Configuration

Configure your MCP client to connect to Prowler MCP Server.

Step 1: Get Your API Key

Authentication is optional: Prowler Hub and Prowler Documentation features work without authentication. An API key is only required for Prowler tools (Prowler Cloud, Prowler Private Cloud, or Prowler Local Server).

An API key authenticates the Prowler tools (Prowler Cloud, Prowler Private Cloud, or Prowler Local Server). To get the API key, please refer to the API Keys guide.

Keep the API key secure. Never share it publicly or commit it to version control.

Step 2: Configure Your MCP Host/Client

Most users should use the Cloud MCP Server — it needs no installation and is maintained by Prowler. The Local MCP Server configuration is provided afterwards for users who run the server themselves.

Cloud MCP Server (HTTP): the managed server at https://mcp.prowler.com/mcp (or your own self-hosted HTTP server).
Local MCP Server (STDIO): local installation only (runs as a subprocess of your MCP client).

Step-by-Step Guides Per Agent

The tabs below are a quick configuration reference. For a walkthrough with screenshots, troubleshooting, and client-specific caveats, follow the dedicated guide for your agent:

Claude Code

Plugin vs. MCP-only, and which Claude surfaces work

Claude Desktop App (Chat)

The Chat tab, via a local bridge

Codex

CLI and the VS Code extension

Cursor

Global and project scopes

VS Code / Copilot

Agent mode with secure key prompts

Cloud MCP Server Configuration (Recommended)

Connect to the Cloud MCP Server at https://mcp.prowler.com/mcp over HTTP. This is the recommended path — no installation, always up to date. The same configuration works for a self-hosted HTTP server: just swap the URL.

Generic Native HTTP Support
Generic without Native HTTP Support

Configuration:

{
  "mcpServers": {
    "prowler": {
      "url": "https://mcp.prowler.com/mcp", // or your self-hosted Prowler MCP Server URL
      "headers": {
        "Authorization": "Bearer <your-api-key-here>"
      }
    }
  }
}

Configuration:

Avoid configuring MCP clients to run npx mcp-remote directly. npx can download and execute a new package version on each run. Install a reviewed version of mcp-remote in a dedicated local workspace, then point the MCP client to the installed binary.

mkdir -p ~/.local/share/prowler-mcp-bridge
cd ~/.local/share/prowler-mcp-bridge
npm init -y
npm install --save-exact mcp-remote@0.1.38

{
  "mcpServers": {
    "prowler": {
      "command": "/absolute/path/to/.local/share/prowler-mcp-bridge/node_modules/.bin/mcp-remote",
      "args": [
        "https://mcp.prowler.com/mcp", // or your self-hosted Prowler MCP Server URL
        "--header",
        "Authorization: Bearer ${PROWLER_API_KEY}"
      ],
      "env": {
        "PROWLER_API_KEY": "<your-api-key-here>"
      }
    }
  }
}

The mcp-remote tool acts as a bridge for clients that don’t support HTTP natively. Learn more at mcp-remote on npm.

Local MCP Server Configuration

STDIO mode is only available when running the Local MCP Server on your own machine. See the Installation guide to set it up first.

Generic uvx installation
Generic Docker installation

Run from source or local installation

{
  "mcpServers": {
    "prowler": {
      "command": "uvx",
      "args": ["/absolute/path/to/prowler/mcp_server/"],
      "env": {
        "PROWLER_API_KEY": "<your-api-key-here>",
        "API_BASE_URL": "https://api.prowler.com/api/v1"
      }
    }
  }
}

Replace /absolute/path/to/prowler/mcp_server/ with the actual path. The API_BASE_URL is optional and defaults to Prowler Cloud API.

Run with Docker image

{
  "mcpServers": {
    "prowler": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "--env",
        "PROWLER_API_KEY=<your-api-key-here>",
        "--env",
        "API_BASE_URL=https://api.prowler.com/api/v1",
        "prowlercloud/prowler-mcp"
      ]
    }
  }
}

The API_BASE_URL is optional and defaults to Prowler Cloud API.

