Connectors · Identity & security
CrowdStrike Falcon MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to CrowdStrike Falcon and the rest of your systems. It gives your agent 1,534 CrowdStrike Falcon actions (941 reads, 429 writes and 164 that wait for a confirmation) and holds the CrowdStrike Falcon credential itself, so the agent never does. It paces CrowdStrike Falcon's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "crowdstrike_falcon.hosts.combined_devices_by_filter", intent: "check which CrowdStrike Falcon account is connected"}# Search for hosts in your environment by platform, hostname, IP, and other criteria · read · 1 upstream call- 1,534actionsin one signed file
- 941readlook, never change
- 429writecreate and update
- 164wait for a yesdestructive, confirmed first
Set up
Connect CrowdStrike Falcon in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect CrowdStrike Falcon.
OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.
client_idCrowdStrike API client IDclient_secretCrowdStrike API client secret (shown once when the client is created)tenant_hostWhere your CrowdStrike Falcon lives: your tenant host
account { op: "connections.requirements", service: "crowdstrike_falcon" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "crowdstrike_falcon.hosts.combined_devices_by_filter" }# search for hosts in your environment by platform, hostname, ip, and other criteria · read · 1 upstream callcheck { action: "crowdstrike_falcon.iocs.create_ioc", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
CrowdStrike Falcon at a glance
- Sign-in
- OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.
- You provide
client_idclient_secret- Setup fields
tenant_host- Limits we pace to
- 6,000 calls a minute, per connection
- API covered
- CrowdStrike Falcon OAuth2 API (FalconPy endpoint map, main branch)
api.crowdstrike.com - Built from
- CrowdStrike Falcon's documentation, read 22 October 2026GitHubdeveloper.crowdstrike.com
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 931 of 941 reads, for up to 5 minutes; a write clears what it affects
- Shared entities
- 2, so ask can line CrowdStrike Falcon up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in CrowdStrike Falcon.
1,534 actions in 136 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 941readlook, never change
- 429writecreate and update
- 164destructivewait for a confirmation
Ngsiem
7220 read · 41 write · 11 destructive
Add multiple labels to a single dashboard · Add multiple labels to a single file · Add multiple labels to a saved query · Add labels to multiple dashboards (max 100 items, non-transactional)
Kubernetes protection
6456 read · 6 write · 2 destructive
Creates a new AWS account in our system for a customer and generates the installation script · Creates a new Azure Subscription in our system · Retrieve containers by container_runtime_version · Retrieve containers count affected by zero day vulnerabilities
Aspm
5333 read · 16 write · 4 destructive
Get findings of a given type for an application resource, with filtering, sorting and pagination · Create a new relay node · Create a new integration · Create new integration task
Data protection configuration
5222 read · 20 write · 10 destructive
Create classifications · Persist the given cloud application for the provided entity instance · Persist the given content pattern for the provided entity instance · Persist the given enterprise account for the provided entity instance
Case management
5125 read · 20 write · 6 destructive
Get access tag aggregates · Get file details aggregates as specified via json in the request body · Get notification groups aggregations · Get notification groups aggregations
It automation
4220 read · 16 write · 6 destructive
Cancel a task execution specified in the request · Returns full details of scheduled tasks matching the filter query parameter · Creates a new policy of the specified type · Creates a scheduled task from the given request
CSPM registration
4022 read · 14 write · 4 destructive
Refresh certificate and returns JSON object(s) that contain the base64 encoded certificate for a service principal · Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the fo · Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment · Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to
Saas security
3623 read · 12 write · 1 destructive
POST Connect a Check Tag to a Security Check · POST App Journal Comment · POST Security Check Journal Comment · POST User Journal Comment
128 more areas · 1,124 actions
- Aidr 33
- Firewall management 33
- User management 33
- Cloud policies 30
- Filevantage 30
- MSSP 30
- Recon 25
- Intel 24
- Real time response 22
- Browser security 21
- D4C registration 21
- Custom ioa 20
- Sensor update policies 19
- Workflows 19
