--- title: "CrowdStrike Falcon MCP server for AI agents - actionlake" description: "Give Claude 1,534 CrowdStrike Falcon actions through one MCP server: ngsiem. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/crowdstrike-falcon updated: 2026-10-22 --- Connectors · Identity & security # CrowdStrike Falcon MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to CrowdStrike Falcon and the rest of your systems. It gives your agent 1,534 CrowdStrike Falcon actions (941 reads, 429 writes and 164 that wait for a confirmation) and holds the CrowdStrike Falcon credential itself, so the agent never does. It paces CrowdStrike Falcon's limits and records every call. [Connect CrowdStrike Falcon free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "crowdstrike_falcon.hosts.combined_devices_by_filter", intent: "check which CrowdStrike Falcon account is connected" } # Search for hosts in your environment by platform, hostname, IP, and other criteria · read · 1 upstream call ``` - 1,534 actions in one signed file - 941 read look, never change - 429 write create and update - 164 wait for a yes destructive, confirmed first Set up ## Connect CrowdStrike Falcon in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect CrowdStrike Falcon. OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key. - `client_id` CrowdStrike API client ID - `client_secret` CrowdStrike API client secret (shown once when the client is created) - `tenant_host` Where your CrowdStrike Falcon lives: your tenant host ``` account { op: "connections.requirements", service: "crowdstrike_falcon" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "crowdstrike_falcon.hosts.combined_devices_by_filter" } # search for hosts in your environment by platform, hostname, ip, and other criteria · read · 1 upstream call check { action: "crowdstrike_falcon.iocs.create_ioc", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` CrowdStrike Falcon at a glance **Sign-in** OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. **You provide** `client_id` `client_secret` **Setup fields** `tenant_host` **Limits we pace to** 6,000 calls a minute, per connection **API covered** CrowdStrike Falcon OAuth2 API (FalconPy endpoint map, main branch)`api.crowdstrike.com` **Built from** CrowdStrike Falcon's documentation, read 22 October 2026[GitHub](https://github.com/CrowdStrike/falconpy/tree/main/src/falconpy/_endpoint) [developer.crowdstrike.com](https://developer.crowdstrike.com/) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 931 of 941 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 2, so ask can line CrowdStrike Falcon up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in CrowdStrike Falcon. 1,534 actions in 136 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **941** read look, never change - **429** write create and update - **164** destructive wait for a confirmation 1. ### Ngsiem 72 20 read · 41 write · 11 destructive Add multiple labels to a single dashboard · Add multiple labels to a single file · Add multiple labels to a saved query · Add labels to multiple dashboards (max 100 items, non-transactional) 2. ### Kubernetes protection 64 56 read · 6 write · 2 destructive Creates a new AWS account in our system for a customer and generates the installation script · Creates a new Azure Subscription in our system · Retrieve containers by container_runtime_version · Retrieve containers count affected by zero day vulnerabilities 3. ### Aspm 53 33 read · 16 write · 4 destructive Get findings of a given type for an application resource, with filtering, sorting and pagination · Create a new relay node · Create a new integration · Create new integration task 4. ### Data protection configuration 52 22 read · 20 write · 10 destructive Create classifications · Persist the given cloud application for the provided entity instance · Persist the given content pattern for the provided entity instance · Persist the given enterprise account for the provided entity instance 5. ### Case management 51 25 read · 20 write · 6 destructive Get access tag aggregates · Get file details aggregates as specified via json in the request body · Get notification groups aggregations · Get notification groups aggregations 6. ### It automation 42 20 read · 16 write · 6 destructive Cancel a task execution specified in the request · Returns full details of scheduled tasks matching the filter query parameter · Creates a new policy of the specified type · Creates a scheduled task from the given request 7. ### CSPM registration 40 22 read · 14 write · 4 destructive Refresh certificate and returns JSON object(s) that contain the base64 encoded certificate for a service principal · Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the fo · Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment · Creates a new account in our system for a customer and generates a script for them to run in their cloud environment to 8. ### Saas security 36 23 read · 12 write · 1 destructive POST Connect a Check Tag to a Security Check · POST App Journal Comment · POST Security Check Journal Comment · POST User Journal Comment **128 more areas · 1,124 actions** - Aidr **33** - Firewall management **33** - User management **33** - Cloud policies **30** - Filevantage **30** - MSSP **30** - Recon **25** - Intel **24** - Real time response **22** - Browser security **21** - D4C registration **21** - Custom ioa **20** - Sensor update policies **19** - Workflows **19** - Correlation rules **18** - Custom storage **18** - Device control policies **18** - Falcon container **18** - Falcon complete dashboard **17** - Ioc **17** - Ods **17** - Cloud azure registration **16** - Hosts **16** - Admission control policies **15** - Code security **15** - ML exclusions **15** - Ioa exclusions **14** - Container images **13** - Discover **13** - Real time response admin **13** - Container image compliance **11** - Content update policies **11** - Image assessment policies **11** - Alerts **10** - Container vulnerabilities **10** - Exposure management **10** - Firewall policies **10** - Host migration **10** - Kubernetes container compliance **10** - Prevention policies **10** - Response policies **10** - Sensor download **10** - Application abuse exclusions **9** - Cloud connect aws **9** - Cloud google cloud registration **9** - Falconx sandbox **9** - Host group **9** - Installation tokens **9** - Iocs **9** - Profile groups **9** - Cloud snapshots **8** - Identity protection **8** - Sample uploads **8** - Scanning orchestrator **8** - API clients **7** - Cao hunting **7** - Cloud aws registration **7** - Cloud oci registration **7** - Cloud security **7** - Container detections **7** - Container packages **7** - Malquery **7** - Message center **7** - Network scan zones **7** - Certificate based exclusions **6** - Deployments **6** - Foundry logscale **6** - Network scan networks **6** - Network scan scans **6** - Network scan templates **6** - Quarantine **6** - Threatgraph **6** - Agents **5** - Cloud security assets **5** - Drift indicators **5** - FDR **5** - Knowledge bases **5** - Network containment **5** - Network scan scan runs **5** - Quick scan pro **5** - Sensor visibility exclusions **5** - Spotlight vulnerabilities **5** - Tailored intelligence **5** - Agent invocation **4** - Audit **4** - Cloud security detections **4** - Downloads **4** - Falcon id **4** - Network scan detections **4** - Network scan scanners **4** - Quick scan **4** - Spotlight evaluation logic **4** - API integrations **3** - Container alerts **3** - Federated connections **3** - Knowledge base audit events **3** - Knowledge base files **3** - Report executions **3** - Scheduled reports **3** - Serverless exports **3** - Skills **3** - Unidentified containers **3** - Zero trust assessment **3** - Access scopes **2** - Agent templates **2** - Agent versions **2** - Cloud security compliance **2** - Configuration assessment **2** - Correlation rules admin **2** - Delivery settings **2** - Device content **2** - Event streams **2** - Intelligence feeds **2** - Intelligence indicator graph **2** - Mobile enrollment **2** - Models **2** - Network scan global configs **2** - Sensor usage **2** - Spans **2** - Tools **2** - Cloud security registration combined **1** - Cloud security risks **1** - Configuration assessment evaluation logic **1** - Faas execution **1** - Real time response audit **1** - Serverless vulnerabilities **1** - Spotlight vulnerability metadata **1** - Stream **1** Top actions ## The CrowdStrike Falcon API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `crowdstrike_falcon.alerts.post_combined_alerts_v1` Retrieves all Alerts that match a particular FQL filter | Retrieves all Alerts that match a particular FQL filter. | read | this connector | | `crowdstrike_falcon.hosts.combined_devices_by_filter` Search for hosts in your environment by platform, hostname, IP, and other criteria | Search for hosts in your environment by platform, hostname, IP, and other criteria. | read | this connector | | `crowdstrike_falcon.iocs.create_ioc` Create a new IOC | Create a new IOC. | write | this connector | | `crowdstrike_falcon.iocs.query_io_cs` Search the custom IOCs in your customer account | Search the custom IOCs in your customer account. | read | this connector | | `crowdstrike_falcon.ioc.action_query_v1` Query Actions | Query Actions. | read | this