crowdstrike-falcon-foundry
CrowdStrike Falcon Foundry development skills for building cybersecurity applications on the Falcon platform. Includes UI development, colle
Open source Repository Open in the app JSON README (API)
About
CrowdStrike Falcon Foundry development skills for building cybersecurity applications on the Falcon platform. Includes UI development, collections, functions, workflows, API integration, security patterns, and debugging workflows.
Details
- Kind
- Plugins
- Topic
- Developer tools
- Publisher
- crowdstrike
- Origin
- marketplace
- Category
- ferramentas
- Stars
- 25
- Forks
- 2
- Last push
- 2026-08-30T20:01:19Z
- Repository state
- ativo
- Language
- Shell
- License
- MIT
- Added
- 2026-08-30 01:48:58
- Updated
- 2026-08-30 01:48:58
- Origin id
crowdstrike/foundry-skills/crowdstrike-falcon-foundry
README
# Falcon Foundry Skills
[](https://github.com/CrowdStrike/foundry-skills/releases/tag/v1.5.0)
[](https://github.com/CrowdStrike/foundry-skills/actions/workflows/main.yml)
AI coding assistant skills for building [CrowdStrike Falcon Foundry](https://www.crowdstrike.com/en-us/platform/next-gen-siem/falcon-foundry/) apps. Build Foundry apps from a natural language prompt — API integrations, workflows, UI pages, functions, and collections — all scaffolded with the Foundry CLI and deployed to the Falcon console.
## Getting Started
### Prerequisites
- **Foundry CLI**: Install with `brew tap crowdstrike/foundry-cli && brew install crowdstrike/foundry-cli/foundry` (macOS/Linux) or [download for Windows](https://assets.foundry.crowdstrike.com/cli/latest/foundry_Windows_x86_64.zip)
- **CrowdStrike Account**: With Falcon Foundry access
- **Authentication**: Run `foundry login` to authenticate
- **AI Coding Assistant**: Claude Code, Codex, Copilot CLI, Cursor, Antigravity CLI, or any tool that supports loading reference documentation
### Install
| Assistant | Command | Marketplace |
|-----------|---------|-------------|
| Claude Code | `/plugin install crowdstrike-falcon-foundry` | [Anthropic](https://claude.com/plugins/crowdstrike-falcon-foundry) |
| Codex | `codex plugin add crowdstrike-falcon-foundry@openai-api-curated` | [OpenAI](https://chatgpt.com/plugins/plugins_6a8f6d7f7fac819191e3eba5a7a2e0df) |
| Copilot CLI | `copilot plugin install CrowdStrike/foundry-skills` | [GitHub](https://awesome-copilot.github.com/plugin/crowdstrike-falcon-foundry/) |
| Cursor | `/plugins` (CLI) or `/add-plugin crowdstrike-falcon-foundry` (IDE) | [Cursor](https://cursor.com/marketplace/crowdstrike/crowdstrike-falcon-foundry) |
| Antigravity CLI | `agy plugin install https://github.com/CrowdStrike/foundry-skills` | [Google](https://antigravity.google/docs/plugins) |
> [!NOTE]
> **Codex** has two install paths depending on how you signed in. The command above installs from the curated CLI marketplace, which **API-key and Amazon Bedrock** sessions load. If you authenticated Codex with a **ChatGPT** account, that marketplace isn't loaded — instead run `/plugins` inside Codex, search for `crowdstrike`, and install from the results.
All five assistants have been verified end to end: the skills were loaded from a local clone, then used to build and deploy an app to a live Falcon Foundry tenant from the example prompt below.
For local development with Claude Code, use `claude --plugin-dir /path/to/foundry-skills`. These skills follow the [Agent Plugins](https://agent-plugins.org) format and include a `.codex-plugin/plugin.json` manifest for native Codex discovery. See the [blog post](https://www.crowdstrike.com/tech-hub/ng-siem/build-falcon-foundry-apps-with-claude-code/) for a full walkthrough.
