CrowdStrike LogScale MCP server: one tool of 138 reaches it

There is no LogScale-only server. What CrowdStrike's own connector covers, which single tool queries LogScale, and why its tool list cannot be inspected without a key.

Last verified 1 September 2026 · from CrowdStrike's repository, PyPI and the installed package's own registration code

This page is one of 90 in a directory of monitoring and developer tools. Each page checks what an AI coding agent can get out of the tool through its MCP server, the connector that lets the agent query the tool directly.

What is the CrowdStrike LogScale MCP server?

It is CrowdStrike's server for the Model Context Protocol. Falcon is a security platform, so a connected agent reaches detections, hosts, incidents, threat intelligence and vulnerabilities.

LogScale is CrowdStrike's log management engine, and it sits underneath Next-Gen SIEM rather than being exposed on its own. That is why searching for a LogScale connector finds this one.

The module layout is the useful map. shield registers 16 tools, cases 13, cloud and rtr 11 each, and ngsiem exactly 1. Every tool name carries a falcon_ prefix, added at registration.

LogScale is reached through Falcon's NGSIEM module, where falcon_search_ngsiem runs CQL against its security data. That narrow route does not extend into delivery, agent traces or spend.

CrowdStrike's connector answers security questions about your machines: what was detected, on which host, and what its intelligence says about it. LogScale enters as one NGSIEM search tool; an availability question still needs metrics or traces from somewhere else.

What can an AI agent do with CrowdStrike LogScale?

Most search tools have a matching guide resource, such as the CQL authoring guide for falcon_search_ngsiem. Those are resources rather than tools, so an agent has to fetch them deliberately.

What connecting costs before the first question

A context window is the amount of text a model can hold at once. 138 tools across 27 modules cost 21,060 to 27,979 tokens on Claude at connection. Exactly one of them reaches LogScale.

That ratio is the finding. An agent connected for LogScale search pays for the entire Falcon platform surface, and the module filter is the only way to stop paying for the other 26.

Encodings: GPT-5.6, GPT-5.5 o200k_base; GPT-4, GPT-3.5 cl100k_base; Claude Haiku 4.5 to Opus 5 count_tokens. Counted from the 138 tool entries in CrowdStrike's own documentation. That documentation is the only public inventory.

The server could not be run for a live tools/list. It authenticates before it registers anything. No input schemas are therefore available. These figures cover each tool's name and description only. They are a floor, not the figure.

The Claude columns are measured through the API's count_tokens endpoint with an empty schema per tool. So they cover the same content as the GPT columns. The range there is two tokenizer generations. Haiku 4.5 and Opus 4.6 are at the low end. Opus 5 and Sonnet 5 are at the high end. The gap between them is about a third.

CrowdStrike LogScale MCP server limits: where answers come back incomplete

The limits below come from LogScale not being a product with its own connector.

How to configure CrowdStrike LogScale MCP for agents

1. 1

   Expect to supply credentials before you can see anything

   The server authenticates at startup, so there is no way to inspect the tool list first.

2. 2

   Filter the modules

   138 tools is a large surface for a question about logs; the package carries a tool filter so a session can register fewer.

3. 3

   Know where LogScale actually sits

   It is the engine under Next-Gen SIEM, reached by falcon_search_ngsiem with a CQL query.

4. 4

   Scope the API client

   Falcon API clients carry scopes, and those decide what the agent can reach far more than the tool list does.

Paste this into your agent’s instructions

One tool of 138 is the LogScale route, and the rest answer different questions from different products. The block makes the agent say which surface it used.

When you answer using CrowdStrike Falcon MCP tools, state:
- The tool you called and the module it belongs to.
- For log questions, whether you used falcon_search_ngsiem
  and the CQL query you ran.
- Whether the tool changed anything. Creating a case or
  adding an indicator writes to the platform.
Never state that data does not exist. State that no results
matched the query above.
Write your answer in ASD-STE100 Simplified Technical
English. Use short sentences with one idea in each.

Do you need the MCP server at all?

Not for log search alone. The NG-SIEM interface and the LogScale query API answer the same questions, without spending context on 138 tool definitions.

The connector earns its place on breadth: an agent can move from a detection to the host to the intelligence report in one session, which is awkward across separate consoles.

For application logs rather than security logs, OpenSearch or Elastic reach what your own pipeline ships, which Falcon does not see.

Connect it for security investigation across Falcon. Query LogScale directly when the question is only about logs.

CrowdStrike LogScale MCP server setup

The package installs from PyPI as falcon-mcp and needs Python 3.11 or later. A Falcon API client ID and secret are required before it will start.

