CrowdStrike Falcon Connector for AI agents.
8 live capabilities
Manage endpoint security and triage threat alerts in real time.
Waiting for input…
Why people use CrowdStrike Falcon
CrowdStrike Falcon for Faster Incident Response
This Connector lets you skip the clicks. You can ask your agent to find the host, check the sensor version, and update the incident status in one go. You get a clear picture of the threat without the tab fatigue.
What Vinkius changes
You get a conversational interface for your entire security operations center.
Use it from Claude, ChatGPT, Cursor or another AI client you already have.
One account · 5,900+ Connectors
- Real-world use case 01
Triage a critical alert
A SOC analyst asks the agent to find all critical detections from the last hour and update the status of a Credential Dumping alert.
- Real-world use case 02
Audit sensor health
An IT manager asks the agent to find all endpoints running outdated sensors and list the top 5 affected departments.
- Real-world use case 03
Rapid response to a breach
A security engineer identifies a malicious IP and asks the agent to create a new IOC and contain the affected device immediately.
Complete set · 8capabilities
The complete CrowdStrike Falcon capability set.
These are the exact actions your AI can choose when you ask it to work with CrowdStrike Falcon.
01—04
4 capabilities in this set.
Part of 8 available through CrowdStrike Falcon.
- 01 Capability
List detections
Query detection alerts using FQL filters to see severity and MITRE mappings. This helps you prioritize which threats need immediate attention.
- 02 Capability
Update detection
Change the status of an alert and add triage comments to the record. It keeps your team updated on the current state of an investigation.
- 03 Capability
Search hosts
Search the device inventory to get full endpoint details and OS info. Use this to quickly identify the hardware and software on a target host.
- 04 Capability
List incidents
Filter and view security incidents by state, severity, or assigned user. This gives you a clear view of your active security posture.
05—08
4 capabilities in this set.
Part of 8 available through CrowdStrike Falcon.
- 05 Capability
List iocs
View your custom indicators of compromise including types, values, and actions. It lets you audit what threats you are currently tracking.
- 06 Capability
Create ioc
Add new custom IOCs like SHA256 hashes, domains, or IP addresses to your list. This streamlines your threat intelligence ingestion.
- 07 Capability
List vulnerabilities
Query Spotlight vulnerability data to find CVEs and remediation statuses. Use this to identify the weakest links in your network.
- 08 Capability
Contain device
Contain or lift containment on a specific host to stop a threat in its tracks. This is your primary capability for rapid incident response.
Set up in minutes
One URL. Then ask CrowdStrike Falcon to work.
Claude and ChatGPT only need the Connector URL. Copy it once, add it in settings, and use CrowdStrike Falcon from the conversation.
Choose your client
Live previewAdvanced clients IDE · CLI
Claude · Web + desktop
Connector URL · ready to paste
Streamable HTTPhttps://edge.vinkius.com/vk_preview_Uam95HEcDSo3obA4xKgBdXTFdUwShAgA5MEsKr32/mcp - Step 01
Open Connectors
In Claude Web or Claude Desktop, open Settings and choose Connectors.
- Step 02
Add the URL
Choose Add custom connector, name it CrowdStrike Falcon, and paste the URL above.
- Step 03
Turn it on in chat
Select +, open Connectors, and enable CrowdStrike Falcon for the conversation.
ChatGPT · Web + desktop
Connector URL · ready to paste
Streamable HTTPhttps://edge.vinkius.com/vk_preview_Uam95HEcDSo3obA4xKgBdXTFdUwShAgA5MEsKr32/mcp - Step 01
Open MCP settings
On desktop, open Settings and MCP servers. On web, open your workspace app or connector settings.
- Step 02
Add the URL
Choose Add server with Streamable HTTP, or create a custom MCP app, then paste the CrowdStrike Falcon URL.
- Step 03
Save and start
Save the connection and enable CrowdStrike Falcon in your conversation. Desktop may ask you to restart once.