<details>
<summary><strong>Install from a local clone</strong> (for development or testing a branch)</summary>
```bash
git clone https://github.com/CrowdStrike/foundry-skills.git
```
| Assistant | Command |
|-----------|---------|
| Claude Code | `claude --plugin-dir /path/to/foundry-skills` |
| Copilot CLI | `copilot --plugin-dir /path/to/foundry-skills` |
| Cursor | `agent --plugin-dir /path/to/foundry-skills` |
| Antigravity CLI | `agy plugin install /path/to/foundry-skills` |
Codex has no `--plugin-dir`. It discovers skills from `~/.agents/skills/` instead, one symlink per skill:
```bash
mkdir -p ~/.agents/skills
for skill in /path/to/foundry-skills/skills/*/; do
ln -s "${skill%/}" ~/.agents/skills/
done
```
`~/.agents/skills/` is a flat, shared namespace: foundry-skills' skill names don't overlap with fusion-skills', so both can be symlinked in together. A marketplace or `--plugin-dir` install namespaces the skills as `crowdstrike-falcon-foundry:<skill>` and sidesteps the question entirely. Edits are live immediately. Restart Codex to re-index.
</details>
## Usage
### Example prompt
This prompt exercises the full skill set — API integration, workflow, and UI:
> Create a Falcon Foundry app for me that has an Okta API integration with openapi. Share its listusers endpoint with Falcon Fusion SOAR. Then, create a workflow that can be run on-demand to email or print the list of users. Finally, create a UI extension that calls the listusers endpoint and displays the results.
### How Claude Code skill routing works
The Claude Code plugin includes hooks that ensure the right skills get used:
1. **`UserPromptSubmit` hook** — Matches an action verb paired with a Foundry noun — e.g., "create a foundry app". Explicit CLI commands and skill requests also trigger it.
2. **`PreToolUse` hook** — When Foundry intent is detected, injects a non-blocking advisory reminder to use the Foundry workflow skill. Claude can still use all tools normally. If [superpowers](https://github.com/obra/superpowers) is installed, also intercepts `superpowers:brainstorming` and redirects to the Foundry workflow skill.
3. **`PreToolUse` hook (CLI guard)** — Validates all Bash commands to ensure Foundry CLI commands include `--no-prompt` flag (prevents `Error: EOF` failures) and blocks manual directory creation for app structure (prevents invalid `manifest.yml`). This enforcement is automatic and transparent — you'll only see it when it catches an error.
Hooks observe prompts and tool I/O to keyword-match Foundry-specific actions; no data leaves the session.
Other assistants discover and follow the skills but do not run these Claude Code hooks. They must apply the documented `--no-prompt` guardrails and run the OpenAPI adaptation helper explicitly. Skill-specific helpers live beside their `SKILL.md` files so Agent Skills and plugin installations remain self-contained; this packaging is separate from Falcon Foundry CLI connectivity, which is covered by the sandbox diagnostics in the debugging skill.
## Skills
| Skill | Purpose |
|-------|---------|
| `development-workflow` | Primary orchestrator — coordinates the full app lifecycle |
| `api-integrations` | OpenAPI spec import, auth scheme configuration, SOAR sharing |
| `functions-falcon-api` | Calling Falcon APIs from within Functions (OAuth, SDKs) |
| `workflows-development` | YAML workflow creation, Falcon Fusion SOAR actions and triggers |
| `ui-development` | React/Vue UI pages with Shoelace components and Falcon theming |
| `functions-development` | Go/Python serverless functions with CrowdStrike SDK |
| `collections-development` | JSON Schema data modeling and CRUD operations |
| `security-patterns` | OAuth scoping, input validation, content security |
| `debugging-workflows` | Systematic troubleshooting for CLI, manifest, and deployment issues |
| `e2e-testing` | End-to-end testing with `@crowdstrike/foundry-playwright` |
| `fusion-redirect` | Declines standalone Falcon Fusion workflow requests and points to the `crowdstrike-falcon-fusion` plugin |
## Architecture
The skills follow a hub-and-spoke pattern. `development-workflow` is the orchestrator that parses your requirements, runs CLI commands for scaffolding, and delegates capability-specific implementation to sub-skills:
```mermaid
graph TD