Credentials are checked at startup rather than at first tool call, so a wrong key fails immediately and visibly.

claude mcp add-json "falcon" '{"command":"falcon-mcp",
  "env":{"FALCON_CLIENT_ID":"<your-id>",
         "FALCON_CLIENT_SECRET":"<your-secret>",
         "FALCON_BASE_URL":"https://api.crowdstrike.com"}}'

{"mcpServers":{"falcon":{"command":"falcon-mcp",
  "env":{"FALCON_CLIENT_ID":"<your-id>",
         "FALCON_CLIENT_SECRET":"<your-secret>",
         "FALCON_BASE_URL":"https://api.crowdstrike.com"}}}}

[mcp_servers.falcon]
command = "falcon-mcp"
env = { FALCON_CLIENT_ID = "<your-id>",
        FALCON_CLIENT_SECRET = "<your-secret>",
        FALCON_BASE_URL = "https://api.crowdstrike.com" }

Every other client

Each block below is the configuration for one client, with the file path and the key that client expects.

{"mcpServers":{"falcon":{"command":"falcon-mcp",
  "env":{"FALCON_CLIENT_ID":"<your-id>","FALCON_CLIENT_SECRET":"<your-secret>","FALCON_BASE_URL":"https://api.crowdstrike.com"}}}}

{"mcpServers":{"falcon":{"command":"falcon-mcp",
  "env":{"FALCON_CLIENT_ID":"<your-id>","FALCON_CLIENT_SECRET":"<your-secret>","FALCON_BASE_URL":"https://api.crowdstrike.com"}}}}

{"servers":{"falcon":{"command":"falcon-mcp",
  "env":{"FALCON_CLIENT_ID":"<your-id>","FALCON_CLIENT_SECRET":"<your-secret>","FALCON_BASE_URL":"https://api.crowdstrike.com"}}}}

{"mcpServers":{"falcon":{"command":"falcon-mcp",
  "env":{"FALCON_CLIENT_ID":"<your-id>","FALCON_CLIENT_SECRET":"<your-secret>","FALCON_BASE_URL":"https://api.crowdstrike.com"}}}}

FALCON_CLIENT_ID=<your-id> \
FALCON_CLIENT_SECRET=<your-secret> \
falcon-mcp --modules ngsiem

Read-only access, permissions and security

• Credentials gate registration, not just execution

  The server calls the Falcon API at startup and exits on failure, which is stricter than most connectors here.

• Tools are annotated read-only by default

  The package's base module applies read-only annotations unless a tool overrides them.

• Some tools still write

  Creating a case, adding or removing indicators of compromise, and managing host grouping tags all change platform state.

• The API client's scopes are the real boundary

  A Falcon client can only reach what it was granted, whatever the tool list offers.

Troubleshooting

The server exits at startup

Authentication failed. The log line names the HTTP status and hints that the client ID and secret should be checked, and the process stops before registering tools.

Nothing is returned for a log search

falcon_search_ngsiem queries LogScale-based Next-Gen SIEM with CQL. A LogScale deployment that is not behind NG-SIEM is not reachable through this server.

The tool list is too large for the client

138 tools register by default. Use the package's module filtering to register only the modules a session needs.

A CQL query is rejected

The package ships a CQL authoring guide as a resource for the query_string parameter. Have the agent read that resource before composing a query.

CrowdStrike LogScale MCP server: Reference

What engineers report

The repository is active and well starred, so the useful figures are the module and tool counts.

“falcon-mcp outputs INFO log messages to stdout during initialization when using stdio transport, which breaks JSON-RPC protocol compatibility with MCP clients.”

“Setting up the URL just as http://x.x.x.x:8000 gives 404 Not Found. Digging around and determined we needed to have a trailing /mcp in the URL.”

Repository facts from the GitHub API and PyPI, retrieved 24 August 2026. Tool and module counts were read from the installed package's own _add_tool registration calls. An unauthenticated tools/list is impossible here: a capture attempt on the same date returned HTTP 401 and the process exited.

Should you connect an agent to CrowdStrike LogScale?

Yes. Best for module filtering, so a session registers the few modules its question needs.

Strongest fit

Falcon customers whose logs sit behind Next-Gen SIEM and who want one connector across security telemetry.

Main advantage

One authenticated connection reaches 27 modules, from detections through intelligence to cloud posture.

Main weakness

LogScale is one tool of 138, so a log-only use case pays for a great deal it will not call.

Operational risk

Writing tools exist among the 138, and the API client's scopes rather than the tool list are the real boundary.

Frequently asked questions