Cursor · IDE configuration
Advanced setup
{
"mcpServers": {
"crowdstrike-falcon": {
"url": "https://edge.vinkius.com/vk_preview_Uam95HEcDSo3obA4xKgBdXTFdUwShAgA5MEsKr32/mcp"
}
}
}- Step 01
Open MCP Settings
Press Cmd+Shift+P (macOS) or Ctrl+Shift+P (Windows/Linux) → search "MCP Settings"
- Step 02
Add the server config
Paste the JSON configuration above into the mcp.json file that opens
- Step 03
Save the file
Cursor will automatically detect the new Connector
- Step 04
Start using CrowdStrike Falcon
Open Agent mode in chat and ask: "Using CrowdStrike Falcon, help me...". 8 tools available
VS Code Copilot · IDE configuration
Advanced setup
{
"mcpServers": {
"crowdstrike-falcon": {
"url": "https://edge.vinkius.com/vk_preview_Uam95HEcDSo3obA4xKgBdXTFdUwShAgA5MEsKr32/mcp"
}
}
}- Step 01
Create MCP config
Create a .vscode/mcp.json file in your project root
- Step 02
Add the server config
Paste the JSON configuration above
- Step 03
Enable Agent mode
Open GitHub Copilot Chat and switch to Agent mode using the dropdown
- Step 04
Start using CrowdStrike Falcon
Ask Copilot: "Using CrowdStrike Falcon, help me...". 8 tools available
Windsurf · IDE configuration
Advanced setup
{
"mcpServers": {
"crowdstrike-falcon": {
"url": "https://edge.vinkius.com/vk_preview_Uam95HEcDSo3obA4xKgBdXTFdUwShAgA5MEsKr32/mcp"
}
}
}- Step 01
Open MCP Settings
Go to Settings → MCP Configuration or press Cmd+Shift+P and search "MCP"
- Step 02
Add the server
Paste the JSON configuration above into mcp_config.json
- Step 03
Save and reload
Windsurf will detect the new server automatically
- Step 04
Start using CrowdStrike Falcon
Open Cascade and ask: "Using CrowdStrike Falcon, help me...". 8 tools available
Cline · IDE configuration
Advanced setup
{
"mcpServers": {
"crowdstrike-falcon": {
"url": "https://edge.vinkius.com/vk_preview_Uam95HEcDSo3obA4xKgBdXTFdUwShAgA5MEsKr32/mcp"
}
}
}- Step 01
Open Cline MCP Settings
Click the Connectors icon in the Cline sidebar panel
- Step 02
Add remote server
Click "Add Connector" and paste the configuration above
- Step 03
Enable the server
Toggle the server switch to ON
- Step 04
Start using CrowdStrike Falcon
Ask Cline: "Using CrowdStrike Falcon, help me...". 8 tools available
Claude Code · Terminal command
Advanced setup
claude mcp add crowdstrike-falcon --transport http "https://edge.vinkius.com/vk_preview_Uam95HEcDSo3obA4xKgBdXTFdUwShAgA5MEsKr32/mcp"- Step 01
Install Claude Code
Run npm install -g @anthropic-ai/claude-code if not already installed
- Step 02
Add the Connector
Run the command above in your terminal
- Step 03
Verify the connection
Run claude mcp to list connected servers, or type /mcp inside a session
- Step 04
Start using CrowdStrike Falcon
Ask Claude: "Using CrowdStrike Falcon, show me...". 8 tools are ready
Where the request belongs
Work CrowdStrike Falcon can move forward.
For the SOC analyst who is tired of clicking through hundreds of alerts at 3 AM. It's for security engineers who need to automate IOC management and CISOs who need a high-level view of fleet health without digging through raw logs.
SOC Analyst
Triaging detections and updating incident statuses during high-pressure shifts.
Security Engineer
Managing large lists of IOCs and hunting for specific threat patterns.
IT Operations Manager
Checking sensor coverage and endpoint compliance across the whole company.
