v1.5.0

These skills now run in all the popular AI coding assistants! 🚀 Claude Code, Codex, Copilot CLI, Cursor, and Antigravity CLI are all supported, and this release also adds the function execution and debugging commands shipping in Foundry CLI 2.1.0.

Four of the five are verified end to end: the skills were loaded from a local clone, then used to build and deploy an app to a live Falcon Foundry tenant from the example prompt.

Added

Multi-assistant support 🎉

• Install instructions for Claude Code, Codex, Copilot CLI, Cursor, and Antigravity CLI, plus a collapsible table of local-clone commands
• Root plugin.json following the Agent Plugins 1.0.0 spec, so any conforming client recognizes the repo as a plugin
• Sub-skill routing for single-entry-point installs — development-workflow now says where sub-skills live on disk and what to do when a capability request lands on the orchestrator
• Every capability sub-skill links back to development-workflow, so an assistant that picks a sub-skill directly still finds the CLI prerequisite check

Functions (Foundry CLI 2.1.0+):

• Function execution, testing, and debugging via foundry functions exec, test, and logs. Covers the deploy-first rule (exec and test run the deployed artifact, not local code), request-data confirmation before exec, handler disambiguation from the manifest, and the tests.yml schema
• Code-review checklist for handlers: logging on error paths, hardcoded secrets and PII, request/response schema coverage
• CLI guard enforces --no-prompt on the new commands

Routing:

• fusion-redirect skill — declines a standalone Falcon Fusion workflow request (a trigger plus actions that already exist) and points to the sibling Falcon Fusion plugin. Previously this advice was only reachable through a hook, so it never fired on assistants that don't run hooks

Platform:

• US-3 cloud region added to the FOUNDRY_CLOUD_REGION value lists and the multi-cloud deployment section

Fixed

• connection issue on tenant commands — in a workspace-scoped sandbox the CLI cannot write ~/.config/foundry/token.json, where it keeps its short-lived access token. It reports only the symptom, which sent agents investigating networks and credentials. The debugging skill now explains that the refresh is expected and that the fix is granting write access to that directory. Observed on Codex
• Three commands that reject --no-prompt — foundry version, apps list, and apps list-deployments fail with unknown flag. Two are in the prerequisite check, so "always add --no-prompt" broke the first thing an agent runs
• OpenAPI adapter dependencies without hooks — Claude Code's skill router runs adapt_spec_for_foundry.py automatically; Copilot CLI, Cursor, and Antigravity CLI don't. It needs pyyaml, which a bare pip install can't supply on Homebrew or system Pythons (PEP 668), so the API integrations skill now documents a virtualenv setup
• NGSIEM start_search keyword guidance — search= remains the recommendation because it works on every FalconPy version. The explanation now notes that body= is fixed in FalconPy 1.6.5 (#1497)
• Go alerts example used a nonexistent SDK method — replaced client.Alerts.QueryAlerts with PostCombinedAlertsV1, swapped interface{} for the concrete gofalcon response types, and added the Payload.Errors check the official SDK examples use

Known limitations

Antigravity CLI is documented but not verified end to end. Its account quota was exhausted during testing, so the install path and skill discovery are confirmed while the full build-and-deploy run is not.

Getting started

Install:

/plugin install crowdstrike-falcon-foundry

Already installed? Update to 1.5.0:

/plugin update crowdstrike-falcon-foundry

Full Changelog

v1.4.1...v1.5.0