npm package: @modular-intelligence/prowler
Description: MCP server wrapping Prowler for AWS, Azure, and GCP security posture assessment
Latest version: 1.0.2

# Prowler MCP Server

Model Context Protocol (MCP) server for cloud security posture management using [Prowler](https://github.com/prowler-cloud/prowler). Provides security scanning capabilities for AWS, Azure, and GCP environments.

## Features

- **Multi-Cloud Support**: Scan AWS, Azure, and GCP environments
- **Comprehensive Scanning**: Run security checks across all cloud services
- **Compliance Frameworks**: Generate reports for CIS, PCI, HIPAA, GDPR, SOC2, NIST, and ISO27001
- **Detailed Findings**: Get severity levels, remediation guidance, and resource details
- **Dashboard Analytics**: Aggregate security metrics by severity and service
- **Read-Only**: All operations are read-only security assessments

## Prerequisites

### 1. Install Prowler CLI

```bash
# Using pip
pip install prowler

# Verify installation
prowler --version
```

### 2. Configure Cloud Credentials

Prowler uses standard cloud provider credential mechanisms:

#### AWS
```bash
export AWS_ACCESS_KEY_ID="your-access-key"
export AWS_SECRET_ACCESS_KEY="your-secret-key"
export AWS_SESSION_TOKEN="your-session-token"  # If using temporary credentials
```

Or use AWS CLI configuration:
```bash
aws configure
```

#### Azure
```bash
# Service Principal authentication
export AZURE_CLIENT_ID="your-client-id"
export AZURE_CLIENT_SECRET="your-client-secret"
export AZURE_TENANT_ID="your-tenant-id"
```

Or use Azure CLI:
```bash
az login
```

#### GCP
```bash
# Service account key file
export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account-key.json"

# Or specify project
export GCP_PROJECT_ID="your-project-id"
```

Or use gcloud CLI:
```bash
gcloud auth application-default login
```

## Installation

```bash
cd prowler
bun install
bun run build
```

## Usage

### Running the Server

```bash
bun run start
```

The server communicates over stdio and is designed to be used with MCP clients.

### Available Tools

#### 1. prowler_aws_scan
Scan AWS environment for security issues.

**Parameters:**
- `services` (optional): Array of services to scan (e.g., `["s3", "iam", "ec2"]`)
- `severity` (optional): Minimum severity level (`critical`, `high`, `medium`, `low`, `informational`)
- `region` (optional): AWS region to scan (e.g., `us-east-1`)
- `compliance` (optional): Compliance framework to check against
- `checks` (optional): Specific check IDs to run
- `timeout` (optional): Scan timeout in seconds (60-1800, default: 600)

**Example Response:**
```json
{
  "provider": "aws",
  "region": "us-east-1",
  "results": [
    {
      "check_id": "aws_s3_bucket_public",
      "check_title": "Check if S3 buckets are publicly accessible",
      "status": "FAIL",
      "severity": "high",
      "service": "s3",
      "resource_id": "my-public-bucket",
      "resource_arn": "arn:aws:s3:::my-public-bucket",
      "region": "us-east-1",
      "status_extended": "Bucket allows public access",
      "risk": "Data exposure risk",
      "remediation": "Disable public access in bucket settings"
    }
  ],
  "summary": {
    "pass": 150,
    "fail": 12,
    "manual": 3,
    "total": 165
  }
}
```

#### 2. prowler_azure_scan
Scan Azure environment for security issues.

**Parameters:**
- `services` (optional): Array of services to scan
- `severity` (optional): Minimum severity level
- `subscription` (optional): Azure subscription ID
- `compliance` (optional): Compliance framework
- `timeout` (optional): Scan timeout in seconds

#### 3. prowler_gcp_scan
Scan GCP environment for security issues.

**Parameters:**
- `services` (optional): Array of services to scan
- `severity` (optional): Minimum severity level
- `project` (optional): GCP project ID
- `compliance` (optional): Compliance framework
- `timeout` (optional): Scan timeout in seconds

#### 4. prowler_check_detail
Get detailed information about a specific security check.

**Parameters:**
- `check_id` (required): Prowler check ID (e.g., `aws_iam_1`)

**Example Response:**
```json
{
  "check_id": "aws_iam_1",
  "title": "Avoid the use of the root account",
  "description": "The root account has unrestricted access to all resources",
  "severity": "critical",
  "service": "iam",
  "provider": "aws",
  "remediation": "Create IAM users and assign least privilege permissions",
  "risk": "Compromise of root account credentials leads to full account takeover",
  "related_url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html",
  "compliance_frameworks": ["cis", "pci", "hipaa"]
}
```

#### 5. prowler_list_checks
List all available security checks for a cloud provider.

**Parameters:**
- `provider` (required): Cloud provider (`aws`, `azure`, `gcp`)
- `service` (optional): Filter by service name
- `severity` (optional): Filter by severity level

**Example Response:**
```json
{
  "checks": [
    {
      "id": "aws_iam_1",
      "title": "Avoid the use of the root account",
      "severity": "critical",
      "service": "iam"
    }
  ],
  "total": 234
}
```

