Sold by: CrowdStrike
Deployed on AWS
falcon-mcp enables seamless communication between AI agents and the CrowdStrike Falcon platform. Deployable directly onto Amazon Bedrock AgentCore, it provides programmatic access to Falcon data for agentic workflows and accelerating AI-native security automation.
4.5
Overview
This server provides a secure, scalable bridge between AI agents and the CrowdStrike Falcon platform, bringing security telemetry and threat intelligence directly into your AWS environment. Purpose-built for deployment on Amazon Bedrock AgentCore, the falcon-mcp server enables agentic applications to programmatically access detections, incidents, behaviors, and threat intelligence from the Falcon platform. This empowers AI agents to reason over rich security context, automate response workflows, and drive proactive defense across your cloud and enterprise environments. By exposing modular Falcon capabilities through a standardized interface, the falcon-mcp server supports a wide range of use cases, from autonomous incident triage and threat enrichment to building fully agentic, context-aware security operations workflows. The falcon-mcp server gives you the data access layer to build the foundation for an AI-native SOC, backed by the power of the CrowdStrike Falcon platform. To learn more about this resource and explore its capabilities, visit the official project page at: https://github.com/crowdstrike/falcon-mcp
Highlights
- The falcon-mcp server establishes a consistent and secure protocol for agents to communicate with the CrowdStrike Falcon platform, enabling - standardized integration across agentic systems.
- It includes native support for deployment onto Amazon Bedrock AgentCore, making it easy to integrate into your AWS environment and power agentic workflows.
- It is designed to support current and future Falcon platform capabilities, ensuring agentic workflows remain adaptive and comprehensive.
Details
Sold by
Categories
Delivery method
Type
Supported services
Delivery option
Amazon Bedrock AgentCore
Latest version
Operating system
Linux
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Trust center
Access real-time vendor security and compliance information through their Trust Center powered by Drata or Vanta. Review certifications and security standards before purchase.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
This product is available free of charge. Free subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Vendor refund policy
All orders are non-cancellable and all fees and other amounts you pay under this Agreement are non-refundable.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Amazon Bedrock AgentCore
Supported services: Learn more
- Amazon Bedrock AgentCore
Container image
Containers are lightweight, portable execution environments that wrap server application software in a filesystem that includes everything it needs to run. Container applications run on supported container runtimes and orchestration services, such as Amazon Elastic Container Service (Amazon ECS) or Amazon Elastic Kubernetes Service (Amazon EKS). Both eliminate the need for you to install and operate your own container orchestration software by managing and scheduling containers on a scalable cluster of virtual machines.
Version release notes
0.20.2 (2026-11-03)
Bug Fixes
Additional details
Usage instructions
Prerequisites
CrowdStrike API Credentials
Create API credentials in your CrowdStrike console:
- Log into your CrowdStrike console
- Navigate to Support > API Clients and Keys
- Click Add new API client
- Configure your API client:
- Client Name: Choose a descriptive name (e.g., "Falcon MCP Server")
- Description: Optional description for your records
- API Scopes: Select scopes based on which modules you plan to use (see scope requirements )
- Note down these values (you cannot retrieve them later):
- FALCON_CLIENT_ID - Your API client ID
- FALCON_CLIENT_SECRET - Your API client secret
- FALCON_BASE_URL - Your API base URL (region-specific)
AWS VPC Requirements
The MCP Server requires internet connectivity to communicate with CrowdStrike's APIs.
- Internet Gateway or NAT Gateway - Enables outbound internet connectivity
- Outbound HTTPS Access - Allow communication to api.crowdstrike.com on port 443
- Security Groups - Configure appropriate rules for your network requirements
Getting Started
To deploy the Falcon MCP Server to Amazon Bedrock AgentCore:
- Visit the Falcon MCP Server on AWS Marketplace
- Follow the subscription and deployment instructions
- Configure your CrowdStrike API credentials and environment variables as described below
Usage Instructions
Environment Variables
Set the environment variables in the deployment form below; recommended AgentCore values are pre-filled. FALCON_CLIENT_ID, FALCON_CLIENT_SECRET, and FALCON_BASE_URL are required, and FALCON_MCP_STATELESS_HTTP must remain true for AgentCore.
Key Capabilities
- Threat Investigation - Search detections by severity, time range, hostname, or MITRE ATT&CK technique.
- Fleet Management - Find hosts by platform, sensor version, network segment, or containment status.
- Vulnerability Hunting - Access Spotlight CVE data with ExPRT ratings and remediation priorities.