When one Connector is not enough
Carry the request into a workflow.
Combine CrowdStrike Falcon with the systems that finish the task.
View all recipesBuild the capability set
Add more capabilities.
Each Connector adds new actions and data without changing how you work.
Browse ConnectorsTrend Micro
Equip your AI agent with Vision One telemetry to investigate threats, audit endpoint activities, and manage security alerts natively.
Halo Security
Automate attack surface management via Halo Security. monitor assets, scans, and vulnerabilities directly from any AI agent.
CrowdSec
Automate threat intelligence via CrowdSec. query local decisions, stream security updates, and check global IP reputation directly from any AI agent.
Intruder
Automate vulnerability scanning and security monitoring via Intruder.io API.
Senar.io
Detect and respond to security threats with AI-powered SIEM that correlates events across your infrastructure in real time.
Elastic Security
Manage SIEM and SOC operations via Elastic Security. monitor detection rules, search security alerts (Signals), handle whitelisting, and audit threat coverage directly from any AI agent.
Bring your own AI
Change the model, client or framework. Keep CrowdStrike Falcon connected.
-
Claude -
ChatGPT -
Gemini -
Cursor -
VS Code -
Windsurf -
ZCode -
Cline -
Zed -
Continue -
Kiro -
Roo Code -
Zencoder -
Goose -
Void -
Augment Code -
Amp -
Qodo -
Tabnine -
Pieces -
Sourcegraph Cody -
JetBrains -
Warp -
Amazon Q -
Antigravity -
BoltAI -
Raycast -
Jan -
LM Studio -
AnythingLLM -
Open WebUI -
Msty -
Cherry Studio -
LibreChat -
TypingMind -
Chorus -
5ire -
n8n -
LangChain -
LlamaIndex -
CrewAI -
Vercel AI SDK
Before you connect
Questions about CrowdStrike Falcon.
The practical details behind the request, access and result.
Can I use the CrowdStrike Falcon MCP to triage alerts?
Yes, it lets you query detections and update statuses directly. You can ask your agent to find specific alerts and then tell it to add triage comments or change the status.
Does the CrowdStrike Falcon MCP support IOC management?
Yes, it allows you to create and list custom indicators of compromise. You can quickly add new hashes, domains, or IPs to your threat intelligence list.
Can I use this to see which devices are out of compliance?
Yes, the Connector can search your host inventory for sensor versions and OS info. This makes it easy to identify which machines need software updates.
How does the CrowdStrike Falcon MCP help with ransomware?
It helps by allowing you to quickly list and create IOCs related to specific campaigns. You can also use it to isolate a compromised device immediately.
Can I isolate a device using the CrowdStrike Falcon MCP?
Yes, it includes a capability to contain or lift containment on specific hosts. This allows you to stop a threat in its tracks using only natural language commands.
Does the CrowdStrike Falcon MCP show me my vulnerabilities?
Yes, it can query your Spotlight vulnerability data to find CVEs and remediation statuses across your managed endpoints.
What authentication does CrowdStrike use?
CrowdStrike uses OAuth 2.0 Client Credentials. You create an API Client in the Falcon Console under Support > API Clients and Keys. The server automatically obtains and caches Bearer tokens using your Client ID and Secret.
Which cloud regions are supported?
All CrowdStrike commercial clouds: US-1 (api.crowdstrike.com), US-2 (api.us-2.crowdstrike.com), EU-1 (api.eu-1.crowdstrike.com), and US-GOV-1. Configure the Base URL credential to match your tenant region.
Can it triage detections automatically?
Yes. The list_detections capability returns severity, tactic, technique, and device context. An AI agent can use this to auto-triage low/medium detections and escalate critical ones, reducing SOC analyst workload by 60-80%.
One connection away
Give your agent a direct line to CrowdStrike Falcon.
Connect CrowdStrike Falcon once. Keep it beside 5,900+ managed Connectors when the next task needs more.
Explore every Connector No credit card required · Free tier available