive [Setup](https://falco.org/docs/setup/...
As final recommendations before deploying Falco, verify environment compatibility, define your detection goals, optimize performance, choose the appropriate build, and plan for SIEM or data lake integration to ensure...
1---2name: falco-runtime-security3description: Falco Runtime Security4---56# Falco Runtime Security78910## Installation1112Use the upstream install or setup path that matches your environment:13- cmake \14- make -j$(($nproc-1)) falco_unit_tests;1516Requirements and caveats from upstream:17- A demo environment is provided via a docker-compose file that can be started on a docker host which includes falco, falcosidekick, falcosidekick-ui and its required redis database. For more information see the [docker...18- As a security tool meant to consume a crazy high throughput of events per second, Falco needs to squeeze performance in all hot paths at runtime and requires deep control on memory allocation, which the Go runtime can...1920Basic usage or getting-started notes:21- If you're new to Falco, begin your journey with our [Getting Started](https://falco.org/docs/getting-started/) guide. For production deployments, please refer to our comprehensive [Setup](https://falco.org/docs/setup/...22- As final recommendations before deploying Falco, verify environment compatibility, define your detection goals, optimize performance, choose the appropriate build, and plan for SIEM or data lake integration to ensure...23- ### Demo Environment2425- Source: https://github.com/falcosecurity/falco26- Extracted from upstream docs: https://raw.githubusercontent.com/falcosecurity/falco/HEAD/README.md2728## Source2930- [Agent Skill Exchange](https://agentskillexchange.com/skills/falco-runtime-security/)3132---33> Source: [agentskillexchange/skills](https://github.com/agentskillexchange/skills) — distributed by [TomeVault](https://tomevault.io).34<!-- tomevault:4.0:skill_md:2026-05-22 -->
Run npx skillmds@latest add tomevault-io/falco-runtime-security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Falco Runtime Security It is listed under Security on SkillMD.
This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.
tomevault-io