Prowler MCP server

Tools provided by Prowler 100

21 of 100 shown; 79 omitted to keep the page bounded.

• prowler_cloud_apply_organization_discoveryoutputSchema declared

  Apply a succeeded discovery: create/link Prowler providers for the selected accounts, subscriptions or projects and build the OU/management-group/folder hierarchy. WARNING: for AWS organizations, omitting `accounts` (or passing an empty list) onboards the ENTIRE organization — every discovered account. Always pass an explicit selection unless that is intended. For Azure, `subscriptions` is required and must be non-empty; for GCP, `projects` is required and must be non-empty. Items whose discovery `apply_status` was 'blocked' (e.g. the account already belongs to another organization) will be re

  Input accounts?: any, context: string, discovery_id?: any, organization_id: string, organizational_units?: any, projects?: any, subscriptions?: any

  • accounts?: anyoptional

    AWS only: accounts to onboard, e.g. [{"id": "123456789012", "alias": "Production"}] (alias optional). WARNING: omitting this onboards ALL discovered accounts.

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • discovery_id?: anyoptional

    Discovery to apply. Defaults to the most recent succeeded discovery for the organization.

  • organization_id: stringrequired

    Organization UUIDv4. Get it from prowler_cloud_list_organizations.

  • organizational_units?: anyoptional

    AWS only: OUs to create as hierarchy nodes, e.g. [{"id": "ou-abcd-12345678"}]. Ancestor OUs are added automatically. Omitting this creates ALL discovered OUs.

  • projects?: anyoptional

    GCP only, REQUIRED for GCP: projects to onboard, e.g. [{"project_id": "my-project", "alias": "Prod"}] (alias optional, 3-100 chars).

  • subscriptions?: anyoptional

    Azure only, REQUIRED for Azure: subscriptions to onboard, e.g. [{"subscription_id": "00000000-0000-0000-0000-000000000000", "alias": "Prod"}] (alias optional, 3-100 chars). Only subscriptions whose discovered state is "Enabled" can be applied.

• prowler_cloud_build_alert_rule_conditionoutputSchema declared

  Build and dry-run an alert-rule condition in one call. Nothing is persisted. This combines the two preparation steps for an alert rule: 1. SEED: translate a findings `filter_bag` into a condition DSL (skipped when you pass a `condition` directly). 2. PREVIEW: dry-run that condition against the latest scan data. Returns the ready-to-use `condition` (pass it straight to prowler_cloud_create_alert_rule / prowler_cloud_update_alert_rule) alongside: - `warnings`: filters dropped during seeding (empty when a `condition` was passed in). - `would_fire`: whether the condition would have fired against t

  Input condition?: any, context: string, filter_bag?: any

  • condition?: anyoptional

    A pre-built condition DSL to validate directly instead of seeding one from a filter_bag (dict or JSON string). Use this to dry-run a condition you already have, e.g. one returned by prowler_cloud_get_alert_rule. Provide EITHER filter_bag OR condition, not both.

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • filter_bag?: anyoptional

    Findings filter to translate into a rule condition, as a dict (or JSON string). Same shape as prowler_app_search_security_findings filters: keys are field names, values are a single value, a comma-separated string, or a list. Only these PORTABLE fields are kept in the condition: severity (critical|high|medium|low|informational), delta (new|changed), provider_type (aws|azure|gcp|...), check_id, categories, region, service, resource_type, resource_groups, resource_uid, provider_id, finding_group_id. Field names may be bare ('severity'), suffixed ('severity__in' / 'severity.in'), or wrapped ('fil

• prowler_cloud_bulk_set_scan_schedulesoutputSchema declared

  Apply one scan schedule to MANY providers at once. This applies one COMPLETE schedule (scan_frequency + scan_hour required) and returns 'updated'/'failed' provider ids, not the schedule itself. For a single provider, or to make a partial edit such as pausing, use prowler_cloud_set_scan_schedule instead. Provide EITHER provider_ids OR provider_group_id (not both). Each provider is applied in its own transaction; the result reports 'updated' provider ids and 'failed' entries individually. Requires the `manage_scans` permission.

