Skip to content
Falcon MCP

Flight Control (MSSP)

The Falcon MCP Server supports CrowdStrike Flight Control for MSSP (Managed Security Service Provider) environments. Use parent CID API credentials with the --member-cid flag or FALCON_MEMBER_CID environment variable to target a specific child CID.

Configuration

Section titled “Configuration”

Environment variable:

Terminal window
export FALCON_MEMBER_CID="abc123-child-cid-xyz"
falcon-mcp

Command-line flag:

Terminal window
falcon-mcp --member-cid "abc123-child-cid-xyz"

In .env file:

Terminal window
# Parent CID credentials (required)
FALCON_CLIENT_ID=parent-client-id
FALCON_CLIENT_SECRET=parent-client-secret


# Child CID to target (optional)
FALCON_MEMBER_CID=abc123-child-cid-xyz

Requirements

Section titled “Requirements”
  • Parent CID API credentials (FALCON_CLIENT_ID and FALCON_CLIENT_SECRET from the parent tenant)
  • Flight Control enabled on the parent tenant
  • Valid child CID identifier
  • Parent API client must have appropriate scopes for operations on the child CID

Behavior

Section titled “Behavior”
  • Session-level: All tools in the server instance target the specified child CID
  • Cannot switch mid-session: The member_cid is set during authentication and persists for the server’s lifetime
  • Multiple child CIDs: To query multiple child CIDs, run separate server instances on different ports

Multi-Tenant Workflow

Section titled “Multi-Tenant Workflow”

To work with multiple child CIDs simultaneously, run separate server instances:

Terminal window
# Parent CID (default)
falcon-mcp --transport streamable-http --port 8000
Terminal window
# Child CID 1
falcon-mcp --member-cid "child-cid-1" --transport streamable-http --port 8001
Terminal window
# Child CID 2
falcon-mcp --member-cid "child-cid-2" --transport streamable-http --port 8002

Each instance maintains its own authentication context and can be accessed independently by your MCP client.