CrowdStrike Falcon MCP Server

CrowdStrike's own server groups tools by module: detections and incidents from endpoint protection, host inventory and status, threat intelligence actors and indicators, cloud posture findings, and identity risk. Modules can be enabled selectively so an analyst working an endpoint case is not handed cloud tooling. The intent is triage support — summarising a detection and its related host history far faster than clicking through the console.