Connect Claude Code to the Prowler Cloud MCP Server at https://mcp.prowler.com/mcp.

Where Claude Code Runs

Claude Code runs in two places. Both read the same configuration file, so you set it up once from a terminal and it works in both.

Surface	How you open it	Reads	Covered by
Claude Code CLI	`claude` in a terminal	`~/.claude.json`	This guide
Claude Code in the desktop app	The Code tab inside the Claude app	`~/.claude.json` — the same file	This guide, set up from a terminal
Claude app Chat	The Chat tab inside the Claude app	`claude_desktop_config.json`	Claude App Chat — a separate setup

The Chat tab is not Claude Code. It is a different product surface with its own configuration file and its own connection method (a local bridge). Nothing on this page applies to it. If you want Prowler in Chat, use the Claude App Chat guide instead.

Choose Your Setup

There are two ways to connect. Both end with the same MCP Server connection, the difference is what comes with it.

	🔌 Prowler Plugin	⚙️ MCP Connection Only
What you get	The MCP connection plus the official Prowler skills for cloud security tasks	The MCP connection
Setup	Two slash commands, prompts for the API key	One `claude mcp add` command
Guided workflows	✅ Skills drive multi-step security work end to end	❌ You drive the conversation
Best for	Structured cloud security work, such as taking an account to compliance	Ad-hoc queries and your own workflows
Where to use it	Claude Code CLI	Claude Code CLI, and the recommended setup for the desktop app’s Code tab

The plugin already includes the MCP connection. If you install the plugin, do not also run claude mcp add — you would end up with the server configured twice.

Prerequisites

Claude Code installed and signed in. See the official install guide.
A Prowler Cloud account. The free tier is enough to start. Sign up at cloud.prowler.com.

Get Your Prowler API Key

Create an API key in Prowler Cloud and copy it. The key begins with pk_ and is shown only once. Check the API Keys guide for details.

Option 1: Install the Prowler Plugin

Preview: this plugin is under active development. Please report issues on GitHub or join the Slack community for feedback.

End-to-end cloud security from inside Claude Code, powered by the Prowler MCP server. The plugin bundles the official Prowler skills, task-specific workflows that let Claude carry out multi-step security work against a Prowler Cloud-connected account, rather than answering one question at a time.

Included Skills

Skill	What it does
`prowler:framework-compliance-triage`	Walks an account through a compliance assessment and remediates findings until the chosen security or industry framework is compliant.

More skills are on the way. Installing the plugin keeps you current — new skills arrive with plugin updates, no extra configuration required.

Installation (Claude Code CLI)

From GitHub (recommended)
From a local clone

Inside a Claude Code session:

/plugin marketplace add prowler-cloud/prowler
/plugin install prowler@prowler-plugins

If you already have the repository checked out:

/plugin marketplace add /absolute/path/to/prowler
/plugin install prowler@prowler-plugins

On first install, Claude Code prompts for your Prowler API key. The value is stored securely (macOS keychain or ~/.claude/.credentials.json) and used to authenticate against Prowler Cloud.

Verify the Installation

In a Claude Code session:

/mcp          → "prowler" appears as a connected server
/plugin       → "prowler" enabled, with the bundled Prowler skills listed

If /mcp reports the prowler server as failed, the most common cause is a rejected API key, re-issue one in Prowler Cloud and reinstall the plugin so it re-prompts.

Usage

Describe the security task you want done and Claude selects the matching skill.

Framework Compliance Triage

Mention the framework you want to comply with:

“Make my AWS production account compliant with CIS 4.0.”
“Make my current Terraform project compliant with Prowler ThreatScore Compliance Framework based on the latest scan results.”
“Help me get to 100% on PCI-DSS for this GCP project.”

You pick a primary tool (Terraform, gh / az / aws CLI, web console, or mixed) and a mode:

Claude-assisted (default)

Claude shows each fix — target resource, exact commands, side effects, reversibility — and waits for your go-ahead before applying.

