chore(main): release 0.13.0

[github-actions]

🚀 New Release Incoming! 🚀

0.13.0 (2026-06-23)

Features

• add Docker support (#19) (f60adc1)
• add E2E testing (#16) (c8a1d18)
• add filter guide for all tools which have filter param (#46) (61ffde9)
• add Flight Control (MSSP) support with member_cid parameter (#317) (d15b1c8), closes #283
• add hosts module (#42) (9375f4b)
• add intel module (#22) (6da3359)
• add origins to intel fql guide (#89) (c9a147e)
• add resources infrastructure (#39) (2629eae)
• add spotlight module (#58) (713b551)
• add streamable-http transport with Docker support and testing (#24) (5e44e97)
• add user agent (#68) (824a69f)
• add version reporting via startup log, CLI flag, and MCP metadata (#334) (27acc45)
• add x-api-key authentication for HTTP transports (#269) (82a594f)
• average CrowdScore (#20) (6580663)
• client: add proxy configuration for outbound Falcon API connections (#408) (5ebafe1), closes #405
• client: allow credential setting through init parameters (#245) (120e56f)
• cloud module (#56) (7f563c2)
• convert fql guides to resources (#62) (63bff7d)
• disable telemetry (#102) (feb4507)
• dynamic: add dynamic mode to reduce context window usage (#441) (807d3db)
• flexible tool input parsing (#41) (06287fe)
• idp support domain lookup and input sanitization (#73) (9d6858c)
• implement lazy module discovery (#37) (a38c949)
• initial implementation for the falcon-mcp server (#4) (773ecb5)
• ioc: add IOC Service Collection search/create/delete module (#292) (ef1b502)
• module/discover: Add unmanaged assets search tool to Discover module (#132) (1c7a798)
• modules/cases: add Case Management module (#388) (58d8460)
• modules/cloud: add CSPM asset inventory search (#319) (cbf2614)
• modules/cloud: add CSPM findings query and suppression tools (#378) (c76dce5)
• modules/correlation-rules: add NG-SIEM Correlation Rules module (#391) (afd0a88)
• modules/data-protection: add Data Protection module (#428) (fff356c)
• modules/detections: add update_detections tool (#439) (477c47e)
• modules/detections: improve FQL filter UX and tool descriptions (#259) (80f0639)
• modules/discover: add new discover module (#131) (2862361)
• modules/exclusions: add unified Exclusions module (#437) (b9b7ea6)
• modules/host-groups: add Host Groups module (#431) (5b6e2af)
• modules/idp: Add geolocation info to entities and timeline in i… (#124) (31bb268)
• modules/idp: Add geolocation info to entities and timeline in idp module (#121) (31bb268)
• modules/intel: provide the ability to get the mitre report in json or csv format (#227) (04e4411)
• modules/ngsiem: add NGSIEM module for Next-Gen SIEM search (#281) (00b8385)
• modules/policies: add unified Policies module (#438) (7975fa3)
• modules/quarantine: add quarantine workflows (#352) (0e66344)
• modules/rtr-admin: add RTR admin module (43aa774)
• modules/rtr: add audit and command wait workflows (#356) (14b1007)
• modules/rtr: add real time response support (#327) (d975534)
• modules/scheduled-reports: add scheduled reports and executions module (#252) (8b54b7f)
• modules/sensorusage: add new sensor usage module (#101) (ad97eb8)
• modules/serverless: add serverless module (#127) (0d7b7b3)
• modules/shield: add Falcon Shield (SaaS Security) module (#355) (3218176)
• modules: add Custom IOA behavioral rules module (#307) (1c10c1d)
• modules: add firewall management module and tests (#306) (eedd89c)
• modules: add MCP tool annotations for all tools (#303) (339e7c4), closes #229
• modules: remove deprecated incidents module (#368) (54c4948), closes #330
• publish falcon mcp to the mcp registry (#357) (47acb05)
• refactor to use falcon_mcp name and absolute imports (#52) (8fe3f2d)
• resources/spotlight: FQL filter as tuples (#91) (d9664a6)
• server: add distinct tools for active vs available modules (#103) (f5f941a)
• server: add stateless HTTP mode for scalable deployments (#242) (8c39de1)
• server: pass host/port to FastMCP to prevent HTTP 421 in proxied deployments (#293) (7aff692), closes #291
• tests: add integration tests with real API calls (#263) (01b8c97)

