CrowdStrike Falcon AIDR MCP

The CrowdStrike Falcon AIDR MCP plugin inspects Model Context Protocol (MCP) traffic flowing through Kong Gateway to an MCP server, evaluating tool listings, tool call inputs, and tool outputs against CrowdStrike’s AIDR policies in real time. Traffic that violates your security policies is blocked at the gateway. No changes to the MCP client or server are required.

Integrating the CrowdStrike Falcon AIDR MCP plugin into your Kong Gateway allows you to:

• Detect malicious tool descriptions: Inspect the tools an MCP server advertises for prompt injection payloads hidden in tool metadata.
• Block malicious tool call inputs: Evaluate tool call arguments against your AIDR policies before the tool executes.
• Prevent sensitive data exfiltration: Inspect tool call outputs for PII, credentials, and other sensitive content before it reaches the client.
• Centralize AI security visibility: Stream audit events to the CrowdStrike Falcon AIDR console and Next-Gen SIEM without modifying your application.

You can also use this plugin together with the CrowdStrike Falcon AIDR Request and CrowdStrike Falcon AIDR Response plugins to protect LLM chat traffic in addition to MCP tool traffic.

Note: This plugin is built for AI Gateway running on Kong Gateway. It has not been validated against AI Gateway 2.0.

The CrowdStrike Falcon AIDR MCP plugin inspects the following MCP JSON-RPC 2.0 event types as they pass through Kong Gateway:

• tool_listing: Inspects the list of tools an MCP server advertises in response to a tools/list request, detecting malicious tool descriptions such as prompt injection embedded in tool metadata.
• tool_input: Inspects tool call arguments in a tools/call request before the tool executes, blocking malicious inputs before they reach the MCP server.
• tool_output: Inspects the tool result an MCP server returns, blocking sensitive data exfiltration in tool output before it reaches the client.

initialize, ping, and other non-tool MCP methods pass through without inspection.

 
sequenceDiagram
autonumber
    participant Client
    participant Plugin as Kong Gateway
AIDR MCP plugin
    participant AIDR as CrowdStrike Falcon AIDR
    participant MCP as MCP Server

    Client->>Plugin: tools/list, tools/call request
    Plugin->>AIDR: Submit event against AIDR policies
    AIDR->>Plugin: Verdict

    alt If tool_input is flagged
        Plugin->>Client: Return JSON-RPC error
    else If request is allowed
        Plugin->>MCP: Forward request
        MCP->>Plugin: Return tool result or tool listing
        Plugin->>AIDR: Submit tool_listing or tool_output against AIDR policies
        AIDR->>Plugin: Verdict
        alt If tool_listing or tool_output is flagged
            Plugin->>Client: Return JSON-RPC error
        else If response is allowed
            Plugin->>Client: Return tool result or tool listing
        end
    end
  

Figure 1: Request and response flow showing how the CrowdStrike Falcon AIDR MCP plugin evaluates MCP tool listings, tool call inputs, and tool outputs against CrowdStrike Falcon AIDR policies. Flagged events are blocked with a JSON-RPC error, while allowed traffic is forwarded or returned.

MCP JSON-RPC 2.0 only uses POST requests. When applied to a Route, restrict the Route to so it accepts POST methods only.

Using CrowdStrike Falcon AIDR MCP with the AI MCP Proxy plugin

The AI MCP Proxy plugin and the CrowdStrike Falcon AIDR MCP plugin can be used together on the same Service. The CrowdStrike Falcon AIDR MCP plugin runs at priority 950, before AI MCP Proxy’s priority 820, so tool_input inspection always runs first.

AI MCP Proxy operates in four modes, and the mode determines which AIDR inspection events fire:

passthrough-listener and conversion-listener modes are fully supported. listener mode provides tool_input coverage only.

The CrowdStrike Falcon AIDR MCP plugin is built from source using the luarocks utility bundled with Kong Gateway. It depends on the kong-plugin-crowdstrike-aidr-shared library, which is included in the same repository.

Prerequisites

Before installing the plugin, ensure you have the following:

• CrowdStrike customer account in one of the following clouds: US-1, US-2, or EU-1
• AIDR for Agents Falcon subscription
• AIDR Admin role assigned to your Falcon user for the current customer account
• HTTP access to AIDR API origins
• A running Kong Gateway installation

Register a Kong Collector in AIDR

Register a collector in the AIDR console to obtain the API key and base URL required to configure the plugin.

1. In the AIDR console, go to the Collectors page.
2. Click Collector.
3. Choose Gateway as the collector type, select Kong, and click Next.
4. Configure the collector:
   • Collector Name: Enter a descriptive name to appear in dashboards and reports.
   • Logging: Select whether to log full traffic content, or metadata only.
   • Policy (optional): Assign a policy to apply detection rules to traffic. You can select an existing policy, create one on the Policies page, or select No Policy, Log Only to record activity without applying detection rules.
5. Click Save to complete registration.

After saving, open the Config tab on the collector details page and copy your API key and AIDR base URL. You’ll need these when enabling the plugin.

Installation steps

The following installation steps install and build the crowdstrike-aidr-mcp plugin and the crowdstrike-aidr-shared library.

Note: If you want to set up the other Crowdstrike plugins at the same time, you can add their names to your installation and builds, alongside the other two packages.

After installing the plugin, enable the CrowdStrike Falcon AIDR MCP plugin on a Route.

Restrict the Route to POST requests, since MCP JSON-RPC 2.0 uses only POST.

After enabling the plugin, verify it’s inspecting MCP traffic as expected.

Send a tools/list request:

curl -s -X POST http://localhost:8000/your-mcp-route \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc": "2.0", "method": "tools/list", "id": 1, "params": {}}'

A tool_listing event is sent to AIDR with the server’s tool definitions. If a tool description contains a prompt injection payload, AIDR detects it and the plugin returns a JSON-RPC error to the client instead of the tool listing.

Send a tools/call request:

curl -s -X POST http://localhost:8000/your-mcp-route \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc": "2.0", "method": "tools/call", "id": 2, "params": {"name": "get_weather", "arguments": {"location": "New York"}}}'

This request triggers both a tool_input event, evaluated before the MCP server executes the tool, and a tool_output event, evaluated against the tool’s result. If the arguments or the result contain a malicious payload or sensitive data such as PII, AIDR detects it and the plugin blocks the call or the response.

The events also appear in the AIDR console under your collector.

After deploying the plugin, you can view collected event data in the CrowdStrike Falcon AIDR console:

• Findings page: Review individual events, detections, and actions taken.
• Visibility page: Explore relationships between logged data attributes and view metrics in AIDR dashboards.
• Next-gen SIEM: Analyze event data for broader threat investigation and response workflows.