connector | | `crowdstrike_falcon.ioc.ioc_type_query_v1` Query IOC Types | Query IOC Types. | read | this connector | | `crowdstrike_falcon.hosts.get_device_details` Get details on one or more hosts by providing host IDs in a POST body | Get details on one or more hosts by providing host IDs in a POST body. | read | this connector | | `crowdstrike_falcon.user_management.create_user` Deprecated : Please use createUserV1 Create a new user | Deprecated : Please use createUserV1 Create a new user. | write | this connector | | `crowdstrike_falcon.alerts.get_queries_alerts_v1` Deprecated: please use version v2 of this endpoint | Deprecated: please use version v2 of this endpoint. | read | this connector | | `crowdstrike_falcon.host_group.query_host_groups` Search for Host Groups in your environment by providing an FQL filter and paging details | Search for Host Groups in your environment by providing an FQL filter and paging details. | read | this connector | | `crowdstrike_falcon.host_group.create_host_groups` Create Host Groups by specifying details about the group to create | Create Host Groups by specifying details about the group to create. | write | this connector | | `crowdstrike_falcon.iocs.delete_ioc` Delete an IOC by providing a type and value | Delete an IOC by providing a type and value. | destructive | this connector | Try it ## Prompts to paste into Claude. Each one names the CrowdStrike Falcon actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Which CrowdStrike Falcon alerts are open right now? Group them by service. calls `crowdstrike_falcon.alerts.post_combined_alerts_v1` 2. Write write Create a new IOC in CrowdStrike Falcon. Show me exactly what you will send before you save it. calls `crowdstrike_falcon.iocs.create_ioc` Governance for CrowdStrike Falcon ## Destructive actions wait for a yes. 164 CrowdStrike Falcon actions are destructive. The first 10: - Delete an IOC by providing a type and value `crowdstrike_falcon.iocs.delete_ioc` - Take various actions on the hosts in your environment `crowdstrike_falcon.hosts.perform_action_v2` - Delete Indicators by ids `crowdstrike_falcon.ioc.indicator_delete_v1` - Deprecated : Please use deleteUserV1 Delete a user permanently `crowdstrike_falcon.user_management.delete_user` - Batch executes an RTR read-only command across the hosts mapped to the given batch ID `crowdstrike_falcon.real_time_response.batch_cmd` - Delete a set of Host Groups by specifying their IDs `crowdstrike_falcon.host_group.delete_host_groups` - Delete a user permanently `crowdstrike_falcon.user_management.delete_user_v1` - Apply actions to one or more User `crowdstrike_falcon.user_management.user_action_v1` - Permanently delete hosts from the system `crowdstrike_falcon.hosts.devices_actions_delete_v1` - Delete an RTR session file `crowdstrike_falcon.real_time_response.rtr_delete_file` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do crowdstrike_falcon.iocs.delete_ioc confirm_policy: **human** Delete an IOC by providing a type and value? **intent:** the user asked me to delete an IOC by providing a type and value run suspended · waiting for a named person · key _crowdstrike-falcon-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "crowdstrike-falcon-agent", allowed_actions: ["crowdstrike_falcon.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "crowdstrike_falcon.iocs.delete_ioc", approver: "lead@example.com" }, { match: "crowdstrike_falcon.hosts.perform_action_v2", approver: "lead@example.com" }, { match: "crowdstrike_falcon.ioc.indicator_delete_v1", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to CrowdStrike Falcon only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What CrowdStrike Falcon costs on actionlake. Every CrowdStrike Falcon action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call CrowdStrike Falcon refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 1,534 CrowdStrike Falcon actions - 1,534 actions page each page of a long list is one call - 931 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every CrowdStrike Falcon action. 