CrowdStrike LogScale MCP server: 1 LogScale tool among 166

There is no LogScale-only server. What CrowdStrike's own connector covers, which single tool queries LogScale, and why its tool list cannot be inspected without a key.

Checked 6 October 2026 · from CrowdStrike's repository, PyPI and the installed package's own registration code

One of 91 guides to monitoring and developer tools. Each covers what an AI coding agent can get out of the tool through MCP, the protocol that lets the agent query the tool directly.

What is the CrowdStrike LogScale MCP server?

It is CrowdStrike's server for the Model Context Protocol. Falcon is a security platform, so a connected agent reaches detections, hosts, incidents, threat intelligence and vulnerabilities.

LogScale is CrowdStrike's log management engine, and it sits underneath Next-Gen SIEM rather than being exposed on its own. That is why searching for a LogScale connector finds this one.

The module layout is the useful map. guardian registers 25 tools, shield 16, cloud 14, cases 13, rtr 11, and ngsiem exactly 1. Every tool name carries a falcon_ prefix, added at registration.

LogScale is reached through Falcon's NGSIEM module, where falcon_search_ngsiem runs CQL against its security data. The Guardian module, added in v0.19.0, watches AI agent activity on your hosts. Delivery and spend stay out of reach.

CrowdStrike's connector answers security questions about your machines: what was detected, on which host, and what its intelligence says about it. LogScale enters as one NGSIEM search tool; an availability question still needs metrics or traces from somewhere else.

What can an AI agent do with CrowdStrike LogScale?

Most search tools have a matching guide resource, such as the CQL authoring guide for falcon_search_ngsiem. Those are resources rather than tools, so an agent has to fetch them deliberately.

What the tool definitions cost in context

A client that loads every tool definition at the start of a session spends this much context before the first question. Claude Code defers definitions by default through tool search, and loads a tool's definition when the agent needs it. The method below gives the version and date measured.

A context window is the amount of text a model can hold at once. Measured on version 0.17.0, its 138 tools across 27 modules cost 21,060 to 27,979 tokens on Claude when a client loads them. Version 0.19.0 registers 166, so the current cost is higher. Exactly one tool reaches LogScale.

That ratio is the finding. An agent connected for LogScale search is offered the entire Falcon platform surface. The module filter removes the other 27 at the server; a client that defers tool loading also avoids paying for them upfront.

Encodings: GPT-5.6, GPT-5.5 o200k_base; GPT-4, GPT-3.5 cl100k_base; Claude Haiku 4.5 to Opus 5 count_tokens. Counted on 24 August 2026 from the 138 tool entries in CrowdStrike's own documentation for version 0.17.0. That documentation is the only public inventory.

The server could not be run for a live tools/list. It authenticates before it registers anything. No input schemas are therefore available. These figures cover each tool's name and description only. They are a floor, not the figure.

The Claude columns are measured through the API's count_tokens endpoint with an empty schema per tool. So they cover the same content as the GPT columns. The range there is two tokenizer generations. Haiku 4.5 and Opus 4.6 are at the low end. Opus 5 and Sonnet 5 are at the high end. The gap between them is about a third.

CrowdStrike LogScale MCP server limits: where answers come back incomplete

The limits below come from LogScale not being a product with its own connector.

How to configure CrowdStrike LogScale MCP for agents

1. 1

   Expect to supply credentials before you can see anything

   The server authenticates at startup, so there is no way to inspect the tool list first.

2. 2

   Filter the modules

   166 tools is a large surface for a question about logs; the package carries a tool filter so a session can register fewer.

3. 3

   Know where LogScale actually sits

   It is the engine under Next-Gen SIEM, reached by falcon_search_ngsiem with a CQL query.

4. 4

   Scope the API client

   Falcon API clients carry scopes, and those decide what the agent can reach far more than the tool list does.

Paste this into your agent’s instructions

One tool of 166 is the LogScale route, and the rest answer different questions from different products. The block makes the agent say which surface it used.

When you answer using CrowdStrike Falcon MCP tools, state:
- The tool you called and the module it belongs to.
- For log questions, whether you used falcon_search_ngsiem
  and the CQL query you ran.
- Whether the tool changed anything. Creating a case or
  adding an indicator writes to the platform.
Never state that data does not exist. State that no results
matched the query above.
Write your answer in ASD-STE100 Simplified Technical
English. Use short sentences with one idea in each.

Do you need the MCP server at all?

Not for log search alone. The NG-SIEM interface and the LogScale query API answer the same questions, without spending context on 166 tool definitions.

The connector earns its place on breadth: an agent can move from a detection to the host to the intelligence report in one session, which is awkward across separate consoles.

For application logs rather than security logs, OpenSearch or Elastic reach what your own pipeline ships, which Falcon does not see.

Connect it for security investigation across Falcon. Query LogScale directly when the question is only about logs.

