docs(crowdstrike): name each tool and the API scope it needs

product/admin/mcp-server/crowdstrike.mdx

@@ -9,7 +9,7 @@
 {/* Editor Refresh: 2026-06-11 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 The CrowdStrike MCP server lets you govern access to CrowdStrike Falcon — detections, incidents, hosts, vulnerabilities, and other data exposed by the Falcon API — as tools your AI clients can call through C1.
@@ -37,25 +37,77 @@
 
 <Steps>
 <Step>
-In the Falcon console, go to **Support and resources** > **API clients and keys** and select **Add new API client**.
-
-{/* REVIEWER NOTE — needs a verified docs link for generating credentials */}
+In the Falcon console, go to **Support and resources** > **API clients and keys**.
 </Step>
 <Step>
-Give the client a recognizable name such as `C1`, then grant only the **API scopes** you need, such as **Read** access to Detections, Incidents, and Hosts.
+Select **Add new API client**.
 </Step>
 <Step>
-Select **Create**, then copy the **Client ID** and **Client Secret**. CrowdStrike shows the secret only once.
+Give the client a recognizable name such as `C1`, then grant **Read** on the API scopes covering the tools you want. See [Choose API scopes](#choose-api-scopes) for the mapping.
 </Step>
 <Step>
-Note your Falcon cloud's API base URL, such as `https://api.crowdstrike.com` or your region-specific endpoint.
-
-{/* REVIEWER NOTE — confirm exact UI labels/path */}
+Select **Create**.
+</Step>
+<Step>
+Copy the **Client ID** and **Client Secret**. CrowdStrike shows the secret only once.
+</Step>
+<Step>
+Note your Falcon cloud's API base URL. Each tenant lives on one regional cloud, and both the token request and every API call go to that region's gateway.
+
+| Falcon cloud | API base URL |
+|---|---|
+| US-1 | `https://api.crowdstrike.com` |
+| US-2 | `https://api.us-2.crowdstrike.com` |
+| EU-1 | `https://api.eu-1.crowdstrike.com` |
+| US-GOV-1 | `https://api.laggar.gcw.crowdstrike.com` |
+| US-GOV-2 | `https://api.us-gov-2.crowdstrike.mil` |
 </Step>
 </Steps>
 
+You now have a client ID, client secret, and base URL to enter when you register the server in C1.
+
 For a shared production setup, use a dedicated API client so activity is attributable to C1 rather than a person.
 
+## Choose API scopes
+
+Each tool reads a different Falcon API, and each API has its own scope. Grant **Read** on the scopes for the tools you want. A tool whose scope is missing returns CrowdStrike's authorization error rather than an empty result, so an unexpected 403 usually means the scope is absent from the API client.
+
+| Tools | Falcon API scope |
+|---|---|
+| `list_hosts` | Hosts |
+| `list_alerts` | Alerts |
+| `list_incidents` | Incidents |
+| `list_ioc_indicators` | IOC Management |
+| `list_device_control_policies` | Device Control Policies |
+| `list_vulnerabilities`, `list_remediations` | Vulnerabilities |
+| `list_intel_actors` | Actors (Falcon Intelligence) |
+| `list_intel_indicators` | Indicators (Falcon Intelligence) |
+| `list_intel_reports` | Reports (Falcon Intelligence) |
+| `list_zero_trust_assessments` | Zero Trust Assessment |
+| `list_discover_applications` | Assets |
+| `list_ioms`, `list_iom_details` | CSPM Registration |
+
+Falcon Intelligence is three separate scopes, not one — granting **Actors** doesn't enable `list_intel_indicators` or `list_intel_reports`. Grant each scope whose tool you want.
+
+<Note>
+Spotlight, Falcon Intelligence, Zero Trust Assessment, Discover, Device Control, and Cloud Security are separately licensed Falcon products. If a scope you expect isn't in the dialog, your tenant doesn't license that product. An unlicensed module returns 403 the same way a missing scope does, so when a tool 403s and its scope is already granted, check the license before re-editing scopes.
+</Note>
+
+Four tools take action in CrowdStrike and need **Write** as well:
+
+| Tools | Falcon API scope |
+|---|---|
+| `contain_host`, `lift_containment`, `hide_host` | Hosts (Write) |
+| `create_ioc_indicator` | IOC Management (Write) |
+
+Leaving Write off the API client is a deliberate way to keep the connection read-only: those four tools then return CrowdStrike's authorization error, and the rest keep working.
+
+<Note>
+`list_ioms` and `list_iom_details` need the **CSPM Registration** scope. CrowdStrike also offers a **Cloud Security API Detections** scope, which is the easier one to reach for by name — but it authorizes a different misconfiguration family (`/cloud-security-evaluations/`) that C1 doesn't expose, so an API client carrying only that scope returns 403 from both tools. The Alerts scope doesn't cover them either, despite the endpoints sharing a URL prefix with Falcon's detections API. If `list_ioms` returns 403 while your other tools return data, add CSPM Registration to the API client.
+</Note>
+
+Scope changes take effect the next time C1 requests a token, so you don't need to re-register the server or reconnect after editing the API client.
+
 ## How CrowdStrike credentials are shared
 
 The API client authenticates every user as one shared Falcon identity, so CrowdStrike sees a single identity for all tool calls. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared setup, use a dedicated API client so activity is attributable to C1 rather than a person.
@@ -85,9 +137,9 @@
 
 After you register the server, C1 runs tool discovery against CrowdStrike. Discovered tools appear on the server's **Tools** tab.
 
 Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call a CrowdStrike tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your CrowdStrike credentials when an approved user successfully calls a CrowdStrike tool from their AI client.
@@ -96,4 +148,4 @@
 ## Manage your CrowdStrike credentials
 
 - **Rotate the client secret** by resetting it on the API client in the Falcon console, then update the secret on the server's authentication settings in C1.
-- **Adjust access** by editing the API scopes granted to the API client in CrowdStrike.
+- **Adjust access** by editing the API scopes granted to the API client in CrowdStrike. See [Choose API scopes](#choose-api-scopes).