Claude autonomous

Claude presents a single up-front plan grouped by shared fixes, waits for one confirmation, then proceeds. It pauses mid-loop if a fix has wide blast radius or a finding is not applicable.

Claude tracks progress in a markdown report under .prowler/ at your project root — one file per framework × account. Open it any time to see exactly where the flow is. When all findings are addressed, Claude proposes a fresh Prowler scan to verify everything end-to-end.

Uninstalling

/plugin uninstall prowler@prowler-plugins
/plugin marketplace remove prowler-plugins

The stored API key is removed automatically.

Option 2: Connect the MCP Server Only

Choose this when you want Prowler’s tools available without the Prowler skills.

Add the Server

Claude Code connects to remote HTTP MCP servers natively and supports custom headers, so no bridge is required.

export PROWLER_API_KEY="pk_your_api_key_here"

claude mcp add --transport http prowler https://mcp.prowler.com/mcp \
  --header "Authorization: Bearer $PROWLER_API_KEY" \
  --scope user

Terminal showing the claude mcp add command and its confirmation output

Always pass --scope user. The default scope is local, which binds the server to the single directory you ran the command in. A locally-scoped server does not load when you open Claude Code anywhere else — this is the most common reason Prowler tools appear to vanish.

Scope	Loads in	Shared	Stored in
`user`	All your projects	No	`~/.claude.json`, top-level `mcpServers`
`project`	Current project only	Yes, via version control	`.mcp.json` in the project root
`local` (default)	Current project only	No	`~/.claude.json`, under that project’s entry

When the same server name exists in more than one scope, precedence is local → project → user. The winning entry is used whole; fields are not merged.

Avoid --scope project for Prowler. That writes .mcp.json into your repository, and committing the file would publish your API key.

Local server: Replace the URL with your own HTTP endpoint. Everything else stays the same.

Verify the Connection

claude mcp get prowler   # shows which scope holds the definition
claude mcp list          # lists all servers and their status

Inside a Claude Code session, run /mcp to see connected servers and their tools.

Claude Code session showing the /mcp command output with the Prowler server connected

Start Using Prowler MCP

“Show me all critical findings from my AWS accounts”
“What does the S3 bucket public access check do?”
“Onboard this new AWS account in my Prowler organization”

Claude Code answering a question about critical findings using Prowler MCP tools

Claude Code in the Desktop App (Code Tab)

The Code tab in the Claude desktop app runs the same Claude Code as the CLI, and reads the same ~/.claude.json. There is no separate Prowler setup for it — you configure it from a terminal and the Code tab picks it up.

Use Option 2 with --scope user here. It is the recommended setup for the Code tab. The Prowler plugin (Option 1) is not the recommended route for the desktop app — install it in the Claude Code CLI instead.

You cannot do this from inside the app. The desktop app has no interface for adding an MCP server to a Claude Code session. Settings → Connectors configures the Chat tab, not the Code tab, so anything added there never reaches Claude Code. Trying to configure it from the app is the main reason this appears not to work.

Add the server at user scope from a terminal

In a normal terminal — not inside the app:

export PROWLER_API_KEY="pk_your_api_key_here"

claude mcp add --transport http prowler https://mcp.prowler.com/mcp \
  --header "Authorization: Bearer $PROWLER_API_KEY" \
  --scope user

--scope user is what makes this work. It writes to ~/.claude.json, the file the Code tab reads.

Confirm it landed at user scope

claude mcp get prowler

The scope must be user. A local-scoped server is bound to the directory you ran the command in and will not load in an app session opened elsewhere.

Restart the Claude app

Quit the app completely and reopen it. Configuration is read at startup.

Verify in the Code tab

Open a Code tab session and ask for a Prowler tool: “Do you have access to the Prowler MCP tools?”, it should respond with a list of available tools or confirming that it has access.

Claude App Chat (Chat Tab)

Not covered by this page. The Chat tab is a separate surface: it does not read ~/.claude.json, so a server added with claude mcp add appears in the CLI and in the Code tab but never in Chat. That is expected behavior, not a broken setup. Chat reads claude_desktop_config.json and reaches the Prowler MCP Server through a local bridge.