- Threat Intelligence - Look up threat actors, indicators, and intelligence reports.
- Cloud Security - Search CSPM assets, container images, and Kubernetes workloads.
- Identity Protection - Investigate entities, analyze timelines, and map relationships.
- Query Capabilities - Run searches against CrowdStrike Next-Gen SIEM using CQL.
- IOC Management - Search, create, and remove custom indicators of compromise.
- Firewall Auditing - Search and manage Falcon firewall rule groups.
Additional modules support Real Time Response, Scheduled Reports, Shield, and more. For the full module list and required API scopes, see the Falcon MCP modules overview .
Example tool invocation (search for recent detections):
{ "jsonrpc": "2.0", "id": "1", "method": "tools/call", "params": { "name": "falcon_search_detections", "arguments": { "filter": "status:'new'" } } }Additional Resources
For full details, visit the Falcon MCP documentation .
Support
Vendor support
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Transform your AWS security operations with Falcon Next-Gen SIEM. Stop threats fast with unified visibility across AWS security tools and your security ecosystem. Prioritize the alerts that matter most and streamline investigations with automation and AI. Meet key compliance requirements with prebuilt dashboards and log retention. Get started in minutes with automated onboarding and flexible, pay-as-you-go consumption billing.
The AI-native CrowdStrike Falcon Platform provides comprehensive protection across all areas of enterprise risk - devices, identities, data, endpoints and cloud. Powered by a single agent, crowdsourced data, expert threat intelligence, and advanced AI, the Falcon Platform simplifies security operations and stops breaches.
CrowdSec is a CTI tool leveraging crowdsourced data to identify malevolent IPs in real time worldwide. This product allows you to subscribe to CrowdSec's CTI API.
CrowdSec delivers real-time, crowd-powered threat intelligence to preemptively block malicious IPs and reduce security alerts, enabling faster, more accurate cyber reponse, avoid fraud and identity abuses.
Customer reviews
Manufacturing
Nice tool, need improvements
Reviewed on Nov 05, 2026
Review provided by G2
What do you like best about the product?
K8s coverage is a solid feature, and it’s easy to manage overall.
What do you dislike about the product?
The interface can feel complex at times, which makes it harder to find the information I’m looking for.
What problems is the product solving and how is that benefiting you?
The coverage of CrowdStrike in Kubernetes infrastructure clusters.
Manufacturing
Complicated to deploy
Reviewed on Nov 04, 2026
Review provided by G2
What do you like best about the product?
Does what it is supposed to do - protect wirklichste in the cloud
What do you dislike about the product?
Installation is complicated - would prefer easier deployment
What problems is the product solving and how is that benefiting you?
Defend wirklichste I. The cloud from Cyber Monsters
Katie J.
Comprehensive Security Posture Visibility and Vulnerability Management
Reviewed on Nov 04, 2026
Review provided by G2
What do you like best about the product?
One of the aspects I appreciate most about CrowdStrike Falcon Cloud Security is the comprehensive visibility it provides into an organisation's overall security posture and potential vulnerabilities.
I particularly value its ability to highlight a wide range of security risks, including potentially compromised accounts, duplicate or reused passwords, accounts potentially vulnerable to Kerberoasting attacks, dormant accounts, and other identity-related security weaknesses. Having this information readily available makes it significantly easier to identify areas of concern and prioritise potential remediation activities.
I also find the platform incredibly useful when conducting customer security reviews. The ability to review security posture findings, identify affected assets and accounts, and gather relevant information to support security assessments makes the review process considerably more efficient.
Rather than having to manually investigate numerous potential security weaknesses across different systems, CrowdStrike provides a centralised overview that helps streamline security assessments and enables analysts to provide customers with meaningful, actionable recommendations.
Overall, I find the platform to be an invaluable tool for vulnerability management, security posture assessments, and proactively identifying potential risks before they can be exploited.
I particularly value its ability to highlight a wide range of security risks, including potentially compromised accounts, duplicate or reused passwords, accounts potentially vulnerable to Kerberoasting attacks, dormant accounts, and other identity-related security weaknesses. Having this information readily available makes it significantly easier to identify areas of concern and prioritise potential remediation activities.
I also find the platform incredibly useful when conducting customer security reviews. The ability to review security posture findings, identify affected assets and accounts, and gather relevant information to support security assessments makes the review process considerably more efficient.
Rather than having to manually investigate numerous potential security weaknesses across different systems, CrowdStrike provides a centralised overview that helps streamline security assessments and enables analysts to provide customers with meaningful, actionable recommendations.
