Prowler MCP Server – Cloud Security Findings
Prowler MCP Server exposes Prowler's cloud security, compliance, knowledge-base, and documentation capabilities to MCP-compatible AI clients. It can be used with Prowler's managed MCP endpoint, as a local stdio server, or as a self-hosted HTTP server for natural-language security operations and research workflows.
Overview
Prowler MCP Server brings the Prowler ecosystem to AI assistants through the Model Context Protocol. It connects MCP clients such as Claude Desktop, Cursor, and other compatible tools to Prowler Cloud, self-managed Prowler App deployments, Prowler Hub, and official Prowler documentation. The server is documented by Prowler as a preview feature, so teams should treat behavior and tool coverage as subject to change while it remains under active development.
What the MCP server enables
The server provides three main integration areas. For Prowler Cloud and Prowler App, an AI agent can query and filter security findings, manage configured cloud providers, trigger on-demand scans or scheduled assessments, inspect audited resources, manage muting rules, and analyze attack paths. For Prowler Hub, the agent can browse the security checks catalog, inspect check implementation details, access remediation scripts, explore compliance mappings, and review supported providers and services. For Prowler Documentation, the agent can search official documentation and retrieve pages for setup, configuration, and usage guidance.
When to use it
Use Prowler MCP when an AI assistant needs live cloud security and compliance context from Prowler. Practical workflows include asking for critical findings across AWS production accounts, registering a new cloud account and scheduling scans, reviewing muted findings, investigating attack paths involving exposed cloud resources, or finding Prowler checks related to encryption, identity, networking, or compliance frameworks. It is also useful for research and enablement workflows where the assistant needs to explain Prowler checks, remediation guidance, or provider authentication requirements.
Connection and authentication
Prowler supports three deployment options. The managed Prowler Cloud MCP Server is available at https://mcp.prowler.com/mcp and requires no local installation. Local stdio mode runs as a subprocess of an MCP client and can connect to Prowler Cloud or a self-managed Prowler App using environment variables. Self-hosted HTTP mode lets teams deploy their own remote server with Python 3.12+ or Docker. Prowler App and Prowler Cloud features require a Prowler API key or JWT token; Prowler Hub and Prowler Documentation features do not require authentication.
Key considerations
Prowler documents the MCP server as a preview feature, so validate behavior before using it in production automation. Cloud/App capabilities depend on a valid Prowler API key and the permissions of the connected account. Store PROWLER_APP_API_KEY securely, do not commit it to version control, and use environment variables or a secret manager. For self-hosted HTTP deployments, restrict network exposure, use TLS termination where appropriate, and confirm the server can reach Prowler Cloud, a self-managed Prowler App API, Prowler Hub, and Prowler Documentation as required.
Supported Transports
streamable_http
URL: https://mcp.prowler.com/mcp
stdio
Command: docker
Args:
run--rm-i-ePROWLER_APP_API_KEY=${PROWLER_APP_API_KEY}-eAPI_BASE_URL=${PROWLER_API_BASE_URL}prowlercloud/prowler-mcp
streamable_http
URL: http://127.0.0.1:8000/mcp
Frequently Asked Questions
- When should an AI agent use Prowler MCP Server?
- Use it when an AI assistant needs to work with Prowler security findings, configured cloud providers, scans, resource inventory, muting rules, attack paths, Prowler Hub checks, or official Prowler documentation through natural language.
- What does Prowler MCP Server add to an AI agent's capabilities?
- It adds live access to the Prowler ecosystem instead of relying on static model knowledge, including Cloud/App security operations, Prowler Hub's security checks and remediations, and searchable official documentation.
- What can the AI agent access or manage through this server?
- With Prowler Cloud or self-managed Prowler App access, the agent can query findings, manage providers, orchestrate scans, inspect audited resources, manage muting rules, and analyze attack paths. Without authentication, Hub and documentation features can still provide checks, compliance mappings, remediations, and documentation context.
- How is authentication configured for Prowler MCP Server?
- Prowler Cloud and Prowler App features use a Prowler API key or JWT token. For local stdio usage, Prowler documents `PROWLER_APP_API_KEY`, `API_BASE_URL`, and `PROWLER_MCP_TRANSPORT_MODE` environment variables. Prowler advises using environment variables or secure secret management and never committing API keys to version control.
- Which transport should be used for Prowler MCP Server?
- Use Prowler's managed Streamable HTTP endpoint at `https://mcp.prowler.com/mcp` when you want the hosted service. Use stdio for local MCP clients running the Docker image or source checkout. Use self-hosted HTTP when you need a remote server under your own operational control.