Connect the Claude App Chat

Separate guide: local bridge and its own configuration file

Troubleshooting

Symptom	Likely cause	Fix
`/mcp` shows `prowler` as failed	Rejected API key	Generate a new one in Prowler Cloud. With the plugin, reinstall it to re-prompt.
No MCP servers configured	Server added at `local` scope from another directory	Run `claude mcp get prowler`, then re-add with `--scope user`.
A stale entry overrides a working one	Precedence is local → project → user	`claude mcp remove prowler --scope local`
Tools appear in the CLI but not in the app’s Code tab	Server added at `local` scope, or the app was not restarted	Re-add with `--scope user`, then quit and reopen the app. See Claude Code in the Desktop App.
Tools appear in the Code tab but not the Chat tab	Chat is a different surface with its own config file	Expected. Set Chat up separately, see Claude App Chat.
No way to add the server from inside the app	The app has no MCP interface for Claude Code sessions	Configure it from a terminal with `--scope user`, then restart the app. See Claude Code in the Desktop App.
Skill not invoked when expected	The prompt didn’t match any skill’s description	Name the task explicitly. For compliance triage, mention the framework plus “compliance” or “compliant”.
”Framework not supported”	Prowler Hub does not list the framework for that provider	Open an issue or PR at github.com/prowler-cloud/prowler.

Authentication Fails With 401

Confirm the header value includes the Bearer prefix.
Check that PROWLER_API_KEY was set when you ran claude mcp add — the shell expands it at that moment and stores the resulting literal value. If the variable was empty, the stored header reads Bearer with nothing after it. Verify with claude mcp get prowler.
Confirm the key has not been revoked in Prowler Cloud.

Next Steps

Tools Reference

Explore all available tools and capabilities

All MCP Clients

Configuration reference for every supported client

Getting Help

Search for existing GitHub issues
Ask for help in our Slack community
Report a new issue on GitHub

Welcome

Prowler Products

Open Source

Prowler vs. Others

Connect Claude Code to Prowler MCP Server

Where Claude Code Runs

Choose Your Setup

Prerequisites

Get Your Prowler API Key

Option 1: Install the Prowler Plugin

Included Skills

Installation (Claude Code CLI)

Verify the Installation

Usage

Framework Compliance Triage

Claude-assisted (default)

Claude autonomous

Uninstalling

Option 2: Connect the MCP Server Only

Add the Server

Verify the Connection

Start Using Prowler MCP

Claude Code in the Desktop App (Code Tab)

Claude App Chat (Chat Tab)

Connect the Claude App Chat

Troubleshooting

Authentication Fails With 401

Next Steps

Tools Reference

All MCP Clients

Getting Help

​Where Claude Code Runs

​Choose Your Setup

​Prerequisites

​Get Your Prowler API Key

​Option 1: Install the Prowler Plugin

​Included Skills

​Installation (Claude Code CLI)

​Verify the Installation

​Usage

​Framework Compliance Triage

Claude-assisted (default)

Claude autonomous

​Uninstalling

​Option 2: Connect the MCP Server Only

​Add the Server

​Verify the Connection

​Start Using Prowler MCP

​Claude Code in the Desktop App (Code Tab)

​Claude App Chat (Chat Tab)

Connect the Claude App Chat

​Troubleshooting

​Authentication Fails With 401

​Next Steps

Tools Reference

All MCP Clients

​Getting Help

Where Claude Code Runs

Choose Your Setup

Prerequisites

Get Your Prowler API Key

Option 1: Install the Prowler Plugin

Included Skills

Installation (Claude Code CLI)

Verify the Installation

Usage

Framework Compliance Triage

Uninstalling

Option 2: Connect the MCP Server Only

Add the Server

Verify the Connection

Start Using Prowler MCP

Claude Code in the Desktop App (Code Tab)

Claude App Chat (Chat Tab)

Troubleshooting

Authentication Fails With 401

Next Steps

Getting Help