  Input context: string, provider_group_id?: any, provider_ids?: array, scan_day_of_month?: any, scan_day_of_week?: any, scan_enabled?: any, scan_frequency: string, scan_hour: integer, scan_interval_hours?: any, scan_timezone?: any

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • provider_group_id?: anyoptional

    Apply to every provider in this provider group (UUIDv4). Mutually exclusive with provider_ids.

  • provider_ids?: arrayoptional

    Providers to apply the scan schedule to, by UUIDv4. Mutually exclusive with provider_group_id.

  • scan_day_of_month?: anyoptional

    Day of month (1-28) for MONTHLY.

  • scan_day_of_week?: anyoptional

    Day of week for WEEKLY: 0=Sunday .. 6=Saturday.

  • scan_enabled?: anyoptional

    Whether the applied schedule is enabled.

  • scan_frequency: stringrequired

    Cadence to apply to every targeted provider.

  • scan_hour: integerrequired

    Hour of day (0-23) in scan_timezone.

  • scan_interval_hours?: anyoptional

    Hours between scans for INTERVAL (minimum 24).

  • scan_timezone?: anyoptional

    IANA timezone name, e.g. 'America/New_York'.

• prowler_cloud_create_alert_recipientoutputSchema declared

  Register a new alert recipient email. SIDE EFFECT: this enqueues a confirmation email to the address. Requires the `manage_alerts` permission on the API key/role.

  Input context: string, email: string

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • email: stringrequired

    Recipient email address to register.

• prowler_cloud_create_alert_ruleoutputSchema declared

  Create a tenant-scoped alert rule. SIDE EFFECT: recipients that are not yet confirmed will receive a confirmation email. Requires the `manage_alerts` permission on the API key/role. Workflow: 1. Use prowler_cloud_build_alert_rule_condition to turn a findings filter into a validated, dry-run condition (returns the 'condition' plus any dropped-filter warnings). 2. Use this tool with that 'condition' to persist the rule.

  Input condition: any, context: string, description?: any, enabled?: boolean, name: string, recipient_emails?: array, trigger?: any

  • condition: anyrequired

    Condition DSL that decides when the rule fires. Accepts a dict or JSON string. Build and validate it with prowler_cloud_build_alert_rule_condition, then pass the returned 'condition' here.

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • description?: anyoptional

    Optional description.

  • enabled?: booleanoptional

    Whether the rule is enabled (default True).

  • name: stringrequired

    Name for the alert rule (1-120 characters).

  • recipient_emails?: arrayoptional

    Email addresses to notify when the rule fires.

  • trigger?: anyoptional

    When the rule is evaluated: after_scan, daily or both.

• prowler_cloud_create_finding_triage_noteoutputSchema declared

  Add a new note to a finding's triage. A finding's triage can hold multiple notes. To edit an existing note use prowler_cloud_update_finding_triage_note; to remove one use prowler_cloud_delete_finding_triage_note. Requires the `manage_scans` permission on the API key/role.

  Input body: string, context: string, finding_uid: string

  • body: stringrequired

    Note text (1-500 chars).

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • finding_uid: stringrequired

    Stable finding UID.

• prowler_cloud_create_organizationoutputSchema declared

  Register a cloud provider organization in Prowler, optionally storing its org-level credentials in the same call. Credentials are required before discovery can run, so providing them here is recommended. Idempotent: if an organization with the same org_type and external_id already exists (e.g. from an earlier onboarding attempt), it is reused instead of failing with a duplicate error — its credentials are then created or rotated — and the response reports `created: false`. IMPORTANT for AWS: discovery assumes an IAM role that must already be deployed via Prowler's CloudFormation template — it

  Input context: string, credentials?: any, external_id: string, metadata?: any, name: string, org_type: string, secret_type?: any

