> ## Documentation Index
> Fetch the complete documentation index at: https://prowler-docs-msp-documentation-accuracy.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Prowler product naming: Prowler App is now Prowler Local Server, and Prowler Enterprise is now Prowler Private Cloud. Always use the current names when answering. The full product reference is at /getting-started/products: Open Source projects are Prowler CLI, Prowler Local Server, Prowler Local Dashboard, and Prowler SDK; Prowler Products are Prowler Cloud, Prowler Private Cloud, Prowler Hub, Prowler Lighthouse AI, and Prowler MCP.

# Configuration

Configure your MCP client to connect to Prowler MCP Server.

## Step 1: Get Your API Key

<Note>
  **Authentication is optional**: Prowler Hub and Prowler Documentation features work without authentication. An API key is only required for Prowler tools (Prowler Cloud, Prowler Private Cloud, or Prowler Local Server).
</Note>

An API key authenticates the Prowler tools (Prowler Cloud, Prowler Private Cloud, or Prowler Local Server). To get the API key, please refer to the [API Keys](/user-guide/tutorials/prowler-app-api-keys) guide.

<Warning>
  Keep the API key secure. Never share it publicly or commit it to version control.
</Warning>

## Step 2: Configure Your MCP Host/Client

Most users should use the **Cloud MCP Server** — it needs no installation and is maintained by Prowler. The [Local MCP Server](#local-mcp-server-configuration) configuration is provided afterwards for users who run the server themselves.

* **Cloud MCP Server (HTTP)**: the managed server at `https://mcp.prowler.com/mcp` (or your own self-hosted HTTP server).
* **Local MCP Server (STDIO)**: local installation only (runs as a subprocess of your MCP client).

### Step-by-Step Guides Per Agent

The tabs below are a quick configuration reference. For a walkthrough with screenshots, troubleshooting, and client-specific caveats, follow the dedicated guide for your agent:

<CardGroup cols={2}>
  <Card title="Claude Code" icon="terminal" href="/user-guide/ai-agents/claude-code">
    Plugin vs. MCP-only, and which Claude surfaces work
  </Card>

  <Card title="Claude Desktop App (Chat)" icon="comment" href="/user-guide/ai-agents/claude-desktop">
    The Chat tab, via a local bridge
  </Card>

  <Card title="Codex" icon="code" href="/user-guide/ai-agents/codex">
    CLI and the VS Code extension
  </Card>

  <Card title="Cursor" icon="arrow-pointer" href="/user-guide/ai-agents/cursor">
    Global and project scopes
  </Card>

  <Card title="VS Code / Copilot" icon="microsoft" href="/user-guide/ai-agents/vscode">
    Agent mode with secure key prompts
  </Card>
</CardGroup>

## Cloud MCP Server Configuration (Recommended)

Connect to the **Cloud MCP Server** at `https://mcp.prowler.com/mcp` over HTTP. This is the recommended path — no installation, always up to date. The same configuration works for a self-hosted HTTP server: just swap the URL.

<Tabs>
  <Tab title="Generic Native HTTP Support">
    **Configuration:**

    ```json theme={null}
    {
      "mcpServers": {
        "prowler": {
          "url": "https://mcp.prowler.com/mcp", // or your self-hosted Prowler MCP Server URL
          "headers": {
            "Authorization": "Bearer <your-api-key-here>"
          }
        }
      }
    }
    ```
  </Tab>

  <Tab title="Generic without Native HTTP Support">
    **Configuration:**

    <Warning>
      Avoid configuring MCP clients to run `npx mcp-remote` directly. `npx` can download and execute a new package version on each run. Install a reviewed version of `mcp-remote` in a dedicated local workspace, then point the MCP client to the installed binary.
    </Warning>

    ```bash theme={null}
    mkdir -p ~/.local/share/prowler-mcp-bridge
    cd ~/.local/share/prowler-mcp-bridge
    npm init -y
    npm install --save-exact mcp-remote@0.1.38
    ```

    ```json theme={null}
    {
      "mcpServers": {
        "prowler": {
          "command": "/absolute/path/to/.local/share/prowler-mcp-bridge/node_modules/.bin/mcp-remote",
          "args": [
            "https://mcp.prowler.com/mcp", // or your self-hosted Prowler MCP Server URL
            "--header",
            "Authorization: Bearer ${PROWLER_API_KEY}"
          ],
          "env": {
            "PROWLER_API_KEY": "<your-api-key-here>"
          }
        }
      }
    }
    ```

    <Info>
      The `mcp-remote` tool acts as a bridge for clients that don't support HTTP natively. Learn more at [mcp-remote on npm](https://www.npmjs.com/package/mcp-remote).
    </Info>
  </Tab>
</Tabs>

## Local MCP Server Configuration

STDIO mode is only available when running the **Local MCP Server** on your own machine. See the [Installation guide](/getting-started/installation/prowler-mcp) to set it up first.

<Tabs>
  <Tab title="Generic uvx installation">
    **Run from source or local installation**

    ```json theme={null}
    {
      "mcpServers": {
        "prowler": {
          "command": "uvx",
          "args": ["/absolute/path/to/prowler/mcp_server/"],
          "env": {
            "PROWLER_API_KEY": "<your-api-key-here>",
            "API_BASE_URL": "https://api.prowler.com/api/v1"
          }
        }
      }
    }
    ```

    <Note>
      Replace `/absolute/path/to/prowler/mcp_server/` with the actual path. The `API_BASE_URL` is optional and defaults to Prowler Cloud API.
    </Note>
  </Tab>

  <Tab title="Generic Docker installation">
    **Run with Docker image**

    ```json theme={null}
    {
      "mcpServers": {
        "prowler": {
          "command": "docker",
          "args": [
            "run",
            "--rm",
            "-i",
            "--env",
            "PROWLER_API_KEY=<your-api-key-here>",
            "--env",
            "API_BASE_URL=https://api.prowler.com/api/v1",
            "prowlercloud/prowler-mcp"
          ]
        }
      }
    }
    ```

    <Note>
      The `API_BASE_URL` is optional and defaults to Prowler Cloud API.
    </Note>
  </Tab>
</Tabs>

## Step 3: Start Using Prowler MCP

Restart your MCP client and start asking questions:

* *"Show me all critical findings from my AWS accounts"*
* *"What does the S3 bucket public access check do?"*
* *"Onboard this new AWS account in my Prowler Organization"*

## Authentication Methods

Prowler MCP Server supports two authentication methods to connect to Prowler (Prowler Cloud, Prowler Private Cloud, or Prowler Local Server):

### API Key (Recommended)

Use your Prowler API key directly in the Bearer token:

```
Authorization: Bearer <your-api-key-here>
```

This is the recommended method for most users.

### JWT Token

Alternatively, obtain a JWT token from Prowler:

```bash theme={null}
curl -X POST https://api.prowler.com/api/v1/tokens \
  -H "Content-Type: application/vnd.api+json" \
  -H "Accept: application/vnd.api+json" \
  -d '{
    "data": {
      "type": "tokens",
      "attributes": {
        "email": "your-email@example.com",
        "password": "your-password"
      }
    }
  }'
```

Use the returned JWT token in place of the API key:

```
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
```

<Warning>
  JWT tokens are only valid for 30 minutes. You need to generate a new token if you want to continue using the MCP server.
</Warning>

## Troubleshooting

### Server Not Detected

* Restart your MCP client after configuration changes
* Check the configuration file syntax (valid JSON)
* Review client logs for specific error messages
* Verify the server URL is correct

### Authentication Failures

**Error: Unauthorized (401)**

* Verify your API key is correct
* Ensure the key hasn't expired
* Check you're using the right API endpoint

### Connection Issues

**Cannot Reach Server:**

* Verify the server URL is correct
* Check network connectivity
* For local servers, ensure the server is running
* Check firewall settings

## Security Best Practices

1. **Protect Your API Key**
   * Never commit API keys to version control.
   * Use environment variables or secure vaults.
   * Rotate keys regularly.

2. **Network Security**
   * Use HTTPS for production deployments.
   * Restrict network access to the MCP server.
   * Consider VPN for remote access.

3. **Least Privilege**
   * API key gives the permission of the user who created the key, make sure to use the key with the minimal required permissions.
   * Review the tools that are gonna be used and how they are gonna be used to avoid prompt injections or unintended behavior.

## Next Steps

Now that your MCP server is configured:

<CardGroup cols={1}>
  <Card title="Tools Reference" icon="wrench" href="/getting-started/basic-usage/prowler-mcp-tools">
    Explore all available tools
  </Card>
</CardGroup>

## Getting Help

Need assistance with configuration?

* Search for existing [GitHub issues](https://github.com/prowler-cloud/prowler/issues)
* Ask for help in our [Slack community](https://goto.prowler.com/slack)
* Report a new issue on [GitHub](https://github.com/prowler-cloud/prowler/issues/new)