1,534 actions by area: the id your agent calls, what it does, and its effect. **Ngsiem 72** - `crowdstrike_falcon.ngsiem.add_dashboard_labels` Add multiple labels to a single dashboard write - `crowdstrike_falcon.ngsiem.add_file_labels` Add multiple labels to a single file write - and 70 more in this area **Kubernetes protection 64** - `crowdstrike_falcon.kubernetes_protection.create_aws_account` Creates a new AWS account in our system for a customer and generates the installation script write - `crowdstrike_falcon.kubernetes_protection.create_azure_subscription` Creates a new Azure Subscription in our system write - and 62 more in this area **Aspm 53** - `crowdstrike_falcon.aspm.aspm_combined_application_findings` Get findings of a given type for an application resource, with filtering, sorting and pagination read - `crowdstrike_falcon.aspm.create_executor_node` Create a new relay node write - and 51 more in this area **Data protection configuration 52** - `crowdstrike_falcon.data_protection_configuration.entities_classification_post_v2` Create classifications write - `crowdstrike_falcon.data_protection_configuration.entities_cloud_application_create` Persist the given cloud application for the provided entity instance write - and 50 more in this area **Case management 51** - `crowdstrike_falcon.case_management.aggregates_access_tags_post_v1` Get access tag aggregates read - `crowdstrike_falcon.case_management.aggregates_file_details_post_v1` Get file details aggregates as specified via json in the request body read - and 49 more in this area **It automation 42** - `crowdstrike_falcon.it_automation.it_automation_cancel_task_execution` Cancel a task execution specified in the request write - `crowdstrike_falcon.it_automation.it_automation_combined_scheduled_tasks` Returns full details of scheduled tasks matching the filter query parameter read - and 40 more in this area **CSPM registration 40** - `crowdstrike_falcon.cspm_registration.azure_refresh_certificate` Refresh certificate and returns JSON object(s) that contain the base64 encoded certificate for a service principal write - `crowdstrike_falcon.cspm_registration.connect_cspmgcp_account` Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the fo write - and 38 more in this area **Saas security 36** - `crowdstrike_falcon.saas_security.connect_check_tag_v3` POST Connect a Check Tag to a Security Check write - `crowdstrike_falcon.saas_security.create_app_journal_comment_v3` POST App Journal Comment write - and 34 more in this area **Aidr 33** - `crowdstrike_falcon.aidr.aggregate_agent_sessions_v1` Aggregate agent-session counts by product read - `crowdstrike_falcon.aidr.aggregate_agents_v1` Aggregate agent counts by product read - and 31 more in this area **Firewall management 33** - `crowdstrike_falcon.firewall_management.aggregate_events` Aggregate events for customer read - `crowdstrike_falcon.firewall_management.aggregate_policy_rules` Aggregate rules within a policy for customer read - and 31 more in this area **User management 33** - `crowdstrike_falcon.user_management.aggregate_users_v1` Get host aggregates as specified via json in request body read - `crowdstrike_falcon.user_management.aggregate_users_v2` Get user aggregates including external users as specified via json in request body read - and 31 more in this area **Cloud policies 30** - `crowdstrike_falcon.cloud_policies.clone_compliance_framework` Clone an existing compliance framework to create a custom copy write - `crowdstrike_falcon.cloud_policies.create_compliance_control` Create a new custom compliance control write - and 28 more in this area **Filevantage 30** - `crowdstrike_falcon.filevantage.create_policies` Creates a new policy of the specified type write - `crowdstrike_falcon.filevantage.create_rule_groups` Creates a new rule group of the specified type write - and 28 more in this area **MSSP 30** - `crowdstrike_falcon.mssp.add_cid_group_members` Add new CID group member write - `crowdstrike_falcon.mssp.add_user_group_members` Add new user group member write - and 28 more in this area **Recon 25** - `crowdstrike_falcon.recon.aggregate_notifications_exposed_data_records_v1` Get notification exposed data record aggregates as specified via JSON in request body read - `crowdstrike_falcon.recon.aggregate_notifications_v1` Get notification aggregates as specified via JSON in request body read - and 23 more in this area **Intel 24** - `crowdstrike_falcon.intel.cao_incidents_aggregates_v1` Perform statistical aggregations over incident data read - `crowdstrike_falcon.intel.cao_incidents_entities_v1` Retrieve full details for one or more adversary incidents by their IDs read - and 22 more in this area **Real time response 22** - `crowdstrike_falcon.real_time_response.batch_get_cmd` Batch executes `get` command across hosts to retrieve files write - `crowdstrike_falcon.real_time_response.batch_get_cmd_status` Retrieves the status of the specified batch get command read - and 20 more in this area **Browser security 21** - `crowdstrike_falcon.browser_security.activate_agents` Activate agents by ID write - `crowdstrike_falcon.browser_security.add_url_domain_list` Add URLs and domains to an integration list write - and 19 more in this area **D4C registration 21** - `crowdstrike_falcon.d4c_registration.connect_d4_cgcp_account` Creates