Bug Fixes

• conversational incidents (#21) (ee7bd01)
• count number of tools correctly (#72) (6c2284e)
• discover modules in examples (#31) (e443fc8)
• docker: use multi-stage COPY pattern for uv binary (#411) (a1f0628)
• docs: updated docs but more for testing release pipeline (c7106f9)
• ensures proper lists are passed to module arg + ENV VAR support for args (#54) (9820310)
• fix incorrect module registration assumptions (#153) (bd3aa95)
• freshen up e2e tests (#40) (7ba3d86)
• handle trailing-slash redirects and json-rpc content-type in HTTP transports (#308) (b4260b7)
• improve error handling and fix lint issue (#69) (31672ad)
• lock version for mcp-use to 1.3.1 (#47) (475fe0a)
• make api scope names the UI name to prevent confusion (#67) (0089fec)
• modules/cloud: correct CSPM asset FQL tag filter syntax (#320) (95fd9bd)
• modules/cloud: return int count from count_kubernetes_containers (#397) (42d1172)
• modules/correlation-rules: align API fields with live behavior (#407) (0199222)
• modules/identity: add missing scope for Identity Protection module (#148) (791a262)
• modules/idp: resolve FieldInfo defaults before building search_criteria (#396) (47205d1)
• modules/intel: parse JSON format in get_mitre_report (#429) (62e698c), closes #383
• modules/ioc: return delete summary (#444) (df2995a)
• modules/scheduled-reports: return full details from search tools (#254) (c6c39ba)
• resources/detections: added severity_name over severity level and cleaned up example filters (#93) (5f4b775)
• server: falcon_check_connectivity will try auth once before reporting no connectivity to Falcon API (#363) (cea77ef)
• server: surface diagnostic details on auth failure at startup (#379) (50a8c95), closes #351
• sync gemini-extension.json version and remove harden-runner (#274) (e152edb)
• tests/intel: correct test expectations for get_mitre_report (#241) (c1e8b6b)
• tests: make NGSIEM async tests actually execute (#381) (64ecd27), closes #375
• tools: omit outputSchema from tools/list to fit client context budgets (#376) (943fe55)

Refactoring

• examples/adk: simplify agent.py and clean up documentation (#304) (4baef37)
• modules/rtr-admin: consolidate get tools into search and align names (ca4190b)
• modules: standardize tool descriptions across all modules (#385) (939d62e), closes #380
• reduce repeated API code patterns in modules (2d5debd)
• remove all return statements from tool docstrings (#117) (80250bb)
• remove mention to Host from FQL guide (cf82392)
• resources/cloud: remove mention to Host from FQL guide (#76) (81ec4de)
• resources/cloud: use new tuple methodology to create filters (#95) (fd5cce7)
• resources/detections: update guide to be more accurate (#83) (4ff2144)
• resources/detections: use new tuple method for fql detections table (#97) (f328b79)
• resources/hosts: tested and updated fql filters and operator support for hosts module (#63) (e0b971c)
• resources/hosts: use new tuple methodology to create filters (#96) (da38d69)
• resources/incidents: use new tuple methodology to create filters (#98) (a9ba2f7)
• resources/intel: use new tuple methodology to create filters (#99) (cf0c19e)
• standardize parameter consistency across all modules (#106) (3c9c299)
• utils: simplify generate_md_table function (#214) (792e128)

---

This PR was generated with Release Please. See documentation.