These skills now run in all the popular AI coding assistants! 🚀 Claude Code, Codex, Copilot CLI, Cursor, and Antigravity CLI are all supported, and this release also adds the function execution and debugging commands shipping in Foundry CLI 2.1.0.

Four of the five are verified end to end: the skills were loaded from a local clone, then used to build and deploy an app to a live Falcon Foundry tenant from the example prompt.

Added

Multi-assistant support 🎉

• Install instructions for Claude Code, Codex, Copilot CLI, Cursor, and Antigravity CLI, plus a collapsible table of local-clone commands
• Root plugin.json following the Agent Plugins 1.0.0 spec, so any conforming client recognizes the repo as a plugin
• Sub-skill routing for single-entry-point installs — development-workflow now says where sub-skills live on disk and what to do when a capability request lands on the orchestrator
• Every capability sub-skill links back to development-workflow, so an assistant that picks a sub-skill directly still finds the CLI prerequisite check

Functions (Foundry CLI 2.1.0+):

• Function execution, testing, and debugging via foundry functions exec, test, and logs. Covers the deploy-first rule (exec and test run the deployed artifact, not local code), request-data confirmation before exec, handler disambiguation from the manifest, and the tests.yml schema
• Code-review checklist for handlers: logging on error paths, hardcoded secrets and PII, request/response schema coverage
• CLI guard enforces --no-prompt on the new commands

Routing:

• fusion-redirect skill — declines a standalone Falcon Fusion workflow request (a trigger plus actions that already exist) and points to the sibling Falcon Fusion plugin. Previously this advice was only reachable through a hook, so it never fired on assistants that don't run hooks

Platform:

• US-3 cloud region added to the FOUNDRY_CLOUD_REGION value lists and the multi-cloud deployment section

Fixed

• connection issue on tenant commands — in a workspace-scoped sandbox the CLI cannot write ~/.config/foundry/token.json, where it keeps its short-lived access token. It reports only the symptom, which sent agents investigating networks and credentials. The debugging skill now explains that the refresh is expected and that the fix is granting write access to that directory. Observed on Codex
• Three commands that reject --no-prompt — foundry version, apps list, and apps list-deployments fail with unknown flag. Two are in the prerequisite check, so "always add --no-prompt" broke the first thing an agent runs
• OpenAPI adapter dependencies without hooks — Claude Code's skill router runs adapt_spec_for_foundry.py automatically; Copilot CLI, Cursor, and Antigravity CLI don't. It needs pyyaml, which a bare pip install can't supply on Homebrew or system Pythons (PEP 668), so the API integrations skill now documents a virtualenv setup
• NGSIEM start_search keyword guidance — search= remains the recommendation because it works on every FalconPy version. The explanation now notes that body= is fixed in FalconPy 1.6.5 (#1497)
• Go alerts example used a nonexistent SDK method — replaced client.Alerts.QueryAlerts with PostCombinedAlertsV1, swapped interface{} for the concrete gofalcon response types, and added the Payload.Errors check the official SDK examples use

Known limitations

Antigravity CLI is documented but not verified end to end. Its account quota was exhausted during testing, so the install path and skill discovery are confirmed while the full build-and-deploy run is not.

Getting started

Install:

/plugin install crowdstrike-falcon-foundry

Already installed? Update to 1.5.0:

/plugin update crowdstrike-falcon-foundry

Full Changelog

v1.4.1...v1.5.0

This is a patch release fixing a single eval failure: the functions-falcon-api skill was still directing the model to use the deprecated Detects class from FalconPy, which returns 405 Method Not Allowed in production.

Fixed

• Replaced deprecated Detects API with Alerts API — The skill now directs users to from falconpy import Alerts with query_alerts_v2() / get_alerts_v2() instead of the removed Detects class. Filter by product:'detections' to scope results to detections only. Eval confirmed 5/5 trials passing after the fix.

Getting started

Install:

/plugin install crowdstrike-falcon-foundry

Already installed? Update to 1.4.1:

/plugin update crowdstrike-falcon-foundry

Full Changelog

v1.4.0...v1.4.1

This release adds recipes for querying LogScale and calling GraphQL APIs from functions, clarifies when to reach for an Event Query versus a source-of-truth API, and documents several platform behaviors that are easy to get wrong. Changes were identified by running eval prompts against the skills and fixing the gaps that surfaced.

Added

Functions & APIs:

• LogScale query recipe — NGSIEM.start_search() / get_search_status() pattern verified against a live CID. Documents the search-all repo requirement (specific repo names 403), the search= keyword (FalconPy documents body= but never honors it), the resources vs body response-key asymmetry, and that NGSIEM is the query class while FoundryLogScale is ingestion-only
• GraphQL APIs use case — integrate Falcon Identity Protection, GitHub, and Snyk via FalconPy or HTTP POST, with the env-var vs API-integration security tradeoff
• Function I/O schema requirements — functions called from workflows must be created with --input-schema and --output-schema; schemas bind only at creation, and without them a function produces no visible output in Fusion actions
• scripts/action_search.py — API-based action discovery that works in headless/CI environments where the CLI's interactive actions view prompt hangs

Workflows:

• Workflow deletion warning — deleting and recreating a workflow with the same name wedges all further deploys (409 name must be unique → 400 dependent artifact failed); recovery requires a fresh app
• Standalone Fusion workflow requests (trigger + actions, no UI/function/collection) are now pointed to the dedicated crowdstrike-falcon-fusion plugin, which discovers real action IDs and validates workflow YAML against the platform schema

Platform:

• Collection description validation constraints (3–500 chars, alphanumeric start, allowed character set)
• foundry apps list added to the prerequisite check (CLI 2.0.2 — lists deployed apps from any directory)
• Query parameter type matching for API integrations — a quoted number like limit: '25' passes type-checking then fails server-side with got string want integer

Fixed

• Alert/detection query routing — fetching a population the workflow doesn't have goes to a source-of-truth API (an Event Query against NG-SIEM can silently return nothing); enriching a detection already held stays an Event Query
• Invalid workflow error-handling references — removed non-existent onError blocks, maxConcurrency, and automatic retries; replaced with the real mechanisms (conditional routing on Workflow.Execution.Errors, loop continue_on_partial_execution, sequential loops)
• "Delete and re-create" advice — never delete and recreate a workflow to refresh a binding; recreate the function and update the workflow YAML reference in place
• Action discovery guidance — actions view examples now include --no-prompt and point to action_search.py as the reliable fallback (the CLI ignores --no-prompt for these commands)
• apps delete workaround removed — the 500/stuck-in-Deleting issue is fixed in CLI 2.0.2
• Gemini CLI → Antigravity CLI — updated command (agy) and skills paths; Antigravity reads AGENTS.md directly
• Codex docs link — updated to learn.chatgpt.com/docs/build-skills
• Python scripts renamed to snake_case — adapt-spec-for-foundry.py → adapt_spec_for_foundry.py. Behavior unchanged, but update any tooling that invoked the old hyphenated path directly

Getting started

Install:

/plugin install crowdstrike-falcon-foundry

Already installed? Update to 1.4.0:

/plugin update crowdstrike-falcon-foundry

Full Changelog

v1.3.0...v1.4.0

"Peace of mind isn't at all superficial... It's the whole thing. That which produces it is good maintenance; that which disturbs it is poor maintenance." — Robert Pirsig, Zen and the Art of Motorcycle Maintenance

This release is about quality. Every change was identified by running automated eval prompts against the skills with Sonnet and Opus, then investigating failures and fixing the gaps that surfaced.

Added

Functions & API Integrations:

• Credential management decision table (API integration vs FalconPy vs env vars) with security tradeoffs
• OAuth scope reference table mapping FalconPy classes/methods to correct manifest scopes — no more detects-read when it should be detects:read
• APIIntegrations().execute_command_proxy() code examples for calling registered third-party APIs from function code

UI:

• Vanilla JS as a first-class template option for pages and extensions (no npm install or build step needed)
• Async connect() callout: use React state (isInitialized) as the useMemo dependency, not falcon.isConnected

Workflows:

• HTTP Actions reference with verified Inline.HTTPRequest schema, both auth patterns, status-code routing, and an HTTP-Actions-vs-API-integration decision guide
• Collection config lookup pattern for reading user-configured settings before performing actions
• Response Action Workflow (Contain Host) example with platform action discovery
• Null-guard warning for trigger parameters that may be empty via API or sub-workflow calls

Fixed

• Trigger parameter syntax — Was ${data['trigger.param_name']}, corrected to ${data['param_name']}
• CEL has() usage — has(data['key']) throws in Fusion; replaced with data['key'] != null and modern data[?'key'].orValue(default) patterns
• version_constraint guidance — Now explains it pins against semantic_version; some platform actions require ~0
• system_action default — Changed to false since most on-demand workflows should be SOAR-visible
• CustomStorage bulk reads — Use FQL filters, not sequential GetObject loops
• CSP/Shoelace icons — Mentions Foundry's CSP allowlist and local asset alternative
• Workflows sub-skill loading — Forced from orchestrator to prevent hallucinated workflow YAML formats

Full Changelog

v1.2.0...v1.3.0

Highlights

• CLI guard improvements — foundry apps deploy now enforces --change-type and --change-log flags (prevents a 500 from the Foundry API), and identity.detections.details is recognized as a valid UI extension socket. Skill size budget validation added to CI.
• Foundry-JS reference updates — falcon.apiIntegration().execute() calling pattern for external APIs from the UI, navigateTo target option for new tab behavior, and default target (_self) documented from source.
• Python function testing — Falcon console testing documentation including discovering the Function logs button.
• Troubleshooting additions — Collection write errors (schema mismatches return errors in the response body without throwing), blank page from un-awaited falcon.connect(), and data not appearing after writes.
• UI extension socket table — Console navigation paths added so developers can find where each extension renders.

Full Changelog: v1.1.0...v1.2.0

Highlights

• e2e-testing skill — End-to-end testing for Foundry apps using @crowdstrike/foundry-playwright. Covers the 4-project pipeline (authenticate → install → test → uninstall), page objects, configuration screens, CI with GitHub Actions, and debugging with Playwright MCP.
• Foundry-JS reference — falcon.api.workflows, falcon.logscale, falcon.cloudFunction, and collections CRUD patterns for @crowdstrike/foundry-js.
• NGSIEM query export use case — Export Falcon Next-Gen SIEM query results to CSV/JSON via Foundry functions with pagination and scheduled workflow patterns.
• agentskills.io metadata — All skills now have tags, author, license, and compatibility fields per the agentskills.io open spec.
• Marketplace disclosure — plugin.json now discloses the npx swagger2openapi network call.

Full Changelog: v1.0.0...v1.1.0

Initial release of the CrowdStrike Falcon Foundry plugin for Claude Code.

Provides skills and hooks for building Falcon Foundry apps: API integrations, collections, functions (Python/Go), workflows, and UI extensions/pages. Includes CLI guard rails, automated spec adaptation, and a development workflow orchestrator.