falcon-mcp is a Model Context Protocol (MCP) server that connects AI agents with the CrowdStrike Falcon platform, powering intelligent security analysis in agent workflows. It provides programmatic access to essential security capabilities—including detections, incidents, behaviors, threat intelligence, hosts, vulnerabilities, and Identity Protection—enabling automated querying, investigation, and enrichment within AI-driven assistants and apps. The server is designed with a modular architecture; available modules include Cloud Security, Core Functionality (built into server), Detections, Discover, Hosts, Identity Protection, Incidents, Intel, Sensor Usage, Serverless, and Spotlight. Users can enable modules via CLI, environment variables, or library configuration, and each module requires appropriate CrowdStrike API scopes. falcon-mcp supports multiple transport mechanisms (stdio, SSE, and streamable-http), runs as a library or a standalone server, and can be deployed via a pre-built container image or built locally. The project is in public preview and under active development, so features may change before 1.0. It emphasizes documentation, examples, and contributor guidance to facilitate integration, testing, and contribution.