O["development-workflow<br/>(Orchestrator)"]
O --> UI["UI Development"]
O --> FN["Functions Development"]
O --> CO["Collections Development"]
O --> WF["Workflows Development"]
O --> AI["API Integrations"]
O --> FA["Functions — Falcon API"]
UI -.-> SP["Security Patterns"]
FN -.-> SP
CO -.-> SP
WF -.-> SP
AI -.-> SP
UI -.-> DB["Debugging Workflows"]
FN -.-> DB
CO -.-> DB
WF -.-> DB
AI -.-> DB
style O fill:#6366f1,stroke:#4f46e5,color:#fff
style SP fill:#f59e0b,stroke:#d97706,color:#fff
style DB fill:#f59e0b,stroke:#d97706,color:#fff
```
## Use Cases
The `use-cases/` directory contains real-world implementation patterns extracted from [CrowdStrike Tech Hub](https://www.crowdstrike.com/tech-hub/ng-siem/) blog posts:
- API pagination strategies
- Detection enrichment with UI extensions
- LogScale data ingestion from functions
- Lookup table enrichment with 3rd-party data
- Custom SOAR actions
- NGSIEM query export to CSV/JSON
- Publishing certified apps
- And more (see [use-cases/README.md](use-cases/README.md))
## Recommended Companion: Superpowers
These skills pair well with [obra/superpowers](https://github.com/obra/superpowers), which adds structured planning, TDD discipline, and code review workflows. Foundry skills handle the Foundry-specific CLI and platform knowledge while superpowers provides general software engineering best practices.
See [skills/development-workflow/references/superpowers-integration.md](skills/development-workflow/references/superpowers-integration.md) for details on how they work together.
**Note:** The without-superpowers path produces more reliable results because the Foundry skill has full control from the start. Superpowers brainstorming loads first and creates a plan before the Foundry skills are read, which may not follow Foundry-specific patterns.
## Foundry CLI Quick Reference
```bash
foundry login # Authenticate
foundry apps create --name "My App" --no-prompt --no-git # Create app
foundry api-integrations create --name "X" --spec /tmp/spec.json --no-prompt # Add API integration
foundry ui pages create --name "X" --from-template React --no-prompt # Add UI page
foundry ui extensions create --name "X" --from-template React --sockets "activity.detections.details" --no-prompt # Add UI extension
foundry functions create --name "X" --language python --no-prompt # Add function
foundry collections create --name "X" --schema /tmp/schema.json --no-prompt # Add collection
foundry workflows create --name "X" --spec /tmp/workflow.yaml --no-prompt # Add workflow
foundry apps deploy --change-type Patch --change-log "msg" --no-prompt # Deploy to cloud
foundry apps release # Release to catalog
```
## Troubleshooting
### Skills not invoked
If Claude doesn't use Foundry skills automatically, phrase your prompt with a clear action verb and Foundry noun (e.g., "create a foundry app", "fix the foundry function"). You can also say "Use Foundry skills" at any point to redirect.
### CLI authentication
```bash
foundry profile active # Check current profile
foundry login # Re-authenticate
foundry profile list # List all profiles
```
### Deployment failures
1. Validate immediately after `foundry api-integrations create` (`foundry apps validate --no-prompt`) — Foundry's server-side OpenAPI parser is stricter than `redocly lint` and may reject large vendor specs
2. Run `foundry apps deploy` from the project root directory
3. Check the `debugging-workflows` skill for systematic troubleshooting
## Testing
Three scripts validate skill changes at different levels. All require macOS or Linux (bash).
**Tip:** Wrap long-running tests with `caffeinate -i` to prevent macOS from sleeping mid-run:
```bash
caffeinate -i ./run-ab-test.sh --fresh 5
```
### Hook tests
```bash
./test-hooks.sh
```
Unit tests for the three hook scripts (skill router, superpowers bridge, CLI guard). Fast, no API calls, no Foundry CLI needed. Run after any hook change.
### Skill test (single run)
```bash
./test-skill.sh # 5 runs against local plugin
./test-skill.sh --runs 1 # Quick single run
./test-skill.sh --plugin-dir . # Explicit plugin path (default is ".")
```
Runs the example Okta prompt end-to-end: scaffolds an app, deploys it, and scores the result. Each run takes 5-10 minutes and costs ~5-10M tokens. Results go to `/tmp/foundry-skill-test/`.
