ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-08-19 09:30:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(mcp): document the Cloud-only prowler_cloud_* tool namespace (#12266)

Browse Source
This commit is contained in:
Rubén De la Torre Vico
2026-07-31 12:16:04 +02:00
committed by GitHub
parent ea0c7eb271
commit 9adc248c05
5 changed files with 158 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/getting-started/basic-usage/prowler-mcp-tools.mdx
+94 -7
View File
@@ -6,11 +6,16 @@ Complete reference guide for all tools available in the Prowler MCP Server. Tool
## Tool Categories Summary ## Tool Categories Summary
| Category | Tool Count | Authentication Required | | Category | Tool Count | Authentication Required | Availability |
|----------|------------|------------------------| |----------|------------|------------------------|--------------|
| Prowler Hub | 10 tools | No | | Prowler Hub | 10 tools | No | Cloud and Local MCP Server |
| Prowler Documentation | 2 tools | No | | Prowler Documentation | 2 tools | No | Cloud and Local MCP Server |
| Prowler Cloud, Private Cloud & Local Server | 42 tools | Yes | | Prowler Cloud, Private Cloud & Local Server | 49 tools | Yes | Cloud and Local MCP Server |
| Prowler Cloud management | 32 tools | Yes | Cloud MCP Server only |
<Note>
48 of the 49 Prowler tools are available on both servers. `prowler_schedule_daily_scan` is the exception: it is Local-only, because the Cloud MCP Server supersedes it with the `prowler_cloud_*` [Scan Scheduling](#scan-scheduling) tools.
</Note>
## Tool Naming Convention ## Tool Naming Convention
@@ -19,6 +24,11 @@ All tools follow a consistent naming pattern with prefixes:
- `prowler_hub_*` - Prowler Hub catalog and compliance tools - `prowler_hub_*` - Prowler Hub catalog and compliance tools
- `prowler_docs_*` - Prowler documentation search and retrieval - `prowler_docs_*` - Prowler documentation search and retrieval
- `prowler_*` - Prowler Cloud, Prowler Private Cloud & Prowler Local Server management tools - `prowler_*` - Prowler Cloud, Prowler Private Cloud & Prowler Local Server management tools
- `prowler_cloud_*` - Prowler Cloud-only management tools
<Note>
`prowler_cloud_*` tools are exposed only by the [Cloud MCP Server](/getting-started/products/prowler-mcp#cloud-vs-local-mcp-server) at `https://mcp.prowler.com/mcp`, because they manage features that exist only in Prowler Cloud. Every other tool is available on both the Cloud and Local MCP Server.
</Note>
## Prowler Tools ## Prowler Tools
@@ -59,9 +69,13 @@ Tools for managing and monitoring security scans.
- **`prowler_list_scans`** - List and filter security scans across all providers - **`prowler_list_scans`** - List and filter security scans across all providers
- **`prowler_get_scan`** - Get comprehensive details about a specific scan (progress, duration, resource counts) - **`prowler_get_scan`** - Get comprehensive details about a specific scan (progress, duration, resource counts)
- **`prowler_trigger_scan`** - Trigger a manual security scan for a provider - **`prowler_trigger_scan`** - Trigger a manual security scan for a provider
- **`prowler_schedule_daily_scan`** - Schedule automated daily scans for continuous monitoring - **`prowler_schedule_daily_scan`** - Schedule automated daily scans for continuous monitoring (**Local MCP Server only**)
- **`prowler_update_scan`** - Update scan name for better organization - **`prowler_update_scan`** - Update scan name for better organization
<Note>
`prowler_schedule_daily_scan` is the scheduling tool for a self-hosted deployment, and it only does one thing: a daily scan. The Cloud MCP Server does not expose it — Prowler Cloud replaces it with the richer [Scan Scheduling](#scan-scheduling) tools, which add interval, weekly, and monthly frequencies, per-provider schedule retrieval, and bulk apply across providers.
</Note>
### Resources Management ### Resources Management
Tools for searching, viewing, and analyzing cloud resources discovered by Prowler. Tools for searching, viewing, and analyzing cloud resources discovered by Prowler.
