falcon-mcp/.env.example at main · dronedeploy/falcon-mcp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
# =============================================================================
# CrowdStrike Falcon API Credentials
# =============================================================================
# Required: Get these from your CrowdStrike console (Support > API Clients and Keys)
FALCON_CLIENT_ID=your-client-id
FALCON_CLIENT_SECRET=your-client-secret

# =============================================================================
# CrowdStrike Falcon API Base URL
# =============================================================================
# Required: Choose the correct region for your CrowdStrike instance
# US-1 (Default):     https://api.crowdstrike.com
# US-2:               https://api.us-2.crowdstrike.com
# EU-1:               https://api.eu-1.crowdstrike.com
# US-GOV:             https://api.laggar.gcw.crowdstrike.com
FALCON_BASE_URL=https://api.us-2.crowdstrike.com

# =============================================================================
# Optional: Flight Control (MSSP) Support
# =============================================================================
# Child CID for Flight Control (MSSP multi-tenancy)
# Use this to target a specific child CID when authenticating with parent credentials
# Requires Flight Control enabled on the parent tenant
#FALCON_MEMBER_CID=

# =============================================================================
# Optional: Server Configuration
# =============================================================================
# Modules to enable (comma-separated list)
# Options: detections,incidents,intel,hosts,spotlight,cloud,idp,sensorusage
# Default: all modules enabled if not specified
#FALCON_MCP_MODULES=detections,incidents,intel,hosts,spotlight,cloud,idp,sensorusage,serverless,discover

# Transport method to use
# Options: stdio, sse, streamable-http
# Default: stdio
#FALCON_MCP_TRANSPORT=stdio

# Enable debug logging
# Options: true, false
# Default: false
#FALCON_MCP_DEBUG=false

# Host for HTTP transports (sse, streamable-http)
# Default: 127.0.0.1
#FALCON_MCP_HOST=127.0.0.1

# Port for HTTP transports (sse, streamable-http)
# Default: 8000
#FALCON_MCP_PORT=8000

# User agent comment to include in API requests
# This will be added to the User-Agent header comment section
# Example: CustomApp/1.0
#FALCON_MCP_USER_AGENT_COMMENT=

# Enable stateless HTTP mode for scalable deployments
# Creates a new transport connection per request instead of persistent sessions
# Options: true, false
# Default: false
#FALCON_MCP_STATELESS_HTTP=false

# API key for HTTP transport authentication (x-api-key header)
# Only applies to sse and streamable-http transports
#FALCON_MCP_API_KEY=