- Correlation rules 18
- Custom storage 18
- Device control policies 18
- Falcon container 18
- Falcon complete dashboard 17
- Ioc 17
- Ods 17
- Cloud azure registration 16
- Hosts 16
- Admission control policies 15
- Code security 15
- ML exclusions 15
- Ioa exclusions 14
- Container images 13
- Discover 13
- Real time response admin 13
- Container image compliance 11
- Content update policies 11
- Image assessment policies 11
- Alerts 10
- Container vulnerabilities 10
- Exposure management 10
- Firewall policies 10
- Host migration 10
- Kubernetes container compliance 10
- Prevention policies 10
- Response policies 10
- Sensor download 10
- Application abuse exclusions 9
- Cloud connect aws 9
- Cloud google cloud registration 9
- Falconx sandbox 9
- Host group 9
- Installation tokens 9
- Iocs 9
- Profile groups 9
- Cloud snapshots 8
- Identity protection 8
- Sample uploads 8
- Scanning orchestrator 8
- API clients 7
- Cao hunting 7
- Cloud aws registration 7
- Cloud oci registration 7
- Cloud security 7
- Container detections 7
- Container packages 7
- Malquery 7
- Message center 7
- Network scan zones 7
- Certificate based exclusions 6
- Deployments 6
- Foundry logscale 6
- Network scan networks 6
- Network scan scans 6
- Network scan templates 6
- Quarantine 6
- Threatgraph 6
- Agents 5
- Cloud security assets 5
- Drift indicators 5
- FDR 5
- Knowledge bases 5
- Network containment 5
- Network scan scan runs 5
- Quick scan pro 5
- Sensor visibility exclusions 5
- Spotlight vulnerabilities 5
- Tailored intelligence 5
- Agent invocation 4
- Audit 4
- Cloud security detections 4
- Downloads 4
- Falcon id 4
- Network scan detections 4
- Network scan scanners 4
- Quick scan 4
- Spotlight evaluation logic 4
- API integrations 3
- Container alerts 3
- Federated connections 3
- Knowledge base audit events 3
- Knowledge base files 3
- Report executions 3
- Scheduled reports 3
- Serverless exports 3
- Skills 3
- Unidentified containers 3
- Zero trust assessment 3
- Access scopes 2
- Agent templates 2
- Agent versions 2
- Cloud security compliance 2
- Configuration assessment 2
- Correlation rules admin 2
- Delivery settings 2
- Device content 2
- Event streams 2
- Intelligence feeds 2
- Intelligence indicator graph 2
- Mobile enrollment 2
- Models 2
- Network scan global configs 2
- Sensor usage 2
- Spans 2
- Tools 2
- Cloud security registration combined 1
- Cloud security risks 1
- Configuration assessment evaluation logic 1
- Faas execution 1
- Real time response audit 1
- Serverless vulnerabilities 1
- Spotlight vulnerability metadata 1
- Stream 1
Top actions
The CrowdStrike Falcon API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
crowdstrike_falcon.alerts.post_combined_alerts_v1Retrieves all Alerts that match a particular FQL filter | Retrieves all Alerts that match a particular FQL filter. | read | this connector |
crowdstrike_falcon.hosts.combined_devices_by_filterSearch for hosts in your environment by platform, hostname, IP, and other criteria | Search for hosts in your environment by platform, hostname, IP, and other criteria. | read | this connector |
crowdstrike_falcon.iocs.create_iocCreate a new IOC | Create a new IOC. | write | this connector |
crowdstrike_falcon.iocs.query_io_csSearch the custom IOCs in your customer account | Search the custom IOCs in your customer account. | read | this connector |
crowdstrike_falcon.ioc.action_query_v1Query Actions | Query Actions. | read | this connector |
crowdstrike_falcon.ioc.ioc_type_query_v1Query IOC Types | Query IOC Types. | read | this connector |
crowdstrike_falcon.hosts.get_device_detailsGet details on one or more hosts by providing host IDs in a POST body | Get details on one or more hosts by providing host IDs in a POST body. | read | this connector |
crowdstrike_falcon.user_management.create_userDeprecated : Please use createUserV1 Create a new user | Deprecated : Please use createUserV1 Create a new user. | write | this connector |
crowdstrike_falcon.alerts.get_queries_alerts_v1Deprecated: please use version v2 of this endpoint | Deprecated: please use version v2 of this endpoint. | read | this connector |
crowdstrike_falcon.host_group.query_host_groupsSearch for Host Groups in your environment by providing an FQL filter and paging details | Search for Host Groups in your environment by providing an FQL filter and paging details. | read | this connector |
crowdstrike_falcon.host_group.create_host_groupsCreate Host Groups by specifying details about the group to create | Create Host Groups by specifying details about the group to create. | write | this connector |
crowdstrike_falcon.iocs.delete_iocDelete an IOC by providing a type and value | Delete an IOC by providing a type and value. | destructive | this connector |
Try it
Prompts to paste into Claude.