#### 6. prowler_compliance_report
Generate a compliance report for a specific framework.

**Parameters:**
- `provider` (required): Cloud provider
- `framework` (required): Compliance framework (`cis`, `pci`, `hipaa`, `gdpr`, `soc2`, `nist_800_53`, `nist_csf`, `iso27001`, `aws_well_architected`)
- `region` (optional): Specific region to scan
- `timeout` (optional): Scan timeout in seconds

**Example Response:**
```json
{
  "framework": "cis",
  "provider": "aws",
  "requirements": [
    {
      "id": "1.1",
      "description": "Maintain current contact details",
      "status": "PASS",
      "checks_pass": 3,
      "checks_fail": 0
    },
    {
      "id": "1.2",
      "description": "Ensure security contact information is registered",
      "status": "FAIL",
      "checks_pass": 0,
      "checks_fail": 2
    }
  ],
  "compliance_score": 85,
  "total_pass": 42,
  "total_fail": 8
}
```

#### 7. prowler_dashboard_data
Get aggregated security metrics for dashboard visualization.

**Parameters:**
- `provider` (required): Cloud provider
- `timeout` (optional): Scan timeout in seconds

**Example Response:**
```json
{
  "provider": "aws",
  "scan_time": "2024-01-15T10:30:00Z",
  "total_checks": 234,
  "by_severity": {
    "critical": { "pass": 45, "fail": 2 },
    "high": { "pass": 89, "fail": 5 },
    "medium": { "pass": 78, "fail": 8 },
    "low": { "pass": 42, "fail": 3 },
    "informational": { "pass": 12, "fail": 0 }
  },
  "by_service": {
    "s3": { "pass": 25, "fail": 3 },
    "iam": { "pass": 18, "fail": 4 },
    "ec2": { "pass": 42, "fail": 2 }
  },
  "top_failing_checks": [
    {
      "id": "aws_s3_bucket_public",
      "title": "Check if S3 buckets are publicly accessible",
      "fail_count": 12
    }
  ],
  "overall_score": 92
}
```

## Security

### Read-Only Operations
All Prowler scans are read-only and do not modify cloud resources.

### Blocked Flags
The following Prowler flags are blocked for security:
- `--role` - Prevents role assumption
- `--session-duration` - Prevents session manipulation
- `--send-sh-only` - Blocks external notifications
- `--mutelist-file` / `--allowlist-file` - Prevents filter bypass
- `--slack` / `--security-hub` - Blocks external integrations

### Credential Management
- Credentials are provided via environment variables only
- No credentials are stored or logged by the MCP server
- Follow cloud provider security best practices for credential management

### Timeouts and Limits
- Maximum scan timeout: 1800 seconds (30 minutes)
- Maximum output buffer: 50 MB (cloud scans can be large)
- Commands are killed with SIGKILL on timeout

## Common Use Cases

### Quick Security Assessment
```typescript
// Scan AWS with high severity issues only
prowler_aws_scan({
  severity: "high",
  timeout: 300
})
```

### Compliance Audit
```typescript
// Generate PCI compliance report for AWS
prowler_compliance_report({
  provider: "aws",
  framework: "pci",
  timeout: 900
})
```

### Service-Specific Scan
```typescript
// Check only S3 and IAM in specific region
prowler_aws_scan({
  services: ["s3", "iam"],
  region: "us-east-1",
  timeout: 600
})
```

### Security Dashboard
```typescript
// Get aggregated metrics for dashboard
prowler_dashboard_data({
  provider: "aws",
  timeout: 1200
})
```

## Troubleshooting

### Prowler Not Found
```bash
# Verify Prowler is installed and in PATH
which prowler
prowler --version

# If not found, install it
pip install prowler
```

### Authentication Errors
```bash
# Test AWS credentials
aws sts get-caller-identity

# Test Azure credentials
az account show

# Test GCP credentials
gcloud auth list
```

### Timeout Issues
For large environments, increase the timeout parameter:
```typescript
prowler_aws_scan({
  timeout: 1800  // 30 minutes
})
```

### Large Output Handling
The server supports up to 50MB of JSON output. For very large environments, use filters:
```typescript
prowler_aws_scan({
  services: ["s3"],  // Scan one service at a time
  region: "us-east-1"  // Scan one region at a time
})
```

## Development

### Building
```bash
bun run build
```

### Testing
```bash
# Test AWS scan (requires AWS credentials)
echo '{"method":"tools/call","params":{"name":"prowler_aws_scan","arguments":{"severity":"critical"}}}' | bun run start

# Test check listing
echo '{"method":"tools/call","params":{"name":"prowler_list_checks","arguments":{"provider":"aws"}}}' | bun run start
```

## License

MIT

## Related Resources

- [Prowler Documentation](https://docs.prowler.cloud/)
- [MCP Protocol](https://modelcontextprotocol.io/)
- [AWS Security Best Practices](https://aws.amazon.com/security/security-best-practices/)
- [Azure Security Best Practices](https://docs.microsoft.com/azure/security/)
- [GCP Security Best Practices](https://cloud.google.com/security/best-practices)