# Deploy to Amazon Bedrock AgentCore via AWS Marketplace

The Falcon MCP Server is available on the [AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-afoqfhvuepgne) for streamlined deployment to Amazon Bedrock AgentCore. The Marketplace listing provides a pre-built container image hosted in AWS and handles IAM permission configuration automatically.

## Prerequisites

### CrowdStrike API Credentials

Create API credentials in your CrowdStrike console:

1. Log into your CrowdStrike console
2. Navigate to **Support > API Clients and Keys**
3. Click **Add new API client**
4. Configure your API client:
   - **Client Name**: Choose a descriptive name (e.g., "Falcon MCP Server")
   - **Description**: Optional description for your records
   - **API Scopes**: Select scopes based on which modules you plan to use ([see scope requirements](https://github.com/CrowdStrike/falcon-mcp#available-modules-tools--resources))
5. Note down these values (you cannot retrieve them later):
   - `FALCON_CLIENT_ID` - Your API client ID
   - `FALCON_CLIENT_SECRET` - Your API client secret
   - `FALCON_BASE_URL` - Your API base URL (region-specific)

### AWS VPC Requirements

The MCP Server requires internet connectivity to communicate with CrowdStrike's APIs.

- **Internet Gateway or NAT Gateway** - Enables outbound internet connectivity
- **Outbound HTTPS Access** - Allow communication to `api.crowdstrike.com` on port 443
- **Security Groups** - Configure appropriate rules for your network requirements

## Getting Started

To deploy the Falcon MCP Server to Amazon Bedrock AgentCore:

1. Visit the [Falcon MCP Server on AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-afoqfhvuepgne)
2. Follow the subscription and deployment instructions
3. Configure your CrowdStrike API credentials and environment variables as described below

## Usage Instructions

### Environment Variables

Configure these environment variables when deploying your AgentCore agent:

| Variable | Value | Description |
| :--- | :--- | :--- |
| `FALCON_CLIENT_ID` | Your client ID | CrowdStrike API client ID |
| `FALCON_CLIENT_SECRET` | Your client secret | CrowdStrike API client secret |
| `FALCON_BASE_URL` | `https://api.crowdstrike.com` | API base URL (region-specific) |
| `FALCON_MCP_TRANSPORT` | `streamable-http` | Transport protocol |
| `FALCON_MCP_HOST` | `0.0.0.0` | Host binding |
| `FALCON_MCP_PORT` | `8000` | Server port |
| `FALCON_MCP_USER_AGENT_COMMENT` | `AWS/Bedrock/AgentCore` | Request identifier |
| `FALCON_MCP_STATELESS_HTTP` | `true` | **Required** for AgentCore |
| `FALCON_MCP_API_KEY` | *(optional)* | API key to secure the MCP endpoint |

> **Important:** `FALCON_MCP_STATELESS_HTTP` must be set to `true` for proper operation in AgentCore's stateless container environment.

### Available Modules

The Falcon MCP Server provides security tools organized into modules. Each module requires specific API scopes.

| Module | Purpose |
| :--- | :--- |
| Cloud Security | Analyze Kubernetes containers and container image vulnerabilities |
| Detections | Find and analyze detections for malicious activity |
| Discover | Search application inventory across your environment |
| Hosts | Manage and query host/device information |
| Identity Protection | Entity investigation and identity protection analysis |
| Intel | Research threat actors, IOCs, and intelligence reports |
| IOC Management | Create, search, and delete custom indicators of compromise |
| Next-Gen SIEM | Execute CQL queries against CrowdStrike LogScale |
| Scheduled Reports | Manage scheduled reports, launch on demand, and download results |
| Sensor Usage | Access and analyze sensor usage data |
| Serverless | Search vulnerabilities in serverless functions |
| Spotlight | Manage vulnerability data and security assessments |

**Example tool invocation** (search for recent detections):

```json
{
  "jsonrpc": "2.0",
  "id": "1",
  "method": "tools/call",
  "params": {
    "name": "falcon_search_detections",
    "arguments": { "filter": "status:'new'" }
  }
}
```

### Verify Deployment

After deployment, verify connectivity by invoking the `falcon_check_connectivity` tool:

```json
{
  "jsonrpc": "2.0",
  "id": "1",
  "method": "tools/call",
  "params": { "name": "falcon_check_connectivity" }
}
```

### Additional Resources

For full details, visit the [Falcon MCP GitHub repository](https://github.com/CrowdStrike/falcon-mcp).