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • credentials?: anyoptional

    Org-level credentials used for discovery. AWS role: {"role_arn": ...} — external_id defaults to your Prowler tenant id, the value the ProwlerScan CloudFormation template deploys with; only pass it for a manually deployed role with a custom ExternalId. Azure static: {"client_id": ..., "client_secret": ...} for a service principal that can read the management-group hierarchy — client_id must be a UUID and the Azure tenant_id is taken from the organization's external_id, never passed here. GCP static: {"client_id": ..., "client_secret": ..., "refresh_token": ...}. GCP service_account: {"service_a

  • external_id: stringrequired

    Cloud-side id: AWS organization id (o-...), Azure tenant id (UUID) or GCP numeric organization id (digits only, e.g. '123456789012').

  • metadata?: anyoptional

    Optional free-form metadata to store on the organization.

  • name: stringrequired

    Human-readable organization name (min 3 chars).

  • org_type: stringrequired

    Organization type: 'aws', 'azure' or 'gcp'.

  • secret_type?: anyoptional

    Type of org-level credentials. AWS requires 'role'; Azure requires 'static'; GCP accepts 'static' or 'service_account'. Must be provided together with credentials.

• prowler_cloud_create_scan_configurationoutputSchema declared

  Create a scan configuration and optionally attach it to providers. Returns the stored configuration as saved, including its full body and the providers it ended up attached to. Workflow: 1. Use prowler_cloud_get_scan_configuration_schema to learn the valid configuration structure. 2. Use prowler_app_search_providers to find provider ids. 3. Use this tool to create and attach the configuration.

  Input configuration: any, context: string, name: string, provider_ids?: array

  • configuration: anyrequired

    Scan configuration body: a two-level mapping of provider type -> (setting key -> value), e.g. {'aws': {'excluded_services': ['macie']}}. Accepts a dict or a JSON string. It is a partial OVERRIDE on top of Prowler's built-in defaults: include only the providers and keys you want to change; omitted providers/keys keep their defaults. Call prowler_cloud_get_scan_configuration_schema for the valid keys, types, and constraints.

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • name: stringrequired

    Human-readable name for the scan configuration (3-100 characters).

  • provider_ids?: arrayoptional

    Provider UUIDv4s to attach this configuration to. Providers not attached to any custom configuration use the built-in default.

• prowler_cloud_delete_alert_recipientoutputSchema declared

  Delete an alert recipient. WARNING: This is a destructive operation. The recipient stops receiving alerts; past alert events that referenced it remain queryable. Requires `manage_alerts`.

  Input context: string, recipient_id: string

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • recipient_id: stringrequired

    UUIDv4 of the recipient to delete.

• prowler_cloud_delete_alert_ruleoutputSchema declared

  Delete an alert rule. WARNING: This is a destructive operation. The rule stops firing immediately; past alert events remain queryable. Requires the `manage_alerts` permission.

  Input context: string, rule_id: string

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • rule_id: stringrequired

    UUIDv4 of the alert rule to delete.

• prowler_cloud_delete_finding_triage_noteoutputSchema declared

  Delete a note from a finding's triage. WARNING: This permanently removes the note and cannot be undone. Requires the `manage_scans` permission on the API key/role.

  Input context: string, finding_uid: string, note_id: string

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • finding_uid: stringrequired

    Stable finding UID.

  • note_id: stringrequired

    UUIDv4 of the note to delete. Get it from prowler_cloud_list_finding_triage_notes.

• prowler_cloud_delete_organizationoutputSchema declared

  Start deleting an organization. WARNING: This is a destructive operation. It deletes the organization, its entire OU/folder hierarchy, and marks EVERY linked provider as deleted — removing their scans and findings. It cannot be undone. To detach providers without deleting them, use prowler_cloud_manage_organization_providers first. IMPORTANT: the API task this waits on only marks the organization deleted and dispatches one deletion job per linked provider; the organization row itself is removed by a follow-up job once every provider finishes, and a failure there rolls the whole deletion back.

  Input context: string, organization_id: string

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • organization_id: stringrequired

    Organization UUIDv4. Get it from prowler_cloud_list_organizations.