Each one names the CrowdStrike Falcon actions it will call, so you know what it reads and what it changes before you send it.
- Readread
Which CrowdStrike Falcon alerts are open right now? Group them by service.
calls
crowdstrike_falcon.alerts.post_combined_alerts_v1 - Writewrite
Create a new IOC in CrowdStrike Falcon. Show me exactly what you will send before you save it.
calls
crowdstrike_falcon.iocs.create_ioc
Governance for CrowdStrike Falcon
Destructive actions wait for a yes.
164 CrowdStrike Falcon actions are destructive. The first 10:
- Delete an IOC by providing a type and value
crowdstrike_falcon.iocs.delete_ioc - Take various actions on the hosts in your environment
crowdstrike_falcon.hosts.perform_action_v2 - Delete Indicators by ids
crowdstrike_falcon.ioc.indicator_delete_v1 - Deprecated : Please use deleteUserV1 Delete a user permanently
crowdstrike_falcon.user_management.delete_user - Batch executes an RTR read-only command across the hosts mapped to the given batch ID
crowdstrike_falcon.real_time_response.batch_cmd - Delete a set of Host Groups by specifying their IDs
crowdstrike_falcon.host_group.delete_host_groups - Delete a user permanently
crowdstrike_falcon.user_management.delete_user_v1 - Apply actions to one or more User
crowdstrike_falcon.user_management.user_action_v1 - Permanently delete hosts from the system
crowdstrike_falcon.hosts.devices_actions_delete_v1 - Delete an RTR session file
crowdstrike_falcon.real_time_response.rtr_delete_file
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
Delete an IOC by providing a type and value?
intent: the user asked me to delete an IOC by providing a type and value
account { op: "keys.create", name: "crowdstrike-falcon-agent", allowed_actions: ["crowdstrike_falcon.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "crowdstrike_falcon.iocs.delete_ioc", approver: "[email protected]" }, { match: "crowdstrike_falcon.hosts.perform_action_v2", approver: "[email protected]" }, { match: "crowdstrike_falcon.ioc.indicator_delete_v1", approver: "[email protected]" } ]}Cost
What CrowdStrike Falcon costs on actionlake.
Every CrowdStrike Falcon action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call CrowdStrike Falcon refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 1,534 CrowdStrike Falcon actions
- 1,534actions pageeach page of a long list is one call
- 931reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every CrowdStrike Falcon action.
1,534 actions by area: the id your agent calls, what it does, and its effect.
