{
  "id": "tool-server:mcp-falco",
  "_kind": "ToolServer",
  "_file": "extensions/tool-servers/mcp-security-observability.yaml",
  "_cluster": "extensions",
  "attributes": {
    "displayName": "Falco MCP Server",
    "description": "Lightweight MCP server that exposes the Falcosidekick event search API as a tool.\nEnables AI agents to query and analyze Falco runtime security events, inspect anomalous\ncontainer and host activity, and investigate threat detection alerts via HTTP.\n",
    "protocol": "mcp",
    "category": "security",
    "repoUrl": "https://github.com/maratsal/falco-mcp",
    "maintainer": "Community",
    "mcpTransports": [
      "mcp-transport:stdio"
    ]
  },
  "outgoingEdges": [
    {
      "from": "tool-server:mcp-falco",
      "to": "tool:falco",
      "kind": "integrates_with",
      "attributes": {}
    },
    {
      "from": "tool-server:mcp-falco",
      "to": "domain:cybersecurity",
      "kind": "lib_applies_to_domain",
      "attributes": {}
    },
    {
      "from": "tool-server:mcp-falco",
      "to": "domain:devops",
      "kind": "lib_applies_to_domain",
      "attributes": {}
    }
  ],
  "incomingEdges": []
}