• prowler_cloud_delete_scan_configurationoutputSchema declared

  Delete a scan configuration. WARNING: This is a destructive operation. Any providers currently attached to this configuration will fall back to the built-in default scan configuration.

  Input context: string, scan_configuration_id: string

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • scan_configuration_id: stringrequired

    UUIDv4 of the scan configuration to delete.

• prowler_cloud_delete_scan_scheduleoutputSchema declared

  Delete a provider's scan schedule. WARNING: This is a destructive operation - it stops recurring scans and resets the scan schedule to its unconfigured defaults. To temporarily stop scans instead, prefer prowler_cloud_set_scan_schedule with scan_enabled=False. Requires the `manage_scans` permission on the API key/role.

  Input context: string, provider_id: string

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • provider_id: stringrequired

    UUIDv4 of the provider whose scan schedule to delete.

• prowler_cloud_discover_organizationoutputSchema declared

  Discover the real structure of a cloud provider organization: AWS accounts and OUs, Azure subscriptions and management groups, or GCP projects and folders. Starts a discovery run (or checks an existing one when discovery_id is given) and waits up to wait_seconds for it to finish. On success it returns the discovered accounts/OUs (AWS), subscriptions/management groups (Azure) or projects/folders (GCP), each account, subscription or project with its registration state (`provider_exists`, `apply_status`, `blocked_reasons`) so you can choose what to onboard. If still running after the wait, it ret

  Input context: string, discovery_id?: any, organization_id: string, wait_seconds?: integer

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • discovery_id?: anyoptional

    Check an existing discovery instead of starting a new one. Use the id returned by a previous call that was still running.

  • organization_id: stringrequired

    Organization UUIDv4. Get it from prowler_cloud_list_organizations.

  • wait_seconds?: integeroptional

    How long to wait for the discovery to finish before returning its current status (0-120).

• prowler_cloud_get_alert_eventoutputSchema declared

  Retrieve a single alert event including its matched rule and scan.

  Input context: string, event_id: string

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • event_id: stringrequired

    UUIDv4 of the alert event to retrieve.

• prowler_cloud_get_alert_recipientoutputSchema declared

  Retrieve a single alert recipient with its confirmation status.

  Input context: string, recipient_id: string

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • recipient_id: stringrequired

    UUIDv4 of the recipient to retrieve.

• prowler_cloud_get_alert_ruleoutputSchema declared

  Retrieve an alert rule including its condition DSL and recipient emails.

  Input context: string, rule_id: string

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • rule_id: stringrequired

    UUIDv4 of the alert rule to retrieve.

• prowler_cloud_get_finding_triageoutputSchema declared

  Retrieve a single finding's triage state by finding UID.

  Input context: string, finding_uid: string

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • finding_uid: stringrequired

    Stable finding UID. Get it from prowler_app_search_security_findings or prowler_app_get_finding_details.

• prowler_cloud_get_organizationoutputSchema declared

  Get one organization in full: attributes, linked providers, credentials status, latest discovery and the OU/management-group/folder hierarchy. The `credentials` field only reports whether org-level credentials are stored and their type — secret values are write-only and never returned. `latest_discovery` carries counts and status only; for the discovered account/project lists use prowler_cloud_discover_organization with the discovery id.

  Input context: string, include_hierarchy?: boolean, organization_id: string

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • include_hierarchy?: booleanoptional

    Include the nested OU/management-group/folder tree. Set False to save calls on large organizations.

  • organization_id: stringrequired

    Organization UUIDv4. Get it from prowler_cloud_list_organizations.

• prowler_cloud_get_scan_configurationoutputSchema declared

  Retrieve a scan configuration including its full configuration body. The 'configuration' body follows the JSON Schema returned by prowler_cloud_get_scan_configuration_schema (one section per provider type).

  Input context: string, scan_configuration_id: string

  • context: stringrequired

    Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."

  • scan_configuration_id: stringrequired

    UUIDv4 of the scan configuration to retrieve. Use prowler_cloud_list_scan_configurations to find ids.