Ngsiem72
crowdstrike_falcon.ngsiem.add_dashboard_labelsAdd multiple labels to a single dashboardwritecrowdstrike_falcon.ngsiem.add_file_labelsAdd multiple labels to a single filewrite- and 70 more in this area
Kubernetes protection64
crowdstrike_falcon.kubernetes_protection.create_aws_accountCreates a new AWS account in our system for a customer and generates the installation scriptwritecrowdstrike_falcon.kubernetes_protection.create_azure_subscriptionCreates a new Azure Subscription in our systemwrite- and 62 more in this area
Aspm53
crowdstrike_falcon.aspm.aspm_combined_application_findingsGet findings of a given type for an application resource, with filtering, sorting and paginationreadcrowdstrike_falcon.aspm.create_executor_nodeCreate a new relay nodewrite- and 51 more in this area
Data protection configuration52
crowdstrike_falcon.data_protection_configuration.entities_classification_post_v2Create classificationswritecrowdstrike_falcon.data_protection_configuration.entities_cloud_application_createPersist the given cloud application for the provided entity instancewrite- and 50 more in this area
Case management51
crowdstrike_falcon.case_management.aggregates_access_tags_post_v1Get access tag aggregatesreadcrowdstrike_falcon.case_management.aggregates_file_details_post_v1Get file details aggregates as specified via json in the request bodyread- and 49 more in this area
It automation42
crowdstrike_falcon.it_automation.it_automation_cancel_task_executionCancel a task execution specified in the requestwritecrowdstrike_falcon.it_automation.it_automation_combined_scheduled_tasksReturns full details of scheduled tasks matching the filter query parameterread- and 40 more in this area
CSPM registration40
crowdstrike_falcon.cspm_registration.azure_refresh_certificateRefresh certificate and returns JSON object(s) that contain the base64 encoded certificate for a service principalwritecrowdstrike_falcon.cspm_registration.connect_cspmgcp_accountCreates a new GCP account with newly-uploaded service account or connects with existing service account with only the fowrite- and 38 more in this area
Saas security36
crowdstrike_falcon.saas_security.connect_check_tag_v3POST Connect a Check Tag to a Security Checkwritecrowdstrike_falcon.saas_security.create_app_journal_comment_v3POST App Journal Commentwrite- and 34 more in this area
Aidr33
crowdstrike_falcon.aidr.aggregate_agent_sessions_v1Aggregate agent-session counts by productreadcrowdstrike_falcon.aidr.aggregate_agents_v1Aggregate agent counts by productread- and 31 more in this area
Firewall management33
crowdstrike_falcon.firewall_management.aggregate_eventsAggregate events for customerreadcrowdstrike_falcon.firewall_management.aggregate_policy_rulesAggregate rules within a policy for customerread- and 31 more in this area
User management33
crowdstrike_falcon.user_management.aggregate_users_v1Get host aggregates as specified via json in request bodyreadcrowdstrike_falcon.user_management.aggregate_users_v2Get user aggregates including external users as specified via json in request bodyread- and 31 more in this area
Cloud policies30
crowdstrike_falcon.cloud_policies.clone_compliance_frameworkClone an existing compliance framework to create a custom copywritecrowdstrike_falcon.cloud_policies.create_compliance_controlCreate a new custom compliance controlwrite- and 28 more in this area
Filevantage30
crowdstrike_falcon.filevantage.create_policiesCreates a new policy of the specified typewritecrowdstrike_falcon.filevantage.create_rule_groupsCreates a new rule group of the specified typewrite- and 28 more in this area
MSSP30
crowdstrike_falcon.mssp.add_cid_group_membersAdd new CID group memberwritecrowdstrike_falcon.mssp.add_user_group_membersAdd new user group memberwrite- and 28 more in this area
Recon25
crowdstrike_falcon.recon.aggregate_notifications_exposed_data_records_v1Get notification exposed data record aggregates as specified via JSON in request bodyreadcrowdstrike_falcon.recon.aggregate_notifications_v1Get notification aggregates as specified via JSON in request bodyread- and 23 more in this area
Intel24