a new GCP account with newly-uploaded service account or connects with existing service account with only the fo write - `crowdstrike_falcon.d4c_registration.create_d4_c_aws_account` Creates a new account in our system for a customer and generates a script for them to run in their AWS cloud environment write - and 19 more in this area **Custom ioa 20** - `crowdstrike_falcon.custom_ioa.create_rule` Create a rule within a rule group write - `crowdstrike_falcon.custom_ioa.create_rule_group` Create a rule group for a platform with a name and an optional description write - and 18 more in this area **Sensor update policies 19** - `crowdstrike_falcon.sensor_update_policies.create_sensor_update_policies` Create Sensor Update Policies by specifying details about the policy to create write - `crowdstrike_falcon.sensor_update_policies.create_sensor_update_policies_v2` Create Sensor Update Policies by specifying details about the policy to create with additional support for uninstall pro write - and 17 more in this area **Workflows 19** - `crowdstrike_falcon.workflows.v1_child_executions_query` Search for child executions by providing an FQL filter and paging details read - `crowdstrike_falcon.workflows.workflow_activities_combined` Search for activities by name read - and 17 more in this area **Correlation rules 18** - `crowdstrike_falcon.correlation_rules.aggregates_rule_versions_post_v1` Get rules aggregates as specified via json in the request body read - `crowdstrike_falcon.correlation_rules.combined_rules_get_v1` Find all rules matching the query and filter read - and 16 more in this area **Custom storage 18** - `crowdstrike_falcon.custom_storage.describe_collection` Fetch metadata about an existing collection read - `crowdstrike_falcon.custom_storage.describe_collections` Fetch metadata about one or more existing collections write - and 16 more in this area **Device control policies 18** - `crowdstrike_falcon.device_control_policies.create_device_control_policies` Create Device Control Policies by specifying details about the policy to create write - `crowdstrike_falcon.device_control_policies.perform_device_control_policies_action` Perform the specified action on the Device Control Policies specified in the request write - and 16 more in this area **Falcon container 18** - `crowdstrike_falcon.falcon_container.create_registry_entities` Create a registry entity using the provided details write - `crowdstrike_falcon.falcon_container.launch_export_job` Launch an export job of a Container Security resource write - and 16 more in this area **Falcon complete dashboard 17** - `crowdstrike_falcon.falcon_complete_dashboard.aggregate_alerts` Retrieve aggregate epp alerts values based on the matched filter read - `crowdstrike_falcon.falcon_complete_dashboard.aggregate_allow_list` Retrieve aggregate allowlist ticket values based on the matched filter read - and 15 more in this area **Ioc 17** - `crowdstrike_falcon.ioc.action_query_v1` Query Actions read - `crowdstrike_falcon.ioc.get_indicators_report` Launch an indicators report creation job read - and 15 more in this area **Ods 17** - `crowdstrike_falcon.ods.aggregate_query_scan_host_metadata` Get aggregates on ODS scan-hosts data read - `crowdstrike_falcon.ods.aggregate_scans` Get aggregates on ODS scan data read - and 15 more in this area **Cloud azure registration 16** - `crowdstrike_falcon.cloud_azure_registration.cloud_registration_azure_create_registration` Create an Azure registration for a tenant write - `crowdstrike_falcon.cloud_azure_registration.cloud_registration_azure_create_suppressions` Create new issue suppression rules write - and 14 more in this area Hosts **16** Admission control policies **15** Code security **15** ML exclusions **15** Ioa exclusions **14** Container images **13** Discover **13** Real time response admin **13** Container image compliance **11** Content update policies **11** Image assessment policies **11** Alerts **10** Container vulnerabilities **10** Exposure management **10** Firewall policies **10** Host migration **10** Kubernetes container compliance **10** Prevention policies **10** Response policies **10** Sensor download **10** Application abuse exclusions **9** Cloud connect aws **9** Cloud google cloud registration **9** Falconx sandbox **9** Host group **9** Installation tokens **9** Iocs **9** Profile groups **9** Cloud snapshots **8** Identity protection **8** Sample uploads **8** Scanning orchestrator **8** API clients **7** Cao hunting **7** Cloud aws registration **7** Cloud oci registration **7** Cloud security **7** Container detections **7** Container packages **7** Malquery **7** Message center **7** Network scan zones **7** Certificate based exclusions **6** Deployments **6** Foundry logscale **6** Network scan networks **6** Network scan scans **6** Network scan templates **6** Quarantine **6** Threatgraph **6** Agents **5** Cloud security assets **5** Drift indicators **5** FDR **5** Knowledge bases **5** Network containment **5** Network scan scan runs **5** Quick scan pro **5** Sensor visibility exclusions **5** Spotlight vulnerabilities **5** Tailored intelligence **5** Agent invocation **4** Audit **4** Cloud security detections **4** Downloads **4** Falcon id **4** Network scan detections **4** Network scan scanners **4** Quick scan **4** Spotlight evaluation logic **4** API integrations **3** Container alerts **3** Federated connections **3** Knowledge base audit events **3** Knowledge base files **3** Report executions **3** Scheduled reports **3** Serverless exports **3** Skills **3** Unidentified containers **3** Zero trust assessment **3** Access scopes **2** Agent templates **2** Agent versions **2** Cloud security compliance **2** Configuration assessment **2** Correlation rules admin **2** Delivery settings **2** Device content **2** Event streams **2** Intelligence feeds **2** Intelligence indicator graph **2** Mobile enrollment **2** Models **2** Network scan global configs **2** Sensor usage **2** Spans **2** Tools **2** Cloud security registration combined **1** Cloud security risks **1** Configuration assessment evaluation logic **1** Faas execution **1** Real time response audit **1** Serverless vulnerabilities **1** Spotlight vulnerability metadata **1** Stream **1** This index shows a sample of each area. All 1,534 actions, with their inputs and prices, are in the [catalogue](https://actionlake.com/console/catalogue), which a free sandbox key can search. Questions ## The CrowdStrike Falcon MCP server, answered. **Is there a CrowdStrike Falcon MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 1,534 CrowdStrike Falcon actions across ngsiem, kubernetes protection, aspm and data protection configuration, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by CrowdStrike Falcon. **What do I need to connect CrowdStrike Falcon?** CrowdStrike API client ID and CrowdStrike API client secret (shown once when the client is created). Plus your tenant host. The free call account { op: "connections.requirements", service: "crowdstrike_falcon" } lists exactly what to paste. **Can an AI agent delete or change things in CrowdStrike Falcon?** Only if its key allows it, and only with an explicit confirmation. 164 CrowdStrike Falcon actions are destructive, including delete an IOC by providing a type and value, take various actions on the hosts in your environment and delete Indicators by ids. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my CrowdStrike Falcon API limit?** actionlake paces every call to the limits in the CrowdStrike Falcon service file: 6,000 calls a minute per connection. Repeated reads are answered from cache (931 CrowdStrike Falcon actions can be), which never reaches CrowdStrike Falcon. **What does a CrowdStrike Falcon action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (1,534 CrowdStrike Falcon actions page). Cache hits, searches, dry runs and calls CrowdStrike Falcon refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which CrowdStrike Falcon API does it cover?** The CrowdStrike Falcon OAuth2 API (FalconPy endpoint map, main branch) at api.crowdstrike.com by default, or the base URL set when you connect. It is built from CrowdStrike Falcon's documentation as read on 22 October 2026. 1,534 actions in 136 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my CrowdStrike Falcon data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your CrowdStrike Falcon credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like CrowdStrike Falcon Joins with, on shared entities - [NinjaOne 2](https://actionlake.com/connectors/ninjaone) - [Commvault Cloud 2](https://actionlake.com/connectors/commvault-cloud) - [HPE Aruba Networking Central 2](https://actionlake.com/connectors/hpe-aruba-networking-central) - [Veeam Service Provider Console 2](https://actionlake.com/connectors/veeam-service-provider-console) - [Dynatrace 2](https://actionlake.com/connectors/dynatrace) - [Sophos Central 2](https://actionlake.com/connectors/sophos-central) Browse - [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by CrowdStrike Falcon; the name is the vendor's own. Counts are from the CrowdStrike Falcon service file, version 1.0.0. ## Give your agent CrowdStrike Falcon today. [Connect CrowdStrike Falcon free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/crowdstrike-falcon More: https://actionlake.com/llms.txt