@@ -145,6 +159,78 @@ Tools for browsing RBAC roles and managing the role assigned to a user. A user h
- **`prowler_get_user_roles`** - List the roles assigned to a specific user, with the capabilities each role grants - **`prowler_get_user_roles`** - List the roles assigned to a specific user, with the capabilities each role grants
- **`prowler_set_user_role`** - Set the role a user holds, replacing the role they had before (idempotent) - **`prowler_set_user_role`** - Set the role a user holds, replacing the role they had before (idempotent)
## Prowler Cloud Tools
Manage Prowler Cloud-only features and configuration. **Requires authentication.**
<Note>
These tools are available **only on the Cloud MCP Server** (`https://mcp.prowler.com/mcp`). A Local MCP Server does not expose them, because the features they manage exist only in Prowler Cloud.
</Note>
### Scan Configurations
Tools for managing reusable scan configurations — per-provider check and compliance selections — and attaching them to providers. Providers without a configuration attached use the default.
- **`prowler_cloud_list_scan_configurations`** - List and filter the scan configurations defined in the tenant
- **`prowler_cloud_get_scan_configuration`** - Retrieve a scan configuration including its full configuration body
- **`prowler_cloud_get_scan_configuration_schema`** - Fetch the JSON Schema describing the keys a valid configuration body may set, optionally filtered to a single provider type
- **`prowler_cloud_create_scan_configuration`** - Create a scan configuration and optionally attach it to providers
- **`prowler_cloud_update_scan_configuration`** - Update a configuration's name, body, and/or attached providers
- **`prowler_cloud_delete_scan_configuration`** - Delete a scan configuration; attached providers revert to the default
### Findings Triage
Tools for recording a review decision on a finding and documenting the reasoning. Triage is keyed on the stable finding UID returned by `prowler_search_security_findings` and `prowler_get_finding_details`.
<Note>
Triage is distinct from [muting](#muting-management). Use mute rules and the mutelist to **suppress** findings; use triage to **record a decision** and its rationale while the finding stays visible. See the [Findings Triage tutorial](/user-guide/tutorials/prowler-app-findings-triage).
</Note>
- **`prowler_cloud_list_finding_triages`** - List and filter persisted triage records by status, provider, check, and more
- **`prowler_cloud_get_finding_triage`** - Retrieve a single finding's triage state by finding UID
- **`prowler_cloud_set_finding_triage_status`** - Set a finding's triage status (`open`, `under_review`, `remediating`, `risk_accepted`, `false_positive`), optionally attaching a note. The `resolved` and `reopened` statuses are system-managed and cannot be set directly
- **`prowler_cloud_list_finding_triage_notes`** - List the notes attached to a finding's triage, newest first
- **`prowler_cloud_create_finding_triage_note`** - Add a new note to a finding's triage
- **`prowler_cloud_update_finding_triage_note`** - Update the body of an existing note
- **`prowler_cloud_delete_finding_triage_note`** - Delete a note from a finding's triage
### Scan Scheduling
Tools for configuring recurring scans. One schedule exists per provider, with daily, interval, weekly, or monthly frequency. These replace the Local-only `prowler_schedule_daily_scan`, which can only set up a daily scan. See the [Scan Scheduling tutorial](/user-guide/tutorials/prowler-scan-scheduling).
- **`prowler_cloud_list_scan_schedules`** - List scan schedules, one per visible provider
- **`prowler_cloud_get_scan_schedule`** - Retrieve a provider's schedule including all per-frequency fields
- **`prowler_cloud_set_scan_schedule`** - Configure or update a single provider's recurring scan schedule
- **`prowler_cloud_bulk_set_scan_schedules`** - Apply one schedule to many providers at once
- **`prowler_cloud_delete_scan_schedule`** - Delete a provider's scan schedule
### Alerts
Tools for notifying recipients when scan results match a rule condition. See the [Alerts tutorial](/user-guide/tutorials/prowler-alerts).