CrowdStrike LogScale MCP server setup

The package installs from PyPI as falcon-mcp and needs Python 3.11 or later. A Falcon API client ID and secret are required before it will start.

Credentials are checked at startup rather than at first tool call, so a wrong key fails immediately and visibly.

claude mcp add-json "falcon" '{"command":"falcon-mcp",
  "env":{"FALCON_CLIENT_ID":"<your-id>",
         "FALCON_CLIENT_SECRET":"<your-secret>",
         "FALCON_BASE_URL":"https://api.crowdstrike.com"}}'

{"mcpServers":{"falcon":{"command":"falcon-mcp",
  "env":{"FALCON_CLIENT_ID":"<your-id>",
         "FALCON_CLIENT_SECRET":"<your-secret>",
         "FALCON_BASE_URL":"https://api.crowdstrike.com"}}}}

[mcp_servers.falcon]
command = "falcon-mcp"
env = { FALCON_CLIENT_ID = "<your-id>",
        FALCON_CLIENT_SECRET = "<your-secret>",
        FALCON_BASE_URL = "https://api.crowdstrike.com" }

Every other client

Each block below is the configuration for one client, with the file path and the key that client expects.

{"mcpServers":{"falcon":{"command":"falcon-mcp",
  "env":{"FALCON_CLIENT_ID":"<your-id>","FALCON_CLIENT_SECRET":"<your-secret>","FALCON_BASE_URL":"https://api.crowdstrike.com"}}}}

{"mcpServers":{"falcon":{"command":"falcon-mcp",
  "env":{"FALCON_CLIENT_ID":"<your-id>","FALCON_CLIENT_SECRET":"<your-secret>","FALCON_BASE_URL":"https://api.crowdstrike.com"}}}}

{"servers":{"falcon":{"command":"falcon-mcp",
  "env":{"FALCON_CLIENT_ID":"<your-id>","FALCON_CLIENT_SECRET":"<your-secret>","FALCON_BASE_URL":"https://api.crowdstrike.com"}}}}

{"mcpServers":{"falcon":{"command":"falcon-mcp",
  "env":{"FALCON_CLIENT_ID":"<your-id>","FALCON_CLIENT_SECRET":"<your-secret>","FALCON_BASE_URL":"https://api.crowdstrike.com"}}}}

FALCON_CLIENT_ID=<your-id> \
FALCON_CLIENT_SECRET=<your-secret> \
falcon-mcp --modules ngsiem

Read-only access, permissions and security

• Credentials gate registration, not just execution

  The server calls the Falcon API at startup and exits on failure, which is stricter than most connectors here.

• Tools are annotated read-only by default

  The package's base module applies read-only annotations unless a tool overrides them.

• Some tools still write

  Creating a case, adding or removing indicators of compromise, and managing host grouping tags all change platform state.

• The API client's scopes are the real boundary

  A Falcon client can only reach what it was granted, whatever the tool list offers.

Troubleshooting

The server exits at startup

Authentication failed. The log line names the HTTP status and hints that the client ID and secret should be checked, and the process stops before registering tools.

Nothing is returned for a log search

falcon_search_ngsiem queries LogScale-based Next-Gen SIEM with CQL. A LogScale deployment that is not behind NG-SIEM is not reachable through this server.

The tool list is too large for the client

166 tools register by default. Use the package's module filtering to register only the modules a session needs.

A CQL query is rejected

The package ships a CQL authoring guide as a resource for the query_string parameter. Have the agent read that resource before composing a query.

CrowdStrike LogScale MCP server: Reference

What engineers report

The repository is active and well starred, so the useful figures are the module and tool counts.

“falcon-mcp outputs INFO log messages to stdout during initialization when using stdio transport, which breaks JSON-RPC protocol compatibility with MCP clients.”

“Setting up the URL just as http://x.x.x.x:8000 gives 404 Not Found. Digging around and determined we needed to have a trailing /mcp in the URL.”

Repository facts from the GitHub API and PyPI, retrieved 6 October 2026. Tool and module counts were read from the _add_tool registration calls in version 0.19.0 of the published package. An unauthenticated tools/list is impossible here: a capture attempt on 24 August 2026 returned HTTP 401 and the process exited.

Should you connect an agent to CrowdStrike LogScale?

Yes. Best for module filtering, so a session registers the few modules its question needs.

Strongest fit

Falcon customers whose logs sit behind Next-Gen SIEM and who want one connector across security telemetry.

Main advantage

One authenticated connection reaches 28 modules, from detections through intelligence to cloud posture and AI agent activity.

Main weakness

LogScale is one tool of 166, so a log-only use case pays for a great deal it will not call.

Operational risk

Writing tools exist among the 166, and the API client's scopes rather than the tool list are the real boundary.

Frequently asked questions