Step 3: Start Using Prowler MCP

Restart your MCP client and start asking questions:

“Show me all critical findings from my AWS accounts”
“What does the S3 bucket public access check do?”
“Onboard this new AWS account in my Prowler Organization”

Authentication Methods

Prowler MCP Server supports two authentication methods to connect to Prowler (Prowler Cloud, Prowler Private Cloud, or Prowler Local Server):

API Key (Recommended)

Use your Prowler API key directly in the Bearer token:

Authorization: Bearer <your-api-key-here>

This is the recommended method for most users.

JWT Token

Alternatively, obtain a JWT token from Prowler:

curl -X POST https://api.prowler.com/api/v1/tokens \
  -H "Content-Type: application/vnd.api+json" \
  -H "Accept: application/vnd.api+json" \
  -d '{
    "data": {
      "type": "tokens",
      "attributes": {
        "email": "your-email@example.com",
        "password": "your-password"
      }
    }
  }'

Use the returned JWT token in place of the API key:

Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

JWT tokens are only valid for 30 minutes. You need to generate a new token if you want to continue using the MCP server.

Troubleshooting

Server Not Detected

Restart your MCP client after configuration changes
Check the configuration file syntax (valid JSON)
Review client logs for specific error messages
Verify the server URL is correct

Authentication Failures

Error: Unauthorized (401)

Verify your API key is correct
Ensure the key hasn’t expired
Check you’re using the right API endpoint

Connection Issues

Cannot Reach Server:

Verify the server URL is correct
Check network connectivity
For local servers, ensure the server is running
Check firewall settings

Security Best Practices

Protect Your API Key
- Never commit API keys to version control.
- Use environment variables or secure vaults.
- Rotate keys regularly.
Network Security
- Use HTTPS for production deployments.
- Restrict network access to the MCP server.
- Consider VPN for remote access.
Least Privilege
- API key gives the permission of the user who created the key, make sure to use the key with the minimal required permissions.
- Review the tools that are gonna be used and how they are gonna be used to avoid prompt injections or unintended behavior.

Next Steps

Now that your MCP server is configured:

Tools Reference

Explore all available tools

Getting Help

Need assistance with configuration?

Search for existing GitHub issues
Ask for help in our Slack community
Report a new issue on GitHub

Welcome

Prowler Products

Open Source

Prowler vs. Others

Step 1: Get Your API Key

Step 2: Configure Your MCP Host/Client

Step-by-Step Guides Per Agent

Claude Code

Claude Desktop App (Chat)

Codex

Cursor

VS Code / Copilot

Cloud MCP Server Configuration (Recommended)

Local MCP Server Configuration

Step 3: Start Using Prowler MCP

Authentication Methods

API Key (Recommended)

JWT Token

Troubleshooting

Server Not Detected

Authentication Failures

Connection Issues

Security Best Practices

Next Steps

Tools Reference

Getting Help

​Step 1: Get Your API Key

​Step 2: Configure Your MCP Host/Client

​Step-by-Step Guides Per Agent

Claude Code

Claude Desktop App (Chat)

Codex

Cursor

VS Code / Copilot

​Cloud MCP Server Configuration (Recommended)

​Local MCP Server Configuration

​Step 3: Start Using Prowler MCP

​Authentication Methods

​API Key (Recommended)

​JWT Token

​Troubleshooting

​Server Not Detected

​Authentication Failures

​Connection Issues

​Security Best Practices

​Next Steps

Tools Reference

​Getting Help

Step 1: Get Your API Key

Step 2: Configure Your MCP Host/Client

Step-by-Step Guides Per Agent

Cloud MCP Server Configuration (Recommended)

Local MCP Server Configuration

Step 3: Start Using Prowler MCP

Authentication Methods

API Key (Recommended)

JWT Token

Troubleshooting

Server Not Detected

Authentication Failures

Connection Issues

Security Best Practices

Next Steps

Getting Help