crowdstrike_falcon.intel.cao_incidents_aggregates_v1Perform statistical aggregations over incident datareadcrowdstrike_falcon.intel.cao_incidents_entities_v1Retrieve full details for one or more adversary incidents by their IDsread- and 22 more in this area
Real time response22
crowdstrike_falcon.real_time_response.batch_get_cmdBatch executes `get` command across hosts to retrieve fileswritecrowdstrike_falcon.real_time_response.batch_get_cmd_statusRetrieves the status of the specified batch get commandread- and 20 more in this area
Browser security21
crowdstrike_falcon.browser_security.activate_agentsActivate agents by IDwritecrowdstrike_falcon.browser_security.add_url_domain_listAdd URLs and domains to an integration listwrite- and 19 more in this area
D4C registration21
crowdstrike_falcon.d4c_registration.connect_d4_cgcp_accountCreates a new GCP account with newly-uploaded service account or connects with existing service account with only the fowritecrowdstrike_falcon.d4c_registration.create_d4_c_aws_accountCreates a new account in our system for a customer and generates a script for them to run in their AWS cloud environmentwrite- and 19 more in this area
Custom ioa20
crowdstrike_falcon.custom_ioa.create_ruleCreate a rule within a rule groupwritecrowdstrike_falcon.custom_ioa.create_rule_groupCreate a rule group for a platform with a name and an optional descriptionwrite- and 18 more in this area
Sensor update policies19
crowdstrike_falcon.sensor_update_policies.create_sensor_update_policiesCreate Sensor Update Policies by specifying details about the policy to createwritecrowdstrike_falcon.sensor_update_policies.create_sensor_update_policies_v2Create Sensor Update Policies by specifying details about the policy to create with additional support for uninstall prowrite- and 17 more in this area
Workflows19
crowdstrike_falcon.workflows.v1_child_executions_querySearch for child executions by providing an FQL filter and paging detailsreadcrowdstrike_falcon.workflows.workflow_activities_combinedSearch for activities by nameread- and 17 more in this area
Correlation rules18
crowdstrike_falcon.correlation_rules.aggregates_rule_versions_post_v1Get rules aggregates as specified via json in the request bodyreadcrowdstrike_falcon.correlation_rules.combined_rules_get_v1Find all rules matching the query and filterread- and 16 more in this area
Custom storage18
crowdstrike_falcon.custom_storage.describe_collectionFetch metadata about an existing collectionreadcrowdstrike_falcon.custom_storage.describe_collectionsFetch metadata about one or more existing collectionswrite- and 16 more in this area
Device control policies18
crowdstrike_falcon.device_control_policies.create_device_control_policiesCreate Device Control Policies by specifying details about the policy to createwritecrowdstrike_falcon.device_control_policies.perform_device_control_policies_actionPerform the specified action on the Device Control Policies specified in the requestwrite- and 16 more in this area
Falcon container18
crowdstrike_falcon.falcon_container.create_registry_entitiesCreate a registry entity using the provided detailswritecrowdstrike_falcon.falcon_container.launch_export_jobLaunch an export job of a Container Security resourcewrite- and 16 more in this area
Falcon complete dashboard17
crowdstrike_falcon.falcon_complete_dashboard.aggregate_alertsRetrieve aggregate epp alerts values based on the matched filterreadcrowdstrike_falcon.falcon_complete_dashboard.aggregate_allow_listRetrieve aggregate allowlist ticket values based on the matched filterread- and 15 more in this area
Ioc17
crowdstrike_falcon.ioc.action_query_v1Query Actionsreadcrowdstrike_falcon.ioc.get_indicators_reportLaunch an indicators report creation jobread- and 15 more in this area
Ods17
crowdstrike_falcon.ods.aggregate_query_scan_host_metadataGet aggregates on ODS scan-hosts datareadcrowdstrike_falcon.ods.aggregate_scansGet aggregates on ODS scan dataread- and 15 more in this area
Cloud azure registration16
crowdstrike_falcon.cloud_azure_registration.cloud_registration_azure_create_registrationCreate an Azure registration for a tenantwritecrowdstrike_falcon.cloud_azure_registration.cloud_registration_azure_create_suppressionsCreate new issue suppression ruleswrite- and 14 more in this area
