v1.6.0

The skills can now build Falcon Foundry's new AI capabilities! 🤖 The new ai-agents-development skill covers agents and knowledge bases, starting with foundry agents create and going all the way to calling an agent from your app's own workflows. Huge thanks to @prvn, who wrote it. He's been reviewing PRs since this project started, and the skills are much better for it. 🙌

You can also install the plugin from the OpenAI/Codex, Cursor, and GitHub Copilot marketplaces now. The hooks were tuned as well, so they stay quiet unless you're working on a Falcon Foundry app.

Added

AI agents and knowledge bases 🎉

• ai-agents-development skill — covers foundry agents and foundry knowledge-bases (alias kb), the ai.agents / ai.knowledge_bases manifest schema, every validation error string, input/output formats, and agent tool references. Agents and knowledge bases have no temperature, token, chunk size, embedding, or top_k settings, and the skill says so, so those keys never end up in the manifest
• Agent exposure — an agent created without an --expose-* flag can't be called by anything, including its own app's workflows. --expose-agent-as-tool requires --input-schema, and the CLI enforces that on every manifest load
• Calling an app's agent from its workflows as ai_agents.<agent name> — the action needs version_constraint: ~1 (~0 fails deploy with Action was not found), and a later step reads the reply as ${data['<action key>.response']}. A FalconPy AgentInvocation function is documented as the fallback for clouds without alias support
• Structured output — json_with_schema agents need their schema file named output_schema.json (input_schema.json for input), and models without structured output support should use plain json
• Agent tools from collections and API integrations — exposing an operation is only half the wiring, because the agent must also list it in its own tools. Skipping either half doesn't raise an error. The agent just can't reach the data
• Silent pitfalls — a mistyped --system-prompt path becomes the agent's entire prompt with no error, .svg files in a knowledge base pass validation and then get dropped from the deploy, and a large PDF corpus can eat the shared 25 MB package cap
• CLI guard checks for agents and knowledge bases — it warns on a missing --files or --input-schema, a knowledge base the manifest doesn't define yet, and misnamed schema files. It also blocks hand-made agents/ directories and asks for confirmation before an irreversible delete
• Charlotte AI AgentWorks APIs from functions — FalconPy's Agents, Spans, AgentInvocation, AgentVersions, and Models classes, with the charlotte-ai-agent-definition scopes

Marketplaces:

• Installable from the OpenAI/Codex curated marketplace (codex plugin add crowdstrike-falcon-foundry@openai-api-curated, or /plugins for ChatGPT-authenticated Codex), the Cursor marketplace, and the awesome-copilot directory

Functions, UI, and deploys:

• FDK Request field reference — query parameters live at request.params.query, not request.query
• Adding a handler to an existing function, and execution limits (--max-exec-duration-seconds, --max-exec-memory-mb) at create time
• UI sandbox restrictions — localStorage and sessionStorage throw, and alert() and confirm() are silently ignored. There's also a pattern for bulk work from a UI page that saves progress and resumes on re-run
• Paging through collection keys with ListObjects
• foundry apps sync in non-interactive mode, converting an existing repo into an app, and app logos (the App Catalog icon is only set on first deploy)
• Deploy troubleshooting — App manager's "Show errors", what foundry apps deploy leaves out of the package, and what deployment is currently in progress, no deployable artifacts found, and 403 app is not installed mean

Changed

• Minimum Foundry CLI version is now 2.1.0 — the session-start hook warns on 2.0.x and offers to upgrade. With CLI 2.1.1, workflows actions view --no-prompt lists multiple matches non-interactively, so action_search.py is now a convenience rather than a required workaround
• FalconPy clients are created inside the handler — a client created at module scope gets a 401 on every call
• Incremental updates for large lookup files — merge changed rows with NGSIEM.update_lookup_file_entries() instead of re-uploading the whole file
• Dependency order is now Collections → Functions → Knowledge bases → Agents → Workflows → UI
• Narrow manifest carve-out — ai.agents[].model and .tools have no CLI flags, so they're the only manifest keys the skills allow editing by hand

Fixed

• Quieter hooks — the skill-router reminder no longer leaks into unrelated prompts and sessions, the router no longer fires on a passing mention of Falcon Foundry, and the CLI guard ignores foundry commands that only appear inside quoted strings like commit messages. The router also picks up requests like "I need a Foundry app" and "set up a Foundry app" now
• Hooks work across Claude Code, Codex, and Cursor — the guidance no longer names Claude-only tools, and an enabled sibling plugin is recognized in Codex, Cursor, and Antigravity instead of being offered as a fresh install
• Each skill is self-contained — assistants other than Claude Code get each skill as its own package, so links to sibling skills and use-cases/ pointed at files that weren't there. The skills now name those targets in prose
• Un-adaptable OpenAPI specs are actually blocked — the router's block decision was in a field Claude Code doesn't read
• Brainstorming is only redirected for Foundry work, not in every project with the plugin installed
• Real scope names and manifest key — devices:read and detects:read under auth.scopes, not hosts:read, detections:read, or oauth_scopes:
• Alerts.get_alerts_v2 examples passed ids= instead of composite_ids=, so they always failed with a 400
• Smaller corrections — ignored: entries are regexes, not globs; falcon.theme() doesn't exist; function handlers use api_path; the asset CDN only serves foundry-js 0.20.0; and workflows-development no longer asks for onError blocks Fusion doesn't have

Getting started

Refresh the marketplace first so Claude Code sees 1.6.0, then install:

claude plugin marketplace update claude-plugins-official
claude plugin install crowdstrike-falcon-foundry

Already installed? Refresh the marketplace and update:

claude plugin marketplace update claude-plugins-official
claude plugin update crowdstrike-falcon-foundry

See the README for Codex, Copilot CLI, Cursor, and Antigravity CLI.

Full Changelog

v1.5.0...v1.6.0