#### Alert Rules
- **`prowler_cloud_list_alert_rules`** - List and filter the custom alert rules defined in the tenant
- **`prowler_cloud_get_alert_rule`** - Retrieve an alert rule including its condition DSL and recipient emails
- **`prowler_cloud_create_alert_rule`** - Create a tenant-scoped alert rule
- **`prowler_cloud_update_alert_rule`** - Update an alert rule; only the fields provided change
- **`prowler_cloud_delete_alert_rule`** - Delete an alert rule
- **`prowler_cloud_list_alert_rule_events`** - List the fired-alert history for a single rule, newest first
- **`prowler_cloud_build_alert_rule_condition`** - Build a condition from a findings filter and dry-run it in one call to preview what would match. Nothing is persisted
#### Alert Recipients
- **`prowler_cloud_list_alert_recipients`** - List alert recipients with their confirmation status
- **`prowler_cloud_get_alert_recipient`** - Retrieve a single recipient with its confirmation status
- **`prowler_cloud_create_alert_recipient`** - Register a new recipient email
- **`prowler_cloud_resend_alert_recipient_confirmation`** - Re-send the confirmation email to a pending or unsubscribed recipient
- **`prowler_cloud_delete_alert_recipient`** - Delete an alert recipient
#### Alert Events
- **`prowler_cloud_list_alert_events`** - List the fired alert events for the tenant
- **`prowler_cloud_get_alert_event`** - Retrieve a single alert event including its matched rule and scan
## Prowler Hub Tools ## Prowler Hub Tools
Access Prowler's security check catalog and compliance frameworks. **No authentication required.** Access Prowler's security check catalog and compliance frameworks. **No authentication required.**
@@ -185,7 +271,8 @@ Search and access official Prowler documentation. **No authentication required.*
- Use natural language to interact with the tools through your AI assistant - Use natural language to interact with the tools through your AI assistant
- Tools can be combined for complex workflows - Tools can be combined for complex workflows
- Filter options are available on most list tools - Filter options are available on most list tools
- Authentication is only required for Prowler tools (Prowler Cloud, Prowler Private Cloud, or Prowler Local Server) - Authentication is only required for the `prowler_*` and `prowler_cloud_*` tools; Prowler Hub and Prowler Documentation tools work without a key
- If a `prowler_cloud_*` tool is missing from your client, you are connected to a Local MCP Server — point it at `https://mcp.prowler.com/mcp` instead
## Additional Resources ## Additional Resources
docs/getting-started/products/prowler-mcp.mdx
+34 -13
View File
@@ -30,7 +30,7 @@ The fastest way to get started is the **Cloud MCP Server** at `https://mcp.prowl
</Card> </Card>
<Note> <Note>
Prefer to run it yourself? The **Local MCP Server** runs on your own machine or infrastructure. The Cloud MCP Server additionally provides tools for Prowler Cloud-specific features such as [Alerts](/user-guide/tutorials/prowler-alerts), [Scan Scheduling](/user-guide/tutorials/prowler-scan-scheduling), and [Findings Triage](/user-guide/tutorials/prowler-app-findings-triage). See [Cloud vs Local MCP Server](#cloud-vs-local-mcp-server). Prefer to run it yourself? The **Local MCP Server** runs on your own machine or infrastructure. The Cloud MCP Server additionally provides the `prowler_cloud_*` tools for Prowler Cloud-specific features: [Alerts](/user-guide/tutorials/prowler-alerts), [Findings Triage](/user-guide/tutorials/prowler-app-findings-triage), [Scan Scheduling](/user-guide/tutorials/prowler-scan-scheduling), and Scan Configurations. See [Cloud vs Local MCP Server](#cloud-vs-local-mcp-server).
</Note> </Note>
## What is the Model Context Protocol? ## What is the Model Context Protocol?
@@ -39,20 +39,30 @@ The [Model Context Protocol (MCP)](https://modelcontextprotocol.io) is an open s
## Key Capabilities ## Key Capabilities
The Prowler MCP Server provides three main integration points: The Prowler MCP Server provides four integration points:
### 1. Prowler Cloud, Private Cloud & Local Server ### 1. Prowler Cloud, Private Cloud & Local Server
Full access to your Prowler deployment — Prowler Cloud, Prowler Private Cloud, or Prowler Local Server — for: Full access to your Prowler deployment — Prowler Cloud, Prowler Private Cloud, or Prowler Local Server — for:
- **Findings Analysis**: Query, filter, and analyze security findings across all your cloud environments - **Findings Analysis**: Query, filter, and analyze security findings across all your cloud environments
- **Provider Management**: Create, configure, and manage your configured Prowler providers (AWS, Azure, GCP, etc.) - **Provider Management**: Create, configure, and manage your configured Prowler providers (AWS, Azure, GCP, etc.)
- **Scan Orchestration**: Trigger on-demand scans and schedule recurring security assessments - **Scan Orchestration**: Trigger on-demand scans, track their progress, and schedule a daily scan
- **Resource Inventory**: Search and view detailed information about your audited resources - **Resource Inventory**: Search and view detailed information about your audited resources
- **Muting Management**: Create and manage muting lists/rules to suppress non-relevant findings - **Muting Management**: Create and manage muting lists/rules to suppress non-relevant findings
- **Attack Paths Analysis**: Analyze privilege escalation chains and security misconfigurations through graph-based analysis of cloud resource relationships - **Attack Paths Analysis**: Analyze privilege escalation chains and security misconfigurations through graph-based analysis of cloud resource relationships
- **Integrations Management**: Set up and troubleshoot where Prowler sends its results (Amazon S3, AWS Security Hub, Jira), and turn findings into Jira work items
- **User & Role Management**: List the users in your tenant, identify the authenticated user, browse RBAC roles, and set the role a user holds - **User & Role Management**: List the users in your tenant, identify the authenticated user, browse RBAC roles, and set the role a user holds
### 2. Prowler Hub ### 2. Prowler Cloud Management
Prowler Cloud-only tools for configuration and workflows that a Prowler Local Server does not provide. These are exposed only by the [Cloud MCP Server](#cloud-vs-local-mcp-server):
- **Scan Configurations**: Create reusable check and compliance selections and attach them to providers.
- **Findings Triage**: Record review statuses and notes for individual findings, without suppressing them.
- **Scan Scheduling**: Configure daily, interval, weekly, or monthly recurring scans, one provider at a time or in bulk.
- **Alerts**: Build and dry-run alert rule conditions, manage email recipients, and review fired alerts.
### 3. Prowler Hub
Access to Prowler's comprehensive security knowledge base: Access to Prowler's comprehensive security knowledge base:
- **Security Checks Catalog**: Browse and search **over 2,000 security checks** across multiple cloud providers. - **Security Checks Catalog**: Browse and search **over 2,000 security checks** across multiple cloud providers.
@@ -61,7 +71,7 @@ Access to Prowler's comprehensive security knowledge base:
- **Compliance Frameworks**: Explore mappings to **over 70 compliance standards and frameworks**. - **Compliance Frameworks**: Explore mappings to **over 70 compliance standards and frameworks**.
- **Provider Services**: View available services and checks for each cloud provider. - **Provider Services**: View available services and checks for each cloud provider.
### 3. Prowler Documentation ### 4. Prowler Documentation
Search and retrieve official Prowler documentation: Search and retrieve official Prowler documentation:
- **Intelligent Search**: Full-text search across all Prowler documentation. - **Intelligent Search**: Full-text search across all Prowler documentation.
@@ -70,7 +80,7 @@ Search and retrieve official Prowler documentation:
## MCP Server Architecture ## MCP Server Architecture
The following diagram illustrates the Prowler MCP Server architecture and its integration points. MCP clients connect to either the **Cloud MCP Server** (recommended) or a **Local MCP Server**; both expose the same tools and reach the same Prowler backends: The following diagram illustrates the Prowler MCP Server architecture and its integration points. MCP clients connect to either the **Cloud MCP Server** (recommended) or a **Local MCP Server**. Both reach the same Prowler backends and share the `prowler_*`, `prowler_hub_*`, and `prowler_docs_*` tools; the Cloud MCP Server additionally exposes the Cloud-only `prowler_cloud_*` tools:
```mermaid ```mermaid
flowchart LR flowchart LR
@@ -82,12 +92,13 @@ flowchart LR
subgraph SERVERS["Prowler MCP Server"] subgraph SERVERS["Prowler MCP Server"]
direction TB direction TB
cloud["☁️ Cloud MCP Server (Recommended)<br/>mcp.prowler.com/mcp · HTTP<br/>Managed by Prowler · always up to date<br/>Adds Cloud-only tools (Alerts,<br/>Scan Scheduling, Findings Triage)"] cloud["Cloud MCP Server (Recommended)<br/>mcp.prowler.com/mcp · HTTP<br/>Managed by Prowler · always up to date<br/>Adds the Cloud-only prowler_cloud_* tools"]
local["💻 Local MCP Server<br/>Self-run · STDIO or HTTP<br/>Python 3.12+ or Docker<br/>You manage updates"] local["Local MCP Server<br/>Self-run · STDIO or HTTP<br/>Python 3.12+ or Docker<br/>You manage updates"]
end end
subgraph TOOLS["Prowler MCP Tools"] subgraph TOOLS["Prowler MCP Tools"]
prowler_tools["prowler_* tools<br/>(API key or JWT auth)<br/>Findings · Providers · Scans<br/>Resources · Muting · Compliance<br/>Attack Paths"] prowler_tools["prowler_* tools<br/>(API key or JWT auth)<br/>Findings · Finding Groups · Providers<br/>Scans · Resources · Muting · Compliance<br/>Attack Paths · Integrations · Users · Roles"]
cloud_tools["prowler_cloud_* tools<br/>(API key or JWT auth · Cloud only)<br/>Alerts · Findings Triage<br/>Scan Scheduling · Scan Configurations"]
hub_tools["prowler_hub_* tools<br/>(no auth)<br/>Checks Catalog · Check Code<br/>Fixers · Compliance Frameworks"] hub_tools["prowler_hub_* tools<br/>(no auth)<br/>Checks Catalog · Check Code<br/>Fixers · Compliance Frameworks"]
docs_tools["prowler_docs_* tools<br/>(no auth)<br/>Search · Document Retrieval"] docs_tools["prowler_docs_* tools<br/>(no auth)<br/>Search · Document Retrieval"]
end end
@@ -104,6 +115,7 @@ flowchart LR
apps -->|STDIO or HTTP| local apps -->|STDIO or HTTP| local
cloud --> prowler_tools cloud --> prowler_tools
cloud --> cloud_tools
cloud --> hub_tools cloud --> hub_tools
cloud --> docs_tools cloud --> docs_tools
local --> prowler_tools local --> prowler_tools
@@ -111,12 +123,14 @@ flowchart LR
local --> docs_tools local --> docs_tools
prowler_tools -->|REST| api prowler_tools -->|REST| api
cloud_tools -->|REST| api
hub_tools -->|REST| hub hub_tools -->|REST| hub
docs_tools -->|REST| docs docs_tools -->|REST| docs
``` ```
The architecture shows how AI assistants connect through the MCP protocol to access Prowler's three main components: The architecture shows how AI assistants connect through the MCP protocol to access Prowler's four namespaced components:
- Prowler Cloud, Prowler Private Cloud, or Prowler Local Server for security operations - Prowler Cloud, Prowler Private Cloud, or Prowler Local Server for security operations
- Prowler Cloud management for Cloud-only configuration and workflows
- Prowler Hub for security knowledge - Prowler Hub for security knowledge
- Prowler Documentation for guidance and reference. - Prowler Documentation for guidance and reference.
@@ -127,8 +141,15 @@ The Prowler MCP Server enables powerful workflows through AI assistants:
**Security Operations** **Security Operations**
- "Show me all critical findings from my AWS production accounts" - "Show me all critical findings from my AWS production accounts"
- "Register my new AWS account in Prowler and run a scheduled scan every day" - "Register my new AWS account in Prowler and run a scheduled scan every day"
- "List all muted findings and detect what findgings are muted by a not enough good reason in relation to their severity" - "List all muted findings and flag the ones whose mute reason is too weak for their severity"
- "Run an attack paths query to find EC2 instances exposed to the Internet with access to sensitive S3 buckets" - "Run an attack paths query to find EC2 instances exposed to the Internet with access to sensitive S3 buckets"
- "Send my failed CIS findings for this provider to Jira as work items"
**Prowler Cloud Management** (Cloud MCP Server only)
- "Preview an alert rule for critical AWS findings and create it for my confirmed recipients"
- "Show the triage notes for this finding and mark it as under review"
- "Apply a weekly Monday 06:00 scan schedule to every AWS provider"
- "Create a scan configuration that runs only CIS checks and attach it to my production providers"
**Security Research** **Security Research**
- "Explain what the S3 bucket public access Prowler check does" - "Explain what the S3 bucket public access Prowler check does"
@@ -199,17 +220,17 @@ There are two ways to run the Prowler MCP Server. For almost everyone, the **Clo
| | ☁️ **Cloud MCP Server** (Recommended) | 💻 **Local MCP Server** | | | ☁️ **Cloud MCP Server** (Recommended) | 💻 **Local MCP Server** |
|---|---|---| |---|---|---|
| **Cloud-only tools** (`prowler_cloud_*`) | ✅ Alerts, Findings Triage, Scan Scheduling, Scan Configurations | ❌ Not available |
| **Endpoint** | `https://mcp.prowler.com/mcp` | Runs on your machine or infrastructure | | **Endpoint** | `https://mcp.prowler.com/mcp` | Runs on your machine or infrastructure |
| **Setup** | Just configure your MCP client | Install via Docker, or source | | **Setup** | Just configure your MCP client | Install via Docker, or source |
| **Transport** | HTTP | STDIO (subprocess) or self-hosted HTTP | | **Transport** | HTTP | STDIO (subprocess) or self-hosted HTTP |
| **Maintenance** | Managed by Prowler, always up to date | You manage updates | | **Maintenance** | Managed by Prowler, always up to date | You manage updates |
| **Requirements** | None (just an MCP client) | Python 3.12+ or Docker | | **Requirements** | None (just an MCP client) | Python 3.12+ or Docker |
| **Cloud-only tools** | ✅ Alerts, Scan Scheduling, Findings Triage | ❌ Not available |
| **Authentication** | API key or JWT token | API key/JWT (HTTP) or env vars (STDIO) | | **Authentication** | API key or JWT token | API key/JWT (HTTP) or env vars (STDIO) |
### ☁️ Cloud MCP Server (Recommended) ### ☁️ Cloud MCP Server (Recommended)
Prowler's managed MCP server at `https://mcp.prowler.com/mcp`. No installation, always up to date, and it includes tools for Prowler Cloud-specific features such as Alerts, Scan Scheduling, and Findings Triage. This is the path we recommend for nearly all users — go straight to the [Configuration guide](/getting-started/basic-usage/prowler-mcp#cloud-mcp-server-configuration-recommended). Prowler's managed MCP server at `https://mcp.prowler.com/mcp`. No installation, always up to date, and it includes the `prowler_cloud_*` tools for Prowler Cloud-specific features: Alerts, Findings Triage, Scan Scheduling, and Scan Configurations. This is the path we recommend for nearly all users — go straight to the [Configuration guide](/getting-started/basic-usage/prowler-mcp#cloud-mcp-server-configuration-recommended).
### 💻 Local MCP Server ### 💻 Local MCP Server
docs/images/prowler_mcp_schema.mmd
+6 -3
View File
@@ -7,12 +7,13 @@ flowchart LR
subgraph SERVERS["Prowler MCP Server"] subgraph SERVERS["Prowler MCP Server"]
direction TB direction TB
cloud["☁️ Cloud MCP Server (Recommended)<br/>mcp.prowler.com/mcp · HTTP<br/>Managed by Prowler · always up to date<br/>Adds Cloud-only tools (Alerts,<br/>Scan Scheduling, Findings Triage)"] cloud["Cloud MCP Server (Recommended)<br/>mcp.prowler.com/mcp · HTTP<br/>Managed by Prowler · always up to date<br/>Adds the Cloud-only prowler_cloud_* tools"]
local["💻 Local MCP Server<br/>Self-run · STDIO or HTTP<br/>Python 3.12+ or Docker<br/>You manage updates"] local["Local MCP Server<br/>Self-run · STDIO or HTTP<br/>Python 3.12+ or Docker<br/>You manage updates"]
end end
subgraph TOOLS["Prowler MCP Tools"] subgraph TOOLS["Prowler MCP Tools"]
prowler_tools["prowler_* tools<br/>(API key or JWT auth)<br/>Findings · Providers · Scans<br/>Resources · Muting · Compliance<br/>Attack Paths"] prowler_tools["prowler_* tools<br/>(API key or JWT auth)<br/>Findings · Finding Groups · Providers<br/>Scans · Resources · Muting · Compliance<br/>Attack Paths · Integrations · Users · Roles"]
cloud_tools["prowler_cloud_* tools<br/>(API key or JWT auth · Cloud only)<br/>Alerts · Findings Triage<br/>Scan Scheduling · Scan Configurations"]
hub_tools["prowler_hub_* tools<br/>(no auth)<br/>Checks Catalog · Check Code<br/>Fixers · Compliance Frameworks"] hub_tools["prowler_hub_* tools<br/>(no auth)<br/>Checks Catalog · Check Code<br/>Fixers · Compliance Frameworks"]
docs_tools["prowler_docs_* tools<br/>(no auth)<br/>Search · Document Retrieval"] docs_tools["prowler_docs_* tools<br/>(no auth)<br/>Search · Document Retrieval"]
end end
@@ -29,6 +30,7 @@ flowchart LR
apps -->|STDIO or HTTP| local apps -->|STDIO or HTTP| local
cloud --> prowler_tools cloud --> prowler_tools
cloud --> cloud_tools
cloud --> hub_tools cloud --> hub_tools
cloud --> docs_tools cloud --> docs_tools
local --> prowler_tools local --> prowler_tools
@@ -36,5 +38,6 @@ flowchart LR
local --> docs_tools local --> docs_tools
prowler_tools -->|REST| api prowler_tools -->|REST| api
cloud_tools -->|REST| api
hub_tools -->|REST| hub hub_tools -->|REST| hub
docs_tools -->|REST| docs docs_tools -->|REST| docs
mcp_server/README.md
+23 -5
View File
@@ -12,17 +12,26 @@ Full access to your Prowler data (Prowler Cloud, Prowler Private Cloud, or Prowl
- **Findings Analysis**: Query, filter, and analyze security findings across all your cloud environments - **Findings Analysis**: Query, filter, and analyze security findings across all your cloud environments
- **Finding Groups Analysis**: Triage findings grouped by check ID and drill down into affected resources - **Finding Groups Analysis**: Triage findings grouped by check ID and drill down into affected resources
- **Provider Management**: Create, configure, and manage your configured Prowler providers (AWS, Azure, GCP, etc.) - **Provider Management**: Create, configure, and manage your configured Prowler providers (AWS, Azure, GCP, etc.)
- **Scan Orchestration**: Trigger on-demand scans and schedule recurring security assessments - **Scan Orchestration**: Trigger on-demand scans, track their progress, and schedule a daily scan
- **Resource Inventory**: Search and view detailed information about your audited resources - **Resource Inventory**: Search and view detailed information about your audited resources
- **Muting Management**: Create and manage muting rules to suppress non-critical findings - **Muting Management**: Create and manage muting rules to suppress non-critical findings
- **Compliance Reporting**: View compliance status across frameworks and drill into requirement-level details - **Compliance Reporting**: View compliance status across frameworks and drill into requirement-level details
- **Attack Paths Analysis**: Analyze privilege escalation chains through graph-based analysis of cloud resource relationships
- **Integrations Management**: Set up and troubleshoot where Prowler sends its results (Amazon S3, AWS Security Hub, Jira), and turn findings into Jira work items - **Integrations Management**: Set up and troubleshoot where Prowler sends its results (Amazon S3, AWS Security Hub, Jira), and turn findings into Jira work items
- **User & Role Management**: List the users in your tenant, identify the authenticated user, browse RBAC roles, and set the role a user holds - **User & Role Management**: List the users in your tenant, identify the authenticated user, browse RBAC roles, and set the role a user holds
### Prowler Cloud Management
Prowler Cloud-only workflow and configuration features (`prowler_cloud_*` tools). These are available only on the [hosted Prowler MCP](#1-hosted-prowler-mcp-recommended), since they manage features that exist only in Prowler Cloud:
- **Scan Configurations**: Read, create, update, and delete reusable scan configurations and attach them to providers (providers without one use the default)
- **Findings Triage**: Read and set a finding's triage status and leave notes documenting the decision, without suppressing the finding
- **Scan Scheduling**: Read and configure recurring scan schedules (daily, interval, weekly, monthly), one provider at a time or in bulk
- **Alerts**: Read and manage alert rules and recipients, dry-run rule conditions before saving, and browse the fired-alert history
### Prowler Hub ### Prowler Hub
Access to Prowler's comprehensive security knowledge base: Access to Prowler's comprehensive security knowledge base:
- **Security Checks Catalog**: Browse and search **over 1000 security checks** across multiple Prowler providers - **Security Checks Catalog**: Browse and search **over 2,000 security checks** across multiple Prowler providers
- **Check Implementation**: View the Python code that powers each security check - **Check Implementation**: View the Python code that powers each security check
- **Automated Fixers**: Access remediation scripts for common security issues - **Automated Fixers**: Access remediation scripts for common security issues
- **Compliance Frameworks**: Explore mappings to **over 70 compliance standards and frameworks** - **Compliance Frameworks**: Explore mappings to **over 70 compliance standards and frameworks**
@@ -129,6 +138,7 @@ For complete tool descriptions and parameters, see the [Tools Reference](https:/
All tools follow a consistent naming pattern with prefixes: All tools follow a consistent naming pattern with prefixes:
- `prowler_*` - Prowler Cloud, Prowler Private Cloud & Prowler Local Server management tools - `prowler_*` - Prowler Cloud, Prowler Private Cloud & Prowler Local Server management tools
- `prowler_cloud_*` - Prowler Cloud-only management tools (hosted Prowler MCP only)
- `prowler_hub_*` - Prowler Hub catalog and compliance tools - `prowler_hub_*` - Prowler Hub catalog and compliance tools
- `prowler_docs_*` - Prowler documentation search and retrieval - `prowler_docs_*` - Prowler documentation search and retrieval
@@ -136,7 +146,7 @@ All tools follow a consistent naming pattern with prefixes:
```text ```text
prowler_mcp_server/ prowler_mcp_server/
├── server.py # Main orchestrator (imports sub-servers with prefixes) ├── server.py # Main orchestrator (mounts sub-servers with namespaces)
├── main.py # CLI entry point ├── main.py # CLI entry point
├── prowler_hub/ # tools - no authentication required ├── prowler_hub/ # tools - no authentication required
├── prowler_app/ # tools - authentication required ├── prowler_app/ # tools - authentication required
@@ -160,7 +170,15 @@ The Prowler MCP Server enables powerful workflows through AI assistants:
- "Show me all critical findings from my AWS production accounts" - "Show me all critical findings from my AWS production accounts"
- "Register my new AWS account in Prowler and run a scheduled scan every day" - "Register my new AWS account in Prowler and run a scheduled scan every day"
- "List all muted findings and detect what findgings are muted by a not enough good reason in relation to their severity" - "List all muted findings and flag the ones whose mute reason is too weak for their severity"
- "Send my failed CIS findings for this provider to Jira as work items"
### Prowler Cloud Management
- "Preview an alert rule for critical AWS findings and create it for my confirmed recipients"
- "Show the triage notes for this finding and mark it as under review"
- "Apply a weekly Monday 06:00 scan schedule to every AWS provider"
- "Create a scan configuration that runs only CIS checks and attach it to my production providers"
### Security Research ### Security Research
@@ -186,7 +204,7 @@ The Prowler MCP Server enables powerful workflows through AI assistants:
- `https://docs.prowler.com` (for Prowler Documentation) - `https://docs.prowler.com` (for Prowler Documentation)
- Prowler Cloud API or Prowler Local Server API (for Prowler features) - Prowler Cloud API or Prowler Local Server API (for Prowler features)
> **No Authentication Required**: Prowler Hub and Prowler Documentation features work without authentication. A Prowler API key is only required to access Prowler features (Prowler Cloud, Prowler Private Cloud, or Prowler Local Server). > **No Authentication Required**: Prowler Hub and Prowler Documentation features work without authentication. A Prowler API key is only required for the `prowler_*` and `prowler_cloud_*` tools (Prowler Cloud, Prowler Private Cloud, or Prowler Local Server).
## Configuring MCP Hosts ## Configuring MCP Hosts
mcp_server/changelog.d/mcp-docs-cloud-namespace.changed.md
+1
View File
@@ -0,0 +1 @@
README now documents the Cloud-only `prowler_cloud_*` tools available on the hosted Prowler MCP (alerts, findings triage, scan scheduling, scan configurations), and corrects the Prowler Hub check count and the scan orchestration capabilities