Skip to main content
Complete reference guide for all tools available in the Prowler MCP Server. Tools are organized by namespace.

​
Tool Categories Summary

​
Tool Naming Convention

All tools follow a consistent naming pattern with prefixes:
  • prowler_hub_* - Prowler Hub catalog and compliance tools
  • prowler_docs_* - Prowler documentation search and retrieval
  • prowler_* - Prowler Cloud, Prowler Private Cloud & Prowler Local Server management tools

​
Prowler Tools

Manage your Prowler deployment — Prowler Cloud, Prowler Private Cloud, or Prowler Local Server. Requires authentication.
These tools require a valid API key. See the Configuration Guide for authentication setup.

​
Findings Management

Tools for searching, viewing, and analyzing security findings across all cloud providers.
  • prowler_search_security_findings - Search and filter security findings with advanced filtering options (severity, status, provider, region, service, check ID, date range, muted status)
  • prowler_get_finding_details - Get comprehensive details about a specific finding including remediation guidance, check metadata, and resource relationships
  • prowler_get_findings_overview - Get aggregate statistics and trends about security findings as a markdown report

​
Finding Groups Management

Tools for listing finding groups aggregated by check ID, viewing complete group counters, and drilling down into affected resources.
  • prowler_list_finding_groups - List latest or historical finding groups with filters for provider, region, service, resource, category, check, severity, status, muted state, delta, date range, and sorting
  • prowler_get_finding_group_details - Get complete details for a specific finding group including counters, description, timestamps, and impacted providers
  • prowler_list_finding_group_resources - List actionable unmuted resources affected by a finding group by default, including nested resource and provider data plus the finding_id for remediation details. Set include_muted to include suppressed resources

​
Provider Management

Tools for managing cloud provider connections in Prowler.
  • prowler_search_providers - Search and view configured providers with their connection status
  • prowler_connect_provider - Register and connect a provider with credentials for security scanning
  • prowler_delete_provider - Permanently remove a provider from Prowler

​
Scan Management

Tools for managing and monitoring security scans.
  • prowler_list_scans - List and filter security scans across all providers
  • prowler_get_scan - Get comprehensive details about a specific scan (progress, duration, resource counts)
  • prowler_trigger_scan - Trigger a manual security scan for a provider
  • prowler_schedule_daily_scan - Schedule automated daily scans for continuous monitoring
  • prowler_update_scan - Update scan name for better organization

​
Resources Management

Tools for searching, viewing, and analyzing cloud resources discovered by Prowler.
  • prowler_list_resources - List and filter cloud resources with advanced filtering options (provider, region, service, resource type, tags)
  • prowler_get_resource - Get comprehensive details about a specific resource including configuration, metadata, and finding relationships
  • prowler_get_resource_events - Get the timeline of cloud API actions performed on a resource (AWS CloudTrail). Shows who did what and when, with full request/response payloads
  • prowler_get_resources_overview - Get aggregate statistics about cloud resources as a markdown report

​
Muting Management

Tools for managing finding muting, including pattern-based bulk muting (mutelist) and finding-specific mute rules.

​
Mutelist (Pattern-Based Muting)

  • prowler_get_mutelist - Retrieve the current mutelist configuration for the tenant
  • prowler_set_mutelist - Create or update the mutelist configuration for pattern-based bulk muting
  • prowler_delete_mutelist - Remove the mutelist configuration from the tenant

​
Mute Rules (Finding-Specific Muting)

  • prowler_list_mute_rules - Search and filter mute rules with pagination support
  • prowler_get_mute_rule - Retrieve comprehensive details about a specific mute rule
  • prowler_create_mute_rule - Create a new mute rule to mute specific findings with documentation and audit trail
  • prowler_update_mute_rule - Update a mute rule’s name, reason, or enabled status
  • prowler_delete_mute_rule - Delete a mute rule from the system

​
Attack Paths Analysis

Tools for analyzing privilege escalation chains and security misconfigurations using graph-based analysis. Attack Paths maps relationships between cloud resources, permissions, and security findings to detect how privileges can be escalated and how misconfigurations can be exploited.
  • prowler_list_attack_paths_scans - List Attack Paths scans with filtering by provider, provider type, and scan state (available, scheduled, executing, completed, failed, cancelled)
  • prowler_list_attack_paths_queries - Discover available Attack Paths queries for a completed scan, including query names, descriptions, and required parameters
  • prowler_run_attack_paths_query - Execute an Attack Paths query against a completed scan and retrieve graph results with nodes (cloud resources, findings, virtual nodes) and relationships (access paths, role assumptions, security group memberships)
  • prowler_get_attack_paths_cartography_schema - Retrieve the Cartography graph schema (node labels, relationships, properties) for writing accurate custom openCypher queries

​
Compliance Management

Tools for viewing compliance status and framework details across all cloud providers.
  • prowler_get_compliance_overview - Get high-level compliance status across all frameworks for a specific scan or provider, including pass/fail statistics per framework
  • prowler_get_compliance_framework_state_details - Get detailed requirement-level breakdown for a specific compliance framework, including failed requirements and associated finding IDs

​
Prowler Hub Tools

Access Prowler’s security check catalog and compliance frameworks. No authentication required. Tools follow a two-tier pattern: lightweight listing for browsing + detailed retrieval for complete information.

​
Check Discovery and Details

  • prowler_hub_list_checks - List security checks with lightweight data (id, title, severity, provider) and advanced filtering options
  • prowler_hub_semantic_search_checks - Full-text search across check metadata with lightweight results
  • prowler_hub_get_check_details - Get comprehensive details for a specific check including risk, remediation guidance, and compliance mappings

​
Check Code

  • prowler_hub_get_check_code - Fetch the Python implementation code for a security check
  • prowler_hub_get_check_fixer - Fetch the automated fixer code for a check (if available)

​
Compliance Frameworks

  • prowler_hub_list_compliances - List compliance frameworks with lightweight data (id, name, provider) and filtering options
  • prowler_hub_semantic_search_compliances - Full-text search across compliance frameworks with lightweight results
  • prowler_hub_get_compliance_details - Get comprehensive compliance details including requirements and mapped checks

​
Providers Information

  • prowler_hub_list_providers - List Prowler official providers
  • prowler_hub_get_provider_services - Get available services for a specific provider

​
Prowler Documentation Tools

Search and access official Prowler documentation. No authentication required.
  • prowler_docs_search - Search the official Prowler documentation using full-text search with the term parameter
  • prowler_docs_get_document - Retrieve the full markdown content of a specific documentation file using the path from search results

​
Usage Tips

  • Use natural language to interact with the tools through your AI assistant
  • Tools can be combined for complex workflows
  • Filter options are available on most list tools
  • Authentication is only required for Prowler tools (Prowler Cloud, Prowler Private Cloud, or Prowler Local Server)

​
Additional Resources