Overall, I find the platform to be an invaluable tool for vulnerability management, security posture assessments, and proactively identifying potential risks before they can be exploited.
What do you dislike about the product?
One area I feel could be improved is the workflow for reviewing vulnerabilities and their associated affected assets. While CrowdStrike provides excellent visibility into security posture and potential vulnerabilities, investigating individual findings can sometimes be more time-consuming than necessary.
For example, when reviewing a vulnerability affecting multiple assets or users, it would be beneficial to have a consolidated view displaying all relevant information in one place. Currently, I often find myself having to navigate into each affected asset individually to review the associated details, which can become quite tedious when assessing vulnerabilities across a larger environment.
Another limitation I've encountered is the apparent lack of a straightforward option to formally accept the risk associated with a particular finding and subsequently clear or suppress the corresponding recommendation. In situations where a vulnerability has been assessed and the associated risk has been formally accepted by the organisation, having a more accessible risk acceptance workflow would help streamline vulnerability management and reduce unnecessary outstanding recommendations.
Overall, these are primarily workflow and usability improvements rather than criticisms of the platform's detection capabilities, which I find to be excellent.
For example, when reviewing a vulnerability affecting multiple assets or users, it would be beneficial to have a consolidated view displaying all relevant information in one place. Currently, I often find myself having to navigate into each affected asset individually to review the associated details, which can become quite tedious when assessing vulnerabilities across a larger environment.
Another limitation I've encountered is the apparent lack of a straightforward option to formally accept the risk associated with a particular finding and subsequently clear or suppress the corresponding recommendation. In situations where a vulnerability has been assessed and the associated risk has been formally accepted by the organisation, having a more accessible risk acceptance workflow would help streamline vulnerability management and reduce unnecessary outstanding recommendations.
Overall, these are primarily workflow and usability improvements rather than criticisms of the platform's detection capabilities, which I find to be excellent.
What problems is the product solving and how is that benefiting you?
I primarily use CrowdStrike Falcon to conduct quarterly identity protection and security posture reviews for various customers.
The platform helps address the challenge of identifying and assessing potential security weaknesses across customer environments by providing centralised visibility into identity-related risks, such as compromised accounts, reused passwords, dormant accounts, and potential Kerberoasting vulnerabilities.
This is particularly beneficial when conducting quarterly security reviews, as it allows me to efficiently identify areas of concern, assess affected accounts and assets, and gather the relevant information needed to provide customers with meaningful security recommendations.
Having this information readily available significantly reduces the time spent manually gathering evidence and enables a more structured, proactive approach to identifying and addressing potential security risks.
Overall, it makes the quarterly review process considerably more efficient while helping customers better understand their security posture and areas requiring attention.
The platform helps address the challenge of identifying and assessing potential security weaknesses across customer environments by providing centralised visibility into identity-related risks, such as compromised accounts, reused passwords, dormant accounts, and potential Kerberoasting vulnerabilities.
This is particularly beneficial when conducting quarterly security reviews, as it allows me to efficiently identify areas of concern, assess affected accounts and assets, and gather the relevant information needed to provide customers with meaningful security recommendations.
Having this information readily available significantly reduces the time spent manually gathering evidence and enables a more structured, proactive approach to identifying and addressing potential security risks.
Overall, it makes the quarterly review process considerably more efficient while helping customers better understand their security posture and areas requiring attention.
Information Technology and Services
Promising Features
Reviewed on Nov 04, 2026
Review provided by G2
What do you like best about the product?
CrowdStrike leverages its Falcon sensor for active, kernel-level runtime protection. Offers agentless scanning via cloud control-plane APIs for instant asset discovery, vulnerability checks, and misconfigurations
What do you dislike about the product?
Premium pricing. Individuals that are not already proficient with the Falcon platform or Splunk-like query syntax face onboarding hurdle.
What problems is the product solving and how is that benefiting you?
It can automatically detect and terminate malicious processes, prevent container escapes, and isolate compromised cloud instances in real time. This is saving us a lot of time.
Information Technology and Services
Useful CSPM solution
Reviewed on Nov 04, 2026
Review provided by G2
What do you like best about the product?
The overview of all cloud assets and out of the box set of security rules.
What do you dislike about the product?
The impossibility to tailor rules to specific needs. The lack of support of AWS-compatible API on 3rd party IaaS providers.
What problems is the product solving and how is that benefiting you?
Ensuring security of over 100k cloud assets