How to Use the CrowdStrike Falcon MCP in OpenAI Agents SDK

Q: Can I use CrowdStrike Falcon to quarantine hosts in OpenAI Agents SDK?

Yes, your agent calls the containdevice tool to isolate any endpoint. This happens instantly once the agent confirms the threat criteria are met.

Directly manage CrowdStrike Falcon threats from your OpenAI Agents SDK production environment.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect CrowdStrike Falcon MCP to OpenAI Agents SDK

Create your Vinkius account to connect CrowdStrike Falcon to OpenAI Agents SDK and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup CrowdStrike Falcon with OpenAI Agents SDK

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Automated incident response with OpenAI Agents SDK

Use `list_incidents` to pull security alerts directly into your agent logic. You can filter by severity or state to focus on high-priority breaches without manual intervention. Once identified, trigger `contain_device` to isolate compromised machines immediately. Your agent handles the response while you monitor the entire lifecycle via the OpenAI dashboard.

Manage device inventory using this MCP Server

The `search_hosts` tool lets your agent query your entire endpoint fleet in real-time. You don't need to hop between dashboards to find specific machine details or verify current status. Keep your data clean by using `create_ioc` to push new indicators of compromise. This keeps your defensive posture synced with the latest threat intel your agents discover.

Refine detection data for OpenAI Agents SDK

Call `list_detections` to grab MITRE ATT&CK mappings for any alert. This gives your agent the necessary context to decide if a threat is a false positive or a real attack. Apply `update_detection` after your agent finishes its investigation. Adding triage comments ensures your human security team has a clear audit trail of what the agent performed.

Setup guide

Set up CrowdStrike Falcon MCP in OpenAI Agents SDK

Prerequisites

Python 3.10+ installed
openai-agents package (pip install openai-agents)
Active Vinkius subscription with a valid endpoint token

1

Install the SDK

Run pip install openai-agents to install the OpenAI Agents SDK. The MCP integration is built-in — no extra dependencies needed.
2

Connect via SSE transport

Use MCPServerSse with your Vinkius endpoint URL. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. The SDK auto-discovers all CrowdStrike Falcon tools at runtime.
3

Create your Agent

Pass the MCP to Agent(mcp_servers=[server]). The agent receives CrowdStrike Falcon tools as native definitions — JSON schemas resolve automatically.
4

Run the agent

Call Runner.run(agent, prompt) to execute. The agent invokes the appropriate CrowdStrike Falcon tools and returns structured results. Copy the full example on the right to get started.

agent.py

import asyncio
from agents import Agent, Runner
from agents.mcp import MCPServerSse

async def main():
    async with MCPServerSse(
        url="https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    ) as server:
        agent = Agent(
            name="CrowdStrike Falcon Agent",
            instructions="You have access to CrowdStrike Falcon tools.",
            mcp_servers=[server],
        )
        result = await Runner.run(agent, "List recent transactions")
        print(result.final_output)

asyncio.run(main())

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by CrowdStrike Falcon. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect CrowdStrike Falcon now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about CrowdStrike Falcon MCP in OpenAI Agents SDK

You initialize the connection using the MCPServerStreamableHttp class within your Python script. Pass the server endpoint to your agent constructor, and the SDK handles tool discovery automatically.

Yes, your agent calls the contain_device tool to isolate any endpoint. This happens instantly once the agent confirms the threat criteria are met.

Your endpoint telemetry stays within your infrastructure. The MCP server acts as a bridge, only passing the specific detection or host data you request to your agent.

Vinkius manages the connection security for you. You simply provide the required endpoint token, and the server handles the handshake with your backend.

The server only touches detection alerts, incident logs, and device inventory metadata. It does not access raw file content or sensitive user credentials outside of security telemetry.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript