[Bug]: Falcon MCP fails auth at startup with valid OAuth token and correct parent CID

[rodrigobrenes]

Initial Checks

• I confirm that I'm using the latest version of falcon-mcp
• I searched existing issues before opening this report

Bug Description

We are testing the falcon-mcp (stdio) integration.

Facts:

• OAuth2 client-credentials flow succeeds (access_token returned from /oauth2/token)
• Using parent CID: confirmed by the API key settings
• Base URL: https://api.crowdstrike.com
• Minimal module set tested: detections only (even though I provisioned that and more)
• Environment vars passed explicitly (CLIENT_ID, CLIENT_SECRET, BASE_URL)
• Running via uvx in VS Code MCP
  Problem happens in VS Code Insiders & Copilot CLI.

Result:
falcon-mcp exits at startup with:
"Failed to authenticate with the Falcon API"

This occurs AFTER token issuance, which suggests CID binding or backend entitlement validation rather than credential failure.

Question:
Is falcon-mcp expected to work with a parent CID, or does it require a child/member CID for API calls even when OAuth succeeds? I tested with and without CID and still fails.

Happy to provide logs or test patches if needed.

Steps to Reproduce

Environment

macOS
Visual Studio Code Insiders
GitHub Copilot enabled
MCP configured via user-level mcp.json opened using
MCP: Open User Configuration in VS Code Insiders
Falcon MCP executed via stdio using uvx

API Client Setup

CrowdStrike Falcon API client created internally by our organization administrators with read access (for example: alerts/detections read)
OAuth2 client‑credentials flow succeeds:
Calling the OAuth token endpoint returns a valid access_token
A parent CID is explicitly provided via the --member-cid argument (value intentionally omitted)

VS Code MCP Configuration
Falcon MCP is configured in VS Code Insiders mcp.json as follows

{
"servers": {
"falcon": {
"type": "stdio",
"command": "uvx",
"args": [
"falcon-mcp",
"--modules",
"detections",
"--member-cid",
""
],
"env": {
"FALCON_CLIENT_ID": "",
"FALCON_CLIENT_SECRET": "",
"FALCON_BASE_URL": "https://api.crowdstrike.com"
}
}
}
}

Steps

Open Copilot Chat in VS Code Insiders
Switch to Agent mode
Open Tools → MCP Servers
Click Start on the falcon MCP server
Observed Behavior
Falcon MCP initializes
Immediately exits with:
Failed to authenticate with the Falcon API
VS Code reports the MCP process exited with code 1

Additional Notes
OAuth token issuance succeeds independently using the same client credentials (a valid access_token is returned).
The failure occurs during falcon-mcp startup (after initialization), and the process exits with code 1.
We tested both with and without the --member-cid argument; the behavior is the same in both cases (startup fails with “Failed to authenticate with the Falcon API”).
The issue reproduces in two clients:
VS Code Insiders MCP (user-level mcp.json, stdio server executed via uvx)
Copilot CLI using the same credentials and the same stdio command
Reducing the configuration to a single module (for example detections) does not change the behavior; the server still fails at startup.
Environment variables are explicitly set (client ID, client secret, base URL) inside the MCP configuration and not inherited implicitly from the shell.

Installation Method

uvx run falcon-mcp

Environment Details

Operating System: macOS
Python version: 3.11
MCP Client(s) tested: Visual Studio Code Insiders (Copilot Chat, Agent mode, MCP configured via user-level mcp.json) GitHub Copilot CLI
MCP transport: stdio (local execution via uvx)
Falcon MCP execution method: uvx falcon-mcp
Falcon API region: us‑1
Enabled modules tested: detections only (single-module test)
Authentication method: OAuth2 client‑credentials (client ID / client secret via environment variables)

Error Logs (Optional)

2026-04-17 13:23:28.036 [info] Starting server falcon
2026-04-17 13:23:28.036 [info] Connection state: Starting
2026-04-17 13:23:28.036 [info] Starting server from LocalProcess extension host
2026-04-17 13:23:28.043 [info] Connection state: Starting
2026-04-17 13:23:28.043 [info] Connection state: Running
2026-04-17 13:23:30.292 [warning] [server stderr] Downloading pydantic-core (1.9MiB)
2026-04-17 13:23:30.723 [warning] [server stderr]  Downloaded pydantic-core
2026-04-17 13:23:30.769 [warning] [server stderr] Installed 34 packages in 45ms
2026-04-17 13:23:33.045 [info] Waiting for server to respond to `initialize` request...
2026-04-17 13:23:33.708 [warning] [server stderr] 2026-04-17 13:23:33,707 - falcon_mcp.server - INFO - Initializing Falcon MCP Server
2026-04-17 13:23:34.405 [warning] [server stderr] 2026-04-17 13:23:34,404 - falcon_mcp.server - ERROR - Failed to authenticate with the Falcon API
2026-04-17 13:23:34.405 [warning] [server stderr] 2026-04-17 13:23:34,404 - falcon_mcp.server - ERROR - Runtime error: Failed to authenticate with the Falcon API
2026-04-17 13:23:34.485 [info] Connection state: Error Process exited with code 1

Additional Context (Optional)

No response

[chxseh]

Can reproduce, credentials are correct because I can manually use the credentials and they work fine.

[info] Stopping server falcon-mcp
[info] Starting server falcon-mcp
[info] Connection state: Starting
[info] Starting server from LocalProcess extension host
[info] Connection state: Starting
[info] Connection state: Running
[warning] [server stderr] 2026-04-22 09:53:36,175 - falcon_mcp.server - INFO - Initializing Falcon MCP Server
[warning] [server stderr] 2026-04-22 09:53:36,335 - falconpy._auth_object._falcon_interface - DEBUG - CREATED: APIHarnessV2 interface class
[warning] [server stderr] 2026-04-22 09:53:36,335 - falconpy._auth_object._falcon_interface - DEBUG - AUTH: Configured for Direct Authentication
[warning] [server stderr] 2026-04-22 09:53:36,335 - falconpy._auth_object._falcon_interface - DEBUG - CONFIG: Base URL set to https://api.crowdstrike.com
[warning] [server stderr] 2026-04-22 09:53:36,335 - falconpy._auth_object._falcon_interface - DEBUG - CONFIG: SSL verification is set to True
[warning] [server stderr] 2026-04-22 09:53:36,335 - falconpy._auth_object._falcon_interface - DEBUG - CONFIG: Timeout set to None seconds
[warning] [server stderr] 2026-04-22 09:53:36,335 - falconpy._auth_object._falcon_interface - DEBUG - CONFIG: Proxy dictionary: None
[warning] [server stderr] 2026-04-22 09:53:36,335 - falconpy._auth_object._falcon_interface - DEBUG - CONFIG: User-Agent string set to: falcon-mcp/0.9.0 (falconpy/1.6.1; Python/3.13.11; Windows/11)
[warning] [server stderr] 2026-04-22 09:53:36,335 - falconpy._auth_object._falcon_interface - DEBUG - CONFIG: Token renewal window set to 120 seconds
[warning] [server stderr] 2026-04-22 09:53:36,335 - falconpy._auth_object._falcon_interface - DEBUG - CONFIG: Maximum number of records to log: 100
[warning] [server stderr] 2026-04-22 09:53:36,335 - falconpy._auth_object._falcon_interface - DEBUG - CONFIG: Log sanitization is enabled
[warning] [server stderr] 2026-04-22 09:53:36,335 - falconpy._auth_object._falcon_interface - DEBUG - CONFIG: Pythonic responses are disabled
[warning] [server stderr] 2026-04-22 09:53:36,335 - falconpy._auth_object._falcon_interface - DEBUG - VERSION: Currently running FalconPy v1.6.1
[warning] [server stderr] 2026-04-22 09:53:36,335 - falcon_mcp.client - DEBUG - Initialized Falcon client with base URL: https://api.crowdstrike.com
[warning] [server stderr] 2026-04-22 09:53:36,335 - falconpy._auth_object._falcon_interface - DEBUG - OPERATION: oauth2AccessToken
[warning] [server stderr] 2026-04-22 09:53:36,335 - falconpy._auth_object._falcon_interface - DEBUG - ENDPOINT: https://api.crowdstrike.com/oauth2/token (POST)
[warning] [server stderr] 2026-04-22 09:53:36,335 - falconpy._auth_object._falcon_interface - DEBUG - HEADERS: {'User-Agent': 'falcon-mcp/0.9.0 (falconpy/1.6.1; Python/3.13.11; Windows/11)', 'CrowdStrike-SDK': 'crowdstrike-falconpy/1.6.1'}
[warning] [server stderr] 2026-04-22 09:53:36,335 - falconpy._auth_object._falcon_interface - DEBUG - PARAMETERS: None
[warning] [server stderr] 2026-04-22 09:53:36,335 - falconpy._auth_object._falcon_interface - DEBUG - BODY: None
[warning] [server stderr] 2026-04-22 09:53:36,335 - falconpy._auth_object._falcon_interface - DEBUG - DATA: {'client_id': 'REDACTED', 'client_secret': 'REDACTED'}
[warning] [server stderr] 2026-04-22 09:53:36,511 - falcon_mcp.server - ERROR - Failed to authenticate with the Falcon API
[warning] [server stderr] 2026-04-22 09:53:36,511 - falcon_mcp.server - ERROR - Runtime error: Failed to authenticate with the Falcon API
[info] Connection state: Error Process exited with code 1

[carlosmmatos]

Thanks for the detailed report @rodrigobrenes, and @chxseh thanks for confirming the reproduction with debug logs.

To answer your question: falcon-mcp works with parent CID credentials directly. The --member-cid flag is for targeting a child CID in Flight Control/MSSP setups — you'd pass a child CID there, not your parent CID. If you're not doing multi-tenant MSSP, leave it off entirely.

That said, @chxseh's debug logs show no member_cid in the request data and it still fails, so this isn't a CID issue.

The debug output shows FalconPy making the POST to /oauth2/token, then our next log line is the generic "Failed to authenticate" — but we never see what the API actually returned. That's on us: when login() fails we log a generic message and exit without surfacing the HTTP status code or error from the response. I'll make a task to add better logging.

In the meantime, can you try a couple things?

Test your credentials directly against the token endpoint:

curl -s -w "\nHTTP Status: %{http_code}\n" \
  https://api.crowdstrike.com/oauth2/token \
  -d "client_id=$FALCON_CLIENT_ID&client_secret=$FALCON_CLIENT_SECRET"

That should come back with HTTP 201 and an access_token. If you get 401 or 403, the credentials are the problem.

Also try running falcon-mcp from a terminal outside VS Code to rule out environment weirdness:

FALCON_CLIENT_ID="YOUR_CLIENT_ID" \
FALCON_CLIENT_SECRET="YOUR_CLIENT_SECRET" \
FALCON_BASE_URL="https://api.crowdstrike.com" \
uvx falcon-mcp --debug --modules detections

If the curl test returns 201 but falcon-mcp still fails, something is going wrong between FalconPy and the API that we can't see from the current logs.

[chxseh]

I apologize, my issue was actually unrelated, sorry for the noise! I was having internal network certificate issues.