CrowdStrike MCP

Detections/alerts (modern Alerts API, replaces the decommissioned Detects API)

Analyze locally synced data with count, group-by, and summary operations. Data must be synced first with the sync command.

Get API domain context: resource taxonomy, auth requirements, query tips, and unique capabilities. Call this first.

Execute one crowdstrike API endpoint by its endpoint_id (from crowdstrike_search). Params are passed as a JSON object; path placeholders and query strings are resolved automatically.

Search the crowdstrike API for endpoints matching a natural-language query. Returns a ranked list of {endpoint_id, method, path, summary} entries. Call this first to find the endpoint to execute.

Get, query, create, update, and delete devices

Flight-Control-aware fleet commands. 'fleet sync' pulls hosts, alerts, vulnerabilities, prevention policies, and the Flight Control fabric from every child CID into one local store; the rollups (scorecard, vulns, stale, policy-drift, alerts, search, tenants, remediate, trend) then answer cross-tenant questions instantly and offline.

Build a unified, severity-sorted alert queue across all synced CIDs from the local store. Default keeps all open alerts; use --status to scope (e.g. new). Run 'fleet sync' first. Reads no live API.

Compare every tenant's enabled-prevention-policy signature against a baseline CID (or the most common signature when --baseline is omitted) and report which tenants diverge. Run 'fleet sync' first. Reads no live API.

Use this command to group exposure by REMEDIATION ACTION (what to fix, across how many hosts and tenants), joined offline from synced Spotlight vulnerabilities and their remediation facets. Run 'fleet sync' first. Do NOT use this command for the raw severity-ranked vulnerability list; use 'fleet vulns' instead.

Roll up the CID-keyed local store into one posture row per tenant. Run 'fleet sync' first to populate the store. Reads no live API.

Search the CID-keyed fleet store offline: matches hostnames, CVEs, alert names, policy names, IDs, severity, and status across every synced tenant. Run 'fleet sync' first. (The top-level 'search' command covers data synced via the top-level 'sync'; 'fleet search' covers the cross-tenant 'fleet sync' store.)

Surface coverage gaps: hosts whose last_seen is older than --days across all synced CIDs. Run 'fleet sync' first. Reads no live API.

Sync the MSP fleet into the CID-keyed local store. For each Flight Control child CID, fleet sync mints a member_cid-scoped OAuth2 token from your parent API client and pulls hosts, alerts, Spotlight vulnerabilities (with CVE, host, and remediation facets), and prevention policies, tagging every row with its source CID. The fabric kind additionally pulls the Flight Control objects themselves (child CIDs, CID groups, user groups, role grants) from the parent client. The fleet rollups (scorecard, vulns, stale, policy-drift, alerts, tenants, remediate, trend) then read this store offline. Each sync also records a per-CID posture snapshot that powers 'fleet trend'. Requires a parent-CID API client with Flight Control (MSSP) scope. With --cids you can target specific tenants; with neither flag, only the authenticated CID is synced.

Use this command for the whole-fabric "who/what belongs where" RBAC roster across all tenants, joined offline from the synced Flight Control objects. With --expected, also diff the roster against a newline-delimited CID list to catch orphaned or un-onboarded tenants. Run 'fleet sync' first (fabric is in the default kinds). Do NOT use this command for live single-tenant CID CRUD; use the 'mssp' commands instead. Do NOT use it for security-posture rollups; use 'fleet scorecard' instead.

Use this command to see which tenants degraded SINCE the last sync (week-over-week deltas computed from the posture snapshots each 'fleet sync' records). Worst tenants sort first. Run 'fleet sync' at least twice for deltas. Do NOT use this command for the current-state snapshot; use 'fleet scorecard' instead.

Filter and rank synced Spotlight vulnerabilities across all CIDs from the local store. Run 'fleet sync' first. Reads no live API.

Import data from a JSONL file by issuing POST requests for each record. Each line must be a valid JSON object. Failed records are logged to stderr but do not stop the import.

Incidents and behaviors: cross-detection correlation and triage

Get, query, create, add, update, and delete mssp

Get, query, create, update, and delete policy

Full-text search across all synced data. Faster than paginating list endpoints. Requires sync first.

Get and query spotlight

Run read-only SQL against local database. Use for ad-hoc analysis, aggregations, and joins across synced resources. Requires sync first.

Sync data from the API into a local SQLite database. Supports resumable incremental sync (only fetches new data since last sync) and full resync. Once synced, use the 'search' command for instant full-text search. Exit codes & warnings: Resources the API denies access to (HTTP 403, or HTTP 400 with an access-policy body) are reported as warnings rather than failing the run. In --json mode each is emitted as a {"event":"sync_warning",...} line carrying status, reason, and message fields, and a final {"event":"sync_summary",...} aggregates the run. Exit 0 when at least one resource synced and no resource flagged in the spec as critical (x-critical: true) failed; non-critical failures emit {"event":"sync_warning","reason":"exit_policy_default_changed", ...} so callers can detect that a partial failure was tolerated. Pass --strict to exit non-zero on any per-resource failure. Exit is always non-zero when every selected resource failed, regardless of --strict. Resource scoping: --resources runs the named top-level resources, plus any parent-keyed dependent whose own name is listed OR whose parent table is listed. Naming a parent therefore cascades to its dependents (so "sync this parent and its children" works without listing every nested resource by hand). There is no flag today to suppress the cascade for a named parent. To run a dependent without re-syncing its parent, list only the dependent by name; the parent table must already be populated from a prior sync.

Tail streams live data changes by polling the API at configurable intervals. Events are emitted as NDJSON to stdout for piping to other tools. Gracefully shuts down on SIGTERM/SIGINT. Note: For APIs with WebSocket or SSE support, a future version will use native streaming instead of polling.

Compound workflows that combine multiple API operations

Archive fetches all syncable resources from the API and stores them in a local SQLite database. Supports incremental sync (only new data since last run) and full resync. After archiving, use 'search' for instant full-text search.