Hosts 16Admission control policies 15Code security 15ML exclusions 15Ioa exclusions 14Container images 13Discover 13Real time response admin 13Container image compliance 11Content update policies 11Image assessment policies 11Alerts 10Container vulnerabilities 10Exposure management 10Firewall policies 10Host migration 10Kubernetes container compliance 10Prevention policies 10Response policies 10Sensor download 10Application abuse exclusions 9Cloud connect aws 9Cloud google cloud registration 9Falconx sandbox 9Host group 9Installation tokens 9Iocs 9Profile groups 9Cloud snapshots 8Identity protection 8Sample uploads 8Scanning orchestrator 8API clients 7Cao hunting 7Cloud aws registration 7Cloud oci registration 7Cloud security 7Container detections 7Container packages 7Malquery 7Message center 7Network scan zones 7Certificate based exclusions 6Deployments 6Foundry logscale 6Network scan networks 6Network scan scans 6Network scan templates 6Quarantine 6Threatgraph 6Agents 5Cloud security assets 5Drift indicators 5FDR 5Knowledge bases 5Network containment 5Network scan scan runs 5Quick scan pro 5Sensor visibility exclusions 5Spotlight vulnerabilities 5Tailored intelligence 5Agent invocation 4Audit 4Cloud security detections 4Downloads 4Falcon id 4Network scan detections 4Network scan scanners 4Quick scan 4Spotlight evaluation logic 4API integrations 3Container alerts 3Federated connections 3Knowledge base audit events 3Knowledge base files 3Report executions 3Scheduled reports 3Serverless exports 3Skills 3Unidentified containers 3Zero trust assessment 3Access scopes 2Agent templates 2Agent versions 2Cloud security compliance 2Configuration assessment 2Correlation rules admin 2Delivery settings 2Device content 2Event streams 2Intelligence feeds 2Intelligence indicator graph 2Mobile enrollment 2Models 2Network scan global configs 2Sensor usage 2Spans 2Tools 2Cloud security registration combined 1Cloud security risks 1Configuration assessment evaluation logic 1Faas execution 1Real time response audit 1Serverless vulnerabilities 1Spotlight vulnerability metadata 1Stream 1
This index shows a sample of each area. All 1,534 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.
Questions
The CrowdStrike Falcon MCP server, answered.
Is there a CrowdStrike Falcon MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 1,534 CrowdStrike Falcon actions across ngsiem, kubernetes protection, aspm and data protection configuration, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by CrowdStrike Falcon.
What do I need to connect CrowdStrike Falcon?
CrowdStrike API client ID and CrowdStrike API client secret (shown once when the client is created). Plus your tenant host. The free call account { op: "connections.requirements", service: "crowdstrike_falcon" } lists exactly what to paste.
Can an AI agent delete or change things in CrowdStrike Falcon?
Only if its key allows it, and only with an explicit confirmation. 164 CrowdStrike Falcon actions are destructive, including delete an IOC by providing a type and value, take various actions on the hosts in your environment and delete Indicators by ids. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my CrowdStrike Falcon API limit?
actionlake paces every call to the limits in the CrowdStrike Falcon service file: 6,000 calls a minute per connection. Repeated reads are answered from cache (931 CrowdStrike Falcon actions can be), which never reaches CrowdStrike Falcon.
What does a CrowdStrike Falcon action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (1,534 CrowdStrike Falcon actions page). Cache hits, searches, dry runs and calls CrowdStrike Falcon refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which CrowdStrike Falcon API does it cover?
The CrowdStrike Falcon OAuth2 API (FalconPy endpoint map, main branch) at api.crowdstrike.com by default, or the base URL set when you connect. It is built from CrowdStrike Falcon's documentation as read on 22 October 2026. 1,534 actions in 136 areas, each one in the signed service file (version 1.0.0).
Does actionlake keep my CrowdStrike Falcon data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your CrowdStrike Falcon credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent CrowdStrike Falcon today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