### Verify apps (after test-skill)
```bash
SKIP_BROWSER=1 ./verify-apps.sh # Phase 1 only: spec analysis + release
OKTA_DOMAIN=... OKTA_API_KEY=... ./verify-apps.sh # Phase 1 + Phase 2: browser install/uninstall
```
Verifies apps created by `test-skill.sh` or A/B tests — analyzes OpenAPI specs, releases apps, and optionally installs them in the Falcon console via browser automation.
```bash
./verify-apps.sh # Verify test-skill.sh runs (default: /tmp/foundry-skill-test/)
./verify-apps.sh --green # Verify GREEN phase of A/B test
./verify-apps.sh --dir /path # Verify runs in a specific directory
```
### A/B test (main vs local branch)
```bash
./run-ab-test.sh # 5 runs per phase (baseline: main)
./run-ab-test.sh 1 # Quick single run per phase
./run-ab-test.sh 5 --ref v1.0.0 # Compare against a specific release tag
./run-ab-test.sh --no-skill # No plugin vs local plugin (1 run each)
```
Compares baseline ref skills (RED) against local branch skills (GREEN). The `--ref` flag accepts any git ref (tag, branch, commit SHA) and defaults to `main`. Results saved to `/tmp/foundry-skill-ab/baseline.json` and `/tmp/foundry-skill-ab/optimized.json`.
## Contributing
The skills improve every time someone uses them to build an app. If you hit a rough edge or find that Claude struggles with a particular pattern, you can teach the skills to handle it better.
### Use the skills, then improve them
1. Clone this repo and configure your AI coding assistant (see [Getting Started](#getting-started))
2. Try a multi-capability prompt (see [Example prompt](#example-prompt) above)
3. Watch for patterns where Claude struggles, retries, or produces incorrect output
4. At the end of the session, ask Claude to fix the skills directly:
```
What did you learn from this session that could improve the Foundry skills?
Clone https://github.com/CrowdStrike/foundry-skills.git,
create a branch, update the skills with this knowledge, and
create a PR on GitHub.
```
Claude handles the branch, skill edits, and PR creation. Even when Claude struggles to build an app, it usually figures it out eventually. This step captures that learning so the next session is faster and uses fewer tokens.
### Development workflow
1. Clone the repo (see [Getting Started](#getting-started))
2. Edit skill files in `skills/*/SKILL.md`
3. Run `./test-hooks.sh` to validate hooks
4. Test with `./test-skill.sh --runs 1` for a quick end-to-end check
5. Run `./run-ab-test.sh 1` to compare against main before opening a PR
### Release process
Releasing these skills is easy! Just run the following command:
```bash
./release.sh
```
This walks you through a semantic version bump (major/minor/patch), updates the version in `plugin.json`, `marketplace.json`, README badge, all `SKILL.md` files, and the CHANGELOG date, then creates a release branch and PR. After the PR is approved and merged, create a draft GitHub release to tag main:
```bash
gh release create v<version> --target main --title "v<version>" --generate-notes --draft
```
This generates release notes from merged PRs and saves them as a draft. Review and edit the notes at [github.com/CrowdStrike/foundry-skills/releases](https://github.com/CrowdStrike/foundry-skills/releases), then click **Publish** when ready.
After publishing the release, notify Anthropic of the new tag and SHA so they can update the marketplace pin. Do not open PRs to `anthropics/claude-plugins-official` or re-submit through the plugin submission form.
## Cross-Plugin: Fusion Workflows
`foundry-skills` builds **Falcon Foundry apps** with the full lifecycle: API integrations, UI pages, serverless functions, collections, and workflows wrapped in a `manifest.yml`. When a request is a standalone Fusion workflow (a trigger plus actions that already exist, with no app to build), use the sibling plugin ([fusion-skills](https://github.com/CrowdStrike/fusion-skills)):
```
/plugin install crowdstrike-falcon-fusion
```
The two plugins detect each other and advise the right path. Use `foundry-skills` for the full app lifecycle; use `fusion-skills` for standalone workflows with live action discovery. Neither requires the other to function.
## License
